This Personal Data Protection and Privacy Glossary, prepared by the National Data Protection Agency (ANPD), aims at systematizing the main concepts related to terms and expressions widely used in personal data protection legislation, as well as in documents and other communications published by the ANPD. For its preparation, in addition to Law No. 13.709/2018 – the Brazilian Data Protection Law (LGPD), a wide range of technical and doctrinal documents issued by the ANPD were consulted.
In this regard, this Glossary aims at facilitating a common understanding of terms and expressions by data subjects and processing agents; contribute to the consolidation and standardization of these terms and expressions; and expand the compiled dissemination of terms that, although of general interest, are defined in different instruments. Due to its purpose of compiling the mentioned terms and expressions, innovative definitions or those that are subject to a regulatory process by the ANPD will not be considered within the scope of this Glossary.
In this context, the Personal Data Protection and Privacy Glossary will serve as a guiding document to enhance legal certainty, transparency, and effectiveness of the documents issued by the ANPD, while also optimizing understanding by data subjects and processing agents. It will highlight consolidated concepts and definitions based on publications under the regulatory framework established by the ANPD and in its guidance documents.
The definitions presented here refer exclusively to the normative scope of personal data protection and should not be confused with other legal definitions that may apply in different contexts.
This Glossary will remain open to comments and contributions on an ongoing basis, to be updated as definitions are established at the discretion of the ANPD. Suggestions may be sent to the ANPD Ombudsman through the Fala.BR platform (https://falabr.cgu.gov.br/).
A technical measure to ensure that data is accessed only by authorized individuals, consisting of authentication, authorization, and auditing processes.
Reference
ANPD - National Data Protection Authority. Guidance Guide on Information Security for Small Data Processing Agents. Version 1.0, 2021. 20 p. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/guia_seguranca_da_informacao_para_atpps_defeso_eleitoral.pdf. Accessed on: November 6, 2023.
(See page 10, item 34)
Request for mandatory compliance, by force of law, regulation or determination of public authority, to grant access to the Personal Data subject to the International Data Transfer governed by these Clauses.
Reference
BRAZIL. Resolution CD/ANPD No. 19, of August 23, 2024. Approves the Regulation on International Data Transfer and the content of standard contractual clauses. Official Gazette of the Union, Brasília, August 23, 2024. Section 1, p. 213.
(See item “r” of Clause 6 of the STANDARD CONTRACTUAL CLAUSES)
Decision by ANPD recognizing the equivalence of the level of personal data protection of a foreign country or an international organization with the national personal data protection legislation.
Reference
BRAZIL. Resolution CD/ANPD No. 19, of August 23, 2024. Approves the Regulation on International Data Transfer and the content of standard contractual clauses. Official Gazette of the Union, Brasília, August 23, 2024. Section 1, p. 213.
(See Article 10, heading)
Cookies used to collect information from the user for the purpose of displaying advertisements. More specifically, by collecting information about the user's browsing habits, advertising cookies allow for identification, profiling, and the display of personalized ads according to their interests.
Reference
ANPD - National Data Protection Authority. Guidance Guide: Cookies and personal data protection. Brasília: ANPD, Version 1.0, 2022. 39p. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/guia-orientativo-cookies-e-protecao-de-dados-pessoais.pdf. Accessed on: November 7, 2023.
(See page 11)
Categories of data processing agents and data subjects that may be most impacted by the effects of a given Regulatory Action.
Reference
BRAZIL. Ordinance No. 16, of July 8, 2021. Approves the regulatory process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, December 9, 2021. Section 1, p. 4.
(See item V of Article 3)
Personal data whose confidentiality, integrity, availability, or authenticity has been compromised in a security incident.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See item VII of Article 3)
Cookies that enable the collection of data and information about how users use the website, which pages they visit most frequently on that website, the occurrence of errors, or information about the performance of the website or application itself.
Reference
ANPD - National Data Protection Authority. Guidance Guide: Cookies and personal data protection. Brasília: ANPD, Version 1.0, 2022. 39p. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/guia-orientativo-cookies-e-protecao-de-dados-pessoais.pdf. Accessed on: November 7, 2023.
