Publications / Articles

Data processing according to the LGPD

Data processing according to the LGPD

Written by Paulo Rafael Guariglia Escanhoela . 23 . 09 . 2019 Published in Articles

The General Personal Data Protection Law (LGPD) is applicable to all persons, both individuals and corporate entities, that perform any form of personal data processing, as long as: i) it is done within national territory (Brazil); ii) it has as its goal the offer of goods or services or the treatment of data of individuals located within national territory; or iii) the personal data to be treated has been collected within national territory (Article 3 of LGPD).

As it can be seen, the application of the LGPD has a considerable reach, principally when the significant amplitude of the concept of personal data, already discussed in a previous article, is taken into account.

Therefore, to make possible the correct measure of the applicability of the LGPD, as well as to determine to which operations its dispositions are applicable and which obligations are attributed to those responsible for such operations, first we must understand what the legislation determines as data processing.

Processing, for the LGPD, is “every operation done with personal data, such as those referring to collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, elimination, evaluation or control of the information, modification, communication, transference, diffusion or extraction” (Article 5, Item X of the LGPD).

At first, it is important to note that, basically, processing is “every operation done with personal data”, being the rest of the definition contained in the law only an exemplifying list of situations that characterize processing, without, however, limiting such definition to the forms of processing listed.

That is, the performance of operations involving personal data not listed in the law also must observe the dispositions contained in the LGPD – even if they are new operations, which did not exist when the law entered in force.

Besides, the LGPD sets forth specific obligations that must be followed by each of the so called “processing agents”, who may be characterized as “controller” and/or “operator”.

Controller, in short, is the person to whom compete the decisions referring to the processing of personal data, and operator the person that effectively does the data processing, in name of the controller.

It must be noted that the same person may, depending on the data processing operation done, be, at the same time, in the position of controller and operator of the data processing, being, therefore, obligated to comply with the dispositions referring to both positions.

In face of that, it is recommended that persons, whether individuals or corporate entities, that do any form of data processing seek the help of professional with relevant technical knowledge, so that they may adequately verify which data processing operations they perform and their role in such operations, so that they may adopt the needed measures to comply with their legal obligations.