Signed in August 2018, Law nº 13.709, known as the General Personal Data Protection Law (LGPD), which regulates the use and storage of personal information, came into effect on the 18th of September 2020, after being signed off by the President.
This date does not apply to articles 52, 53 and 54 of the LGPD, which bring administrative sanctions for non-compliance with the Law, which will only come into force on August 1st, 2021.
With the LGPD in force, the implementation of this new legislation has become more urgent and necessary. Although the administrative sanctions won’t come into effect until August 2021, the coming into effect of the law makes its penalties enforceable, including allowing civil liability for data processing agents vis-à-vis the holders of personal data, and further sanctions provided for in our legal system are still applicable, such as those in the Consumer Protection Code and the Internet Civil Framework.
Structuring of the ANPD
In addition, the Executive Branch recently issued Decree No. 10,474 / 20, approving the regulatory structure, the framework of mandated positions and functions of trust of the National Data Protection Authority (ANPD), the agency responsible for monitoring LGPD compliance in the country.
The decree will only enter into effect on the date of publication of the appointment of the ANPD’s director in the Official Gazette.