(See page 10)
Use of reasonable technical means available at the time of processing, by which a given data loses the possibility of direct or indirect association with an individual.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Law on the Protection of Personal Data (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item XI of Article 5)
Data related to a subject who cannot be identified considering the use of reasonable and available technical means at the time of its processing.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Law on the Protection of Personal Data (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item III of Article 5)
Property that ensures that the information was produced, issued, modified, or destroyed by a specific natural person, equipment, system, body, or entity.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See item II of Article 3)
The property by which it is ensured that personal data is accessible and usable, upon demand, by a natural person or a specific system, agency, or entity duly authorized.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See item XI of Article 3)
A proportionality assessment carried out by the controller based on the context and specific circumstances of the data processing, considering the impacts and risks to the rights and freedoms of the data subjects.
Reference
ANPD. Guideline: Legal Bases for Processing Personal Data - Legitimate Interest. Version 1.0, 2024. p. 52. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/guia_legitimo_interesse.pdf. Accessed on: February 6, 2024.
(See page 29)
A mechanism designed for international data transfers between organizations within the same group or corporate conglomerate, having a binding effect on all group members that adhere to them.
Reference
BRAZIL. Resolution CD/ANPD No. 19, of August 23, 2024. Approves the Regulation on International Data Transfer and the content of standard contractual clauses. Official Gazette of the Union, Brasília, August 23, 2024. Section 1, p. 213.
(See Article 25)
Temporary suspension of any processing operation, by means of retention of the personal data or database.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Law on the Protection of Personal Data (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item XIII of Article 5)
The highest governing body of the ANPD, composed of five Directors, including the Director-President, pursuant to Article 55-D of Law No. 13,709 of 2018.
Reference
BRAZIL. Ordinance CD/ANPD No. 1, of March 8, 2021. Establishes the Internal Regulations of the National Data Protection Authority – ANPD. Official Gazette of the Union, Brasília, March 9, 2021. Section 1, p. 3.
(See Article 3)
Law that regulates the processing of personal data, including in digital media, by natural persons or by public- or private-law legal entities, with the purpose of protecting the fundamental rights of freedom and privacy, as well as the free development of the personality of the natural person.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Law on the Protection of Personal Data (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See Article 1)
The area of operation of a company, group, or conglomerate of companies, as defined by the ANPD and verified in the specific case, which may be proven through the company's social object, National Classification of Economic Activities (CNAE) code, directly related service code, or similar instruments.
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See item VII of Article 2)
A simplified and discretionary instrument for consulting society, used for building knowledge on a given subject, gathering data, and developing regulatory proposals.
Reference
BRAZIL. Ordinance No. 16, dated July 8, 2021. Approves the regulation process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, December 9, 2021. Section 1, p. 4.
(See item IX of Article 3)
Classification of personal data according to the context of its use, such as personal identification data, system authentication data, and financial data.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See item III of Article 3)
Communication made to ANPD by any natural or legal person regarding an alleged violation of the country's personal data protection legislation, which does not constitute a data subject’s petition.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See item III of Article 4)
A preventive measure that must include, at a minimum:
I - object;
II - deadlines;
III - planned actions to reverse the identified situation;
IV - monitoring criteria;
V - and roadmap to achieve the expected results.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See Articles 32 and 36)
The property by which it is ensured that personal data is not available or disclosed to unauthorized persons, companies, systems, agencies or entities.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See item V of Article 3)
Any situation that could improperly compromise, influence, or affect the objectivity and technical judgment in the performance of the Data Protection Officer's duties.
Reference
BRAZIL. Resolution CD/ANPD No. 18, of July 16, 2024. Approves the Regulation on the role of the data protection officer. Official Gazette of the Union, Brasília, July 17, 2024. Section 1, p. 42.
(See item II of Article 2)
Files installed on a user's device that allow the collection of certain information, including personal data in some situations, for various purposes.
Reference
ANPD - National Data Protection Authority. Guidance Guide: Cookies and personal data protection. Brasília: ANPD, Version 1.0, 2022. 39p. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/guia-orientativo-cookies-e-protecao-de-dados-pessoais.pdf. Accessed on: November 7, 2023.
