LGPD compliance for companies that process the personal data of people in Brazil
Brazil’s data protection law, the LGPD, does not apply only to Brazilian companies. It reaches any organization that processes the personal data of people in Brazil, or that offers goods and services to the Brazilian market, regardless of where that organization is based. Many U.S. companies find this out late: when a data subject exercises a right, when a corporate customer demands contractual guarantees, or when an incident happens.
Our job is to make this concrete. We map what data the company actually processes, identify where current practice falls outside the law, and deliver the documents and contract language that hold the compliance program together, rather than a general memo on what the statute says.
Our services
- Compliance gap assessment — where the company stands against the LGPD, and what is missing
- Data mapping and records of processing activities — what data, where it comes from, where it goes, how long it is kept
- Legal basis analysis — which lawful basis supports each processing activity, documented
- Policies and notices — privacy policy, notice to data subjects, cookie policy, internal data handling policy
- Data protection provisions in contracts — agreements with processors, vendors, and partners
- International data transfers — structuring transfers between Brazil and the United States
- Data subject requests — a workflow to receive and answer access, correction, and deletion requests within the statutory deadline
- Data protection impact assessments — where the processing requires one
- Incident response planning — what to do, who to notify, and how fast, including notification to Brazil’s data protection authority and to affected individuals
- Data Protection Officer as a service — acting as the point of contact between the company, data subjects, and the authority
- Team training — for the people who handle data day to day
Who we work with
- U.S. companies processing data of customers, employees, or users in Brazil
- Brazilian companies that need to come into compliance, or that have already received a demand from a client, a partner, or the authority
- Companies opening operations in Brazil that want to start compliant, which costs far less than fixing it later
- Startups and technology companies with users in both countries
In Partnership With Licensed U.S. Professionals
Our own practice is in Brazilian law. When a project also involves U.S. privacy legislation — state laws such as California’s, or sector-specific rules — we work alongside U.S.-licensed attorneys and coordinate both sides of the compliance program.
Start With the Assessment
Most companies do not know what data they hold. The assessment answers that within a few weeks and shows, in order of risk, what needs to be fixed first.
