By Data Protection, Technology and Cybersecurity Area

The Personal Data Protection Week is celebrated in the last week of January. It is a globally celebrated milestone and an important occasion for different areas to discuss the topic, carry out awareness campaigns, events, publications and other activities to spread the culture of data protection for the benefit of society.

Taking advantage of the commemorative date, the National Data Protection Authority (ANPD) published Resolution No. 02, of 01/27/2022, and regulated the application of the General Data Protection Law (LGPD) for small-sized processing agents, defined as “micro-companies, small-sized enterprises, startups, legal entities governed by private law, including non-profits, pursuant to the current legislation, as well as individuals and private entities without legal personality that process personal data, assuming typical obligations of a controller or operator”.

The Resolution makes the general rule provided for in the LGPD more flexible and creates easier mechanisms for small-sized processing agents, namely:

• The obligation to prepare and maintain a record of personal data processing operations may be fulfilled in a simplified manner;
• Flexibility or simplified procedure for reporting security incidents;
• No obligation to indicate the person in charge of the personal data processing, but the need to provide a communication channel with the data subject;
• Simplified information security policy, with essential requirements for the personal data processing, protecting them from unauthorized access and from accidental or unlawful situations of destruction, loss, alteration, communication, or improper or unlawful processing;
• Double deadline to:

• • Answer to requests from data subjects;
  • Communicate the occurrence of a security incident to the ANPD and the data subject;
  • Provide a clear and complete statement;
  • Submit information, documents, reports, and records requested by the ANPD.

By Diogo Souza Telho