(See page 8)
Visual resource used in the design of applications or websites on the internet, which uses highlighted text bars to inform the data subject, in a summarized, simple and direct way, about the use of cookies in that environment.
Reference
ANPD - National Data Protection Authority. Guidance Guide: Cookies and personal data protection. Brasília: ANPD, Version 1.0, 2022. 39p. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/guia-orientativo-cookies-e-protecao-de-dados-pessoais.pdf. Accessed on: November 7, 2023.
(See page 28)
A public declaration providing users of a website or application with information about, among other aspects, the specific purposes of justifying the collection of data through cookies, the retention period, and whether data is shared with third parties.
Reference
ANPD - National Data Protection Authority. Guiding Document: Cookies and Personal Data Protection. Brasília: ANPD, Version 1.0, 2022. 39 p. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/guia-orientativo-cookies-e-protecao-de-dados-pessoais-pdf. Acesso em: 07 nov. 2023
(See page 28)
A freely given, informed, and unambiguous expression by which the data subject agrees to the processing of their personal data for a specific purpose.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Law on the Protection of Personal Data (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See Section XII of Article 5)
Natural person or legal entity of either public or private law in charge of making the decisions regarding the processing of personal data.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Law on the Protection of Personal Data (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item VI of Article 5)
Measures determined by the ANPD with the purpose of correcting the violation and bringing the offender back to full compliance with the LGPD and the regulations issued by the ANPD, which must be applied together with the warning sanction.
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See item V of Article 2)
Provision of computing services, including servers, storage, databases, networks, software, analytics, and intelligence, via the Internet ("the cloud").
Reference
ANPD. Guideline on Information Security for Small-Scale Data Processing Agents. Version 1.0, 2021. p. 20. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/guia_seguranca_da_informacao_para_atpps_defeso_eleitoral.pdf. Accessed on: November 6, 2023.
(See page 17, item 63)
A structured set of personal data, held in one or several locations, whether in electronic or physical media.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Law on the Protection of Personal Data (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item IV of Article 5)
A natural or legal entity of either public or private law that processes personal data on behalf of the data controller.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Data Protection Law (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See Item VII of Article 5)
Personal data whose secrecy arises from a legal norm or court decision.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See item IX of Article 3)
Documentation from the data controller that contains a description of the personal data processing activities that may pose risks to civil liberties and fundamental rights, as well as measures, safeguards, and risk mitigation mechanisms.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Data Protection Law (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item XVII of Article 5)
Person appointed by the controller and processor to act as a communication channel between the controller, data subjects, and the National Data Protection Agency (ANPD).
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Law on the Protection of Personal Data (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item VIII of Article 5)
A natural person to whom the personal data being processed refers.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Data Protection Law (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item V of Article 5)
A communication made to ANPD by a data subject regarding a request submitted to the data controller that was not resolved within the timeframe established by regulation.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See item V of Article 4)
Express decision on matters not covered by the other deliberative instruments provided in Article 51 of Ordinance CD/ANPD No. 1, of March 8, 2021.
Reference
BRAZIL. Ordinance CD/ANPD No. 1, of March 8, 2021. Establishes the Internal Regulations of the National Data Protection Authority – ANPD. Official Gazette of the Union, Brasília, March 9, 2021. Section 1, p. 3.
(See item III of Article 51)
Regulated agent who, once sufficient indications of an infringing conduct have been identified, is subjected to an administrative sanctioning proceeding initiated through a notice of infraction.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See item II of Article 4)
Extent of the damage and the loss caused, pursuant to article 54 of the LGPD.
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See Paragraph 2 of Article 16)
A decision-making procedure of the Board of Directors characterized by the collection of votes electronically, without the need to hold a Deliberative Meeting.
Reference
BRAZIL. Ordinance CD/ANPD No. 1, of March 8, 2021. Establishes the Internal Regulations of the National Data Protection Authority – ANPD. Official Gazette of the Union, Brasília, March 9, 2021. Section 1, p. 3.
(See Article 40)
Party or a Third-Party Controller, under the terms of CLAUSE 4, designated to fulfill specific obligations regarding transparency, Data Subjects’ rights and notifying security incidents.
