EXIN LGPD Essentials flashcards
EXIN LGPD Essentials · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- LGPD entry into force
- The LGPD (Lei 13.709/2018) entered into force on 18 September 2020, with administrative sanctions applicable from 1 August 2021.
- Anonymized data
- Data that cannot be linked to an individual, using reasonable and available technical means, and therefore falls outside the LGPD's scope.
- Sensitive personal data
- Data on racial or ethnic origin, religious belief, political opinion, union membership, health, sex life, genetic or biometric data, subject to stricter legal bases.
- Territorial scope
- The LGPD applies to processing carried out in Brazil, aimed at offering goods or services to individuals in Brazil, or where data was collected in Brazil.
- Controller
- The natural or legal person, public or private, responsible for decisions regarding the processing of personal data.
- Processor
- The natural or legal person, public or private, that processes personal data on behalf of the controller.
- Legal bases for processing
- The ten grounds in Article 7, including consent, legal obligation, contract performance, legitimate interest, and protection of life.
- Consent requirements
- Consent must be free, informed, and unambiguous, given for specific purposes, and can be revoked at any time by the data subject.
- Sensitive data legal bases
- Article 11 provides a narrower list, requiring specific and highlighted consent or other strict grounds for sensitive data processing.
- Legitimate interest
- A legal basis requiring a balancing test between the controller's legitimate purpose and the data subject's reasonable expectations and rights.
- Access request deadline
- The controller must respond to a data subject's access request within 15 days, providing clear information about the data and processing.
- Data subject rights
- Rights include confirmation, access, correction, anonymization, portability, deletion, information about sharing, and revocation of consent.
- Right to deletion limits
- Deletion of consent-based data may be refused where retention is required by legal obligation or another legal basis.
- Accountability principle
- The controller must demonstrate compliance with the LGPD, including through records, policies, and impact assessments.
- Records of processing
- The controller must maintain records of processing operations, especially when relying on legitimate interest, kept for at least five years.
- Processor liability
- The processor is jointly liable when it fails to comply with the law or lawful instructions, and directly liable when acting outside them.
- International data transfers
- Transfers are allowed to adequate countries or via standard clauses, binding corporate rules, specific consent, or other Article 33 exceptions.
- Impact assessment (RIPD)
- A data protection impact assessment required for high-risk processing and when requested by ANPD, documenting risks and mitigation measures.
- Security measures
- Controllers and processors must adopt technical and administrative measures appropriate to the risk, such as encryption and access control.
- Data processing agreement
- A contract defining purpose, duration, scope, security measures, and sub-processor rules between controller and processor.
- DPO appointment
- The controller appoints a DPO (encarregado), a natural person who may be internal or external, with autonomy and access to processing operations.
- DPO duties
- The DPO accepts complaints from data subjects, provides clarifications, receives ANPD communications, and advises staff on data protection practices.
- DPO public disclosure
- The DPO's identity and contact information must be published clearly, typically on the controller's website and in the privacy notice.
- DPO liability
- The DPO is not personally liable for the controller's processing; liability rests with the controller and processor.
- ANPD Resolution 18/2024
- A rule setting requirements for DPO appointment, including the possibility of a legal entity or shared DPO arrangements.
- DPO role in incidents
- The DPO supports the incident response workflow and communication with data subjects and ANPD during breach handling.
- Incident notification trigger
- Notification to ANPD and data subjects is required when a security incident may cause relevant risk or damage to data subjects.
- Incident notification deadline
- Under ANPD Resolution 15/2024, the controller must notify ANPD within 3 business days of learning of the incident, extendable with justification.
- Incident report content
- The report must describe the data, affected subjects, security measures, risks, and mitigation measures taken.
- ANPD fines
- Fines may reach 2% of the company's revenue in Brazil, capped at R$ 50 million per infraction, plus daily fines.
- Other ANPD sanctions
- Sanctions include warning, publicizing the infraction, blocking or deletion of data, and suspension of processing activities.
- ANPD enforcement factors
- Sanctions consider good faith, cooperation, extent of damage, and the existence of a compliance program.