Reference
BRAZIL. Resolution CD/ANPD No. 19, of August 23, 2024. Approves the Regulation on International Data Transfer and the content of standard contractual clauses. Official Gazette of the Union, Brasília, August 23, 2024. Section 1, p. 213.
(See Clause 6, Paragraph "p", of the STANDARD CONTRACTUAL CLAUSES)
A preventive measure aimed at disclosing aggregated sectoral information and performance data on the ANPD’s website, such as the problem-resolution rate and the number of data subject’s requests that have been fulfilled.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See Articles 32 and 33)
Monitoring, guidance, and preventive action, in accordance with the procedures set out in Resolution CD/ANPD No. 1, of October 28, 2021.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See Article 2)
Standard contractual clauses from other countries or international organizations recognized by the ANPD as equivalent to the clauses provided for in Annex II of Resolution CD/ANPD No. 19, of August 23, 2024.
Reference
BRAZIL. Resolution CD/ANPD No. 19, of August 23, 2024. Approves the Regulation on International Data Transfer and the content of standard contractual clauses. Official Gazette of the Union, Brasília, August 23, 2024. Section 1, p. 213.
(See Article 18, heading)
Removal of data or a set of data stored in a database, regardless of the procedure used.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Law on the Protection of Personal Data (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item XIV of Article 5)
Processing agent, located in the national territory or in a foreign country, that transfers personal data to the importer.
Reference
BRAZIL. Resolution CD/ANPD No. 19, of August 23, 2024. Approves the Regulation on International Data Transfer and the content of standard contractual clauses. Official Gazette of the Union, Brasília, August 23, 2024. Section 1, p. 213.
(See item I of Article 3)
The attribute of a definitive decision rendered in a sanctioning administrative process within the scope of the ANPD , making it unchangeable and indisputable within the process in which it was issued.
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See item X of Article 2)
Personal data related to the financial transactions of the holder, including contracting services and purchasing products.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See item VII of Article 3)
Cookies set directly by the website or application the user is visiting. These types of cookies may include information such as login credentials, shopping cart items, or preferred language.
Reference
ANPD - National Data Protection Authority. Guidance Guide: Cookies and personal data protection. Brasília: ANPD, Version 1.0, 2022. 39p. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/guia-orientativo-cookies-e-protecao-de-dados-pessoais.pdf. Accessed on: November 7, 2023.
(See page 9)
A written, dated, and signed document that clearly and unequivocally demonstrates the data controller's intention to designate a natural person or a legal entity as the data protection officer.
Reference
Brazil. Resolution CD/ANPD No. 18, of July 16, 2024. Approves the Regulation on the role of the data protection officer. Official Gazette of the Union, Brasília, July 17, 2024. Section 1, p. 42.
(See Paragraph 1 of Article 3)
Measure that may be determined by the ANPD to the controller, pursuant to Article 48, Paragraph 2, item I, of the Law No. 13,709, of August 14, 2018, within the scope of the security incident report process, such as publication on the controller's website, social networks, or other media.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See item I of Article 3)
Cookies used to provide basic services requested by the user and to enable remembering site or application preferences, such as username, region, or language.
Reference
ANPD - National Data Protection Authority. Guidance Guide: Cookies and personal data protection. Brasília: ANPD, Version 1.0, 2022. 39p. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/guia-orientativo-cookies-e-protecao-de-dados-pessoais.pdf. Accessed on: November 7, 2023.
(See page 11)
The commission of an offense by the same offender, regardless of the legal or regulatory provision, within a period of 5 (five) years, counted from the final judgment of the administrative sanctioning process until the date of the new offense, excluding the provisions in item VIII of Article 2 of Resolution CD/ANPD No. 4, dated February 24, 2023.
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See item IX of Article 2)
Internal rules and processes that ensure comprehensive compliance with personal data protection legislation, established and implemented by the data controller through the adoption of:
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See item VI of Article 2)
Set of companies, de facto or de jure, with their own legal personalities, under the direction, control, or management of a natural or legal entity/person, or even a group of people who hold, separately or jointly, control power over the others, since integrated interest, effective communion of interests, and joint action of the companies that are part of are demonstrated.
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See item I of Article 2)
Processing of personal data that meets, cumulatively, at least one general criterion and one specific criterion from the following:
I. general criteria:
II. specific criteria:
Reference
BRAZIL. Resolution CD/ANPD No. 2, of January 27, 2022. Approves the Regulation for the implementation of Law No. 13.709, of August 14, 2018, the General Data Protection Law (LGPD), for small-scale data processing agents. Official Gazette of the Union, Brasilia, January 28, 2022. Section 1, p. 6.
(See Article 4)
Processing agent, located in a foreign country or that is an international organization, who receives personal data transferred by the exporter.
Reference
BRAZIL. Resolution CD/ANPD No. 19, of August 23, 2024. Approves the Regulation on International Data Transfer and the content of standard contractual clauses. Official Gazette of the Union, Brasília, August 23, 2024. Section 1, p. 213.
(See item II of Article 3)
Document provided by the controller containing copies, in physical or digital form, of relevant data and information to describe the incident and the measures adopted to reverse or mitigate its effects.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See item XIX of Article 3)
The basis of the LGPD, as stipulated in item II of Article 2, which grants data subjects the right to control their own personal data, based on the principles of good faith and transparency.
Reference
TSE - Superior Electoral Court, ANPD – National Data Protection Authority. Guidance Guide: Application of the General Data Protection Law (LGPD) by data processing agents in the electoral context. Brasília: TSE, 2021. 65p. Available at: https://www.gov.br/anpd/pt-br/documentos-e- publicacoes/guia_lgpd_final.pdf . Accessed on: November 8, 2023.
(See page 38, item 86)
A set of guidelines and rules aimed at enabling the planning, implementation, and control of actions related to information security within an organization.
Reference
ANPD - National Data Protection Authority. Guidance Guide on Information Security for Small Data Processing Agents. Version 1.0, 2021. 20 p. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/guia_seguranca_da_informacao_para_atpps_defeso_eleitoral.pdf. Accessed on: November 6, 2023.
(See page 8, item 21)
Property that ensures that the personal data has not been modified or destroyed in an unauthorized or accidental manner.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See item XIII of Article 3)
Collection of personal data from the data subject carried out directly by the processing agent located abroad.
Reference
BRAZIL. Resolution CD/ANPD No. 19, of August 23, 2024. Approves the Regulation on International Data Transfer and the content of standard contractual clauses. Official Gazette of the Union, Brasília, August 23, 2024. Section 1, p. 213.
(See item V of Article 3)
The transfer of personal data to a foreign country or international organization of which the country is a member.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Data Protection Law (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item XV of Article 5)
Hypotheses provided in items I to IX of article 33 of Law No. 13,709, of August 14, 2018, which authorize an international data transfer.
Reference
BRAZIL. Resolution CD/ANPD No. 19, of August 23, 2024. Approves the Regulation on International Data Transfer and the content of standard contractual clauses. Official Gazette of the Union, Brasília, August 23, 2024. Section 1, p. 213.
(See Article 3 item VIII)
Organization governed by public international law, including its subordinate bodies or any other body created through an agreement signed between two or more countries.
Reference
BRAZIL. Resolution CD/ANPD No. 19, of August 23, 2024. Approves the Regulation on International Data Transfer and the content of standard contractual clauses. Official Gazette of the Union, Brasília, August 23, 2024. Section 1, p. 213.
(See Article 3 item IX)
Joint, common, or convergent determination, by two or more controllers, of the purposes and essential elements for carrying out the processing of personal data, through an agreement that establishes their respective responsibilities regarding compliance with the LGPD.
Reference
ANPD - National Data Protection Authority. Guidance Guide for Defining Personal Data Processing Agents and the Data Protection Officer. Version 2.0, 2022. 26 p. Available at: https://www.gov.br/anpd/pt-br/documentos-e- publicacoes/guia_agentes_de_tratamento_e_encarregado defe so_eleitoral.pdf. Accessed on: November 8, 2023.
(See page 14, item 48)
The one that involves a significant number of data subjects, also considering the volume of data involved, as well as the duration, frequency, and geographic location of the data subjects.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See Paragraph 2 of Article 5)
Processing of personal data that covers a significant number of data subjects, taking into account the volume of data involved, as well as the duration, frequency, and geographical scope of the processing carried out.
Reference
BRAZIL. Resolution CD/ANPD No. 2, of January 27, 2022. Approves the Regulation for the implementation of Law No. 13.709, of August 14, 2018, the General Data Protection Law (LGPD), for small-scale data processing agents. Official Gazette of the Union, Brasilia, January 28, 2022. Section 1, p. 6.
(See Paragraph 1 of Article 4)
The reasonable expectation of the data subject, which must be demonstrated by the controller, that the processing of personal data for the intended purpose is what would be expected in the specific circumstances.
Reference
ANPD - National Data Protection Authority. Guidance Guide: Legal Basis for Processing Personal Data - Legitimate Interest. Version 1.0, 2024. 52 p. Available at: https://www.gov.br/anpd/pt-br/documentos-e- publicacoes/guia_legitimo_interesse.pdf. Accessed on: February 6, 2024.
(See page 23)
Legal hypothesis that authorizes the processing of non-sensitive personal data when necessary to meet the interests of the controller or a third party, provided that they are compatible with the legal system, based on concrete situations, and linked to legitimate, specific, and explicit purposes, except in cases when the fundamental rights and liberties of the data subject prevail and require the protection of personal data, respecting the rights and legitimate expectations of the data subject.
References
BRAZIL. Law No. 13.709, of August 14, 2018. General Law on the Protection of Personal Data (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See Article 7 item IX)
ANPD - National Data Protection Authority. Guidance Guide: Processing of personal data by the Public Sector. Brasília: ANPD, Version 2.0, 2023. 51 p. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/documentos-de-publicacoes/guia-poder-publico-anpd-versao-final.pdf. Accessed on: November 8, 2023.
(See page 13)
ANPD - National Data Protection Authority. Guidance Guide: Legal Basis for Processing Personal Data - Legitimate Interest. Version 1.0, 2024. 52 p. Available at: https://www.gov.br/anpd/pt-br/documentos-e- publicacoes/guia_legitimo_interesse.pdf. Accessed on: February 6, 2024.
(See page 16)
Business corporation, simple partnership, single-member limited liability company, as defined in article 41 of Law No. 14,195, of August 26, 2021, and the entrepreneur referred to in article 966 of Law No. 10,406, of January 10, 2002 (Civil Code), including the individual micro-entrepreneur, duly registered in the Commercial Registry or in the Civil Registry of Legal Entities, that falls within the terms of articles 3 and 18-A, §1 of Complementary Law No. 123, of December 14, 2006.
Reference
BRAZIL. Resolution CD/ANPD No. 2, of January 27, 2022. Approves the Regulation for the application of Law No. 13,709, of August 14, 2018, General Law on the Protection of Personal Data (LGPD), for small-scale data processing agents. Official Gazette of the Union, Brasília, January 28, 2022. Section 1, p. 6.
(See item II of Article 2)
Record of deliberations made by the Board of Directors, based on the votes of its Directors, in Meetings and Deliberative Circuits.
Reference
BRAZIL. Ordinance CD/ANPD No. 1, of March 8, 2021. Establishes the Internal Regulations of the National Data Protection Authority – ANPD. Official Gazette of the Union, Brasília, March 9, 2021. Section 1, p. 3.
(See item IV of Article 51)
Violation that does not fall under any of the hypotheses related to moderate or severe violations.
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See Paragraph 1 of Article 8)
Violation that significantly affects the interests and fundamental rights of data subjects, characterized in situations in which the processing activity may significantly prevent or limit the exercise of rights or the use of a service, as well as cause material or moral damage to the data subjects, such as discrimination; violation of physical integrity; infringements of the rights to image and reputation; financial fraud or identity misuse, provided that it is not classified as severe.
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See Paragraph 2 of Article 8)
Collection of relevant information and data to support decision-making by ANPD to ensure the regular functioning of the regulated environment.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See Paragraph 1 of Article 15)
A monitoring instrument for the evaluation, accountability, and planning of the ANPD’s enforcement activity.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See Articles 19 and 20)
Advisory body of the ANPD (National Data Protection Agency) whose composition and powers are defined by Law No. 13.709 of 2018 and Decree No. 10.474 of 2020.
Reference
BRAZIL. Ordinance CD/ANPD No. 1, of March 8, 2021. Establishes the Internal Regulations of the National Data Protection Authority – ANPD. Official Gazette of the Union, Brasília, March 9, 2021. Section 1, p. 3.
(See Article 8)
A special autonomous government agency, endowed with technical and decision-making independence, possessing its own assets, and headquartered and legally domiciled in the Federal District, responsible for overseeing, implementing, and supervising compliance with Law No. 13,709, of August 14, 2018, throughout the national territory.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Law on the Protection of Personal Data (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59. (adapted)
(See Article 55-A, and item XIX of Article 5)
Classification of personal data as general or sensitive.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See item XV of Article 3)
Cookies used to enable the website or application to perform basic functions and operate correctly.
Reference
ANPD - National Data Protection Authority. Guidance Guide: Cookies and personal data protection. Brasília: ANPD, Version 1.0, 2022. 39p. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/guia-orientativo-cookies-e-protecao-de-dados-pessoais.pdf. Accessed on: November 7, 2023.
(See page 10)
Cookies that do not meet the definition of necessary cookies and whose disabling does not prevent the website or application from functioning or the user from using the services.
Reference
ANPD - National Data Protection Authority. Guidance Guide: Cookies and personal data protection. Brasília: ANPD, Version 1.0, 2022. 39p. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/guia-orientativo-cookies-e-protecao-de-dados-pessoais.pdf. Accessed on: November 7, 2023.
(See page 10)
Preventive measure intended for situations in which regularization must take place within a specified period of time and whose complexity does not justify the preparation of a compliance plan. It shall contain a description of the situation and sufficient information for the processing agent to be able to identify the necessary measures, and the agent must provide proof of regularization within the specified period. The notice will be used when a violation occurs as a result of the processing of personal data by public bodies.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See Article 32 and paragraphs 1 and 2 of Article 35, heading)
An act, whether commissive or omissive, direct or indirect, of the enforcement or of its representatives, which prevents, hinders or embarrasses the enforcement activity carried out by ANPD, by offering obstacles to the agent's situation, refusing to provide answers, and failing to send or sending in a untimely manner any data and information pertinent to the regulated agent's obligation.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See Item IV of Article 4)
Processing agent who commits a violation.
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See item IV of Article 2)
Transfer of Personal Data, within the same country or to another country, by an Importer to a third-party, including a Sub-processor, provided that it does not constitute an Access Request.
Reference
BRAZIL. Resolution CD/ANPD No. 19, of August 23, 2024. Approves the Regulation on International Data Transfer and the content of standard contractual clauses. Official Gazette of the Union, Brasília, August 23, 2024. Section 1, p. 213.
(See item “x” of Clause 6 of the STANDARD CONTRACTUAL CLAUSES)
Action based on cost-effectiveness and on the use of methods and tools that aim to promote guidance, awareness, and education of processing agents and data subjects.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See Paragraph 2 of Article 15)
Information regarding an identified or identifiable natural person.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Law on the Protection of Personal Data (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item I of Article 5)
Infringing conduct that extends over time, through action or omission of the offender regarding the same normative provision.
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See item III of Article 2)
It encompasses bodies and entities of the Executive Branch as well as the Legislative and Judicial Branches, at any level, including the Courts of Accounts and the Public Prosecutor's Office, provided they are acting in the exercise of administrative functions.
Reference
ANPD - National Data Protection Authority. Guidance Guide: Processing of personal data by the Public Sector. Brasília: ANPD, Version 2.0, 2023. 51 p. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/documentos-de-publicacoes/guia-poder-publico-anpd-versao-final.pdf. Accessed on: November 8, 2023.
(See page 19)
A procedure initiated to carry out preliminary investigations when the evidence of an infraction is not sufficient to immediately initiate a sanctioning administrative process.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See Article 40)
The demonstration by the data controller of the adoption of effective measures capable of proving compliance with personal data protection regulations, including the effectiveness of those measures.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Data Protection Law (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
The compatibility of data processing with the purposes informed to the data subject, in accordance with the context of the processing.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Data Protection Law (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item II of Article 6)
The guarantee to data subjects of the accuracy, clarity, relevance, and updating of data, in accordance with the needs and for the purpose of its processing.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Data Protection Law (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item V of Article 6)
The guarantee, to data subjects, of easy and free access to information about the form and duration of data processing, as well as the completeness of their personal data.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Data Protection Law (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See Item IV of Article 6)
The limitation of data processing to the minimum necessary to achieve its purposes, ensuring that the data collected is relevant, proportional, and not excessive in relation to the objectives of the data processing.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Data Protection Law (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item III of Article 6)
The impossibility of processing data for discriminatory, unlawful, or abusive purposes.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Data Protection Law (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item IX of Article 6)
The adoption of measures to prevent the occurrence of harm resulting from the processing of personal data.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Data Protection Law (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item VIII of Article 6)
Data processing must be carried out for legitimate, specific, explicit purposes that are informed to the data subject, with no possibility of further processing in a way that is incompatible with those purposes.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Data Protection Law (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item I of Article 6)
The use of technical and administrative measures capable of protecting personal data from unauthorized access and from accidental or unlawful situations involving destruction, loss, alteration, communication, or dissemination.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Data Protection Law (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item VII of Article 6)
The guarantee, to data subjects, of clear, precise, and easily accessible information about the data processing activities and the respective data controllers, while respecting commercial and industrial secrecy.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Data Protection Law (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item VI of Article 6)
Biannual monitoring instrument that establishes the priority themes that will be considered by the ANPD for the purposes of studying and planning its enforcement activities for the period.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See Articles 19 and 21)
An instrument capable of demonstrating the integrity and commitment of the data controller to adopt internal processes and policies that ensure comprehensive compliance with standards and best practices regarding personal data protection. In this context, it is important to highlight some key processes and policies for personal data governance.
Reference
TSE - Superior Electoral Court, ANPD – National Data Protection Authority. Guiding Document: Application of the General Data Protection Law (LGPD) by data controllers in the electoral context. Brasília: TSE, 2021. 65p. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/guia_lgpd_final.pdf. Acesso em: 08 nov. 2023.
(See page 33, item 71)
Any operation performed on personal data, such as collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, elimination, evaluation or control of information, modification, communication, transfer, dissemination, or extraction.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Data Protection Law (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item X of Article 5)
The controller and the processor.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Law on the Protection of Personal Data (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item IX of Article 5)
This refers to processing activities that could prevent the exercise of rights or the use of a service, as well as cause material or moral harm to the data subjects, such as discrimination, violation of physical integrity, the right to image and reputation, financial fraud, or identity theft.
Reference
BRAZIL. Resolution CD/ANPD No. 2, of January 27, 2022. Approves the Regulation for the implementation of Law No. 13.709, of August 14, 2018, the General Data Protection Law (LGPD), for small-scale data processing agents. Official Gazette of the Union, Brasilia, January 28, 2022. Section 1, p. 6.
(See Paragraph 2 of Article 4)
Action, preferably, based on the joint and dialogical construction of solutions and measures aimed at bringing the processing agent back into full compliance or at avoiding or remedying situations that may entail risk or damage to the data subjects and other processing agents.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See Paragraph 3 of Article 15)
A processing method by which data loses the possibility to be associated, directly or indirectly, with an individual, except through the use of additional information kept separately by the controller in a controlled and secure environment.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Data Protection Law (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See Paragraph 4 of Article 13)
An explicit decision that submits a proposed regulatory act, document, or matter to public criticism and suggestions.
Reference
BRAZIL. Ordinance CD/ANPD No. 1, of March 8, 2021. Establishes the Internal Regulations of the National Data Protection Authority – ANPD. Official Gazette of the Union, Brasília, March 9, 2021. Section 1, p. 3.
(See Section V of Article 51)
Debate or oral presentation on a matter of relevant interest, as defined by the Board of Directors or the National Council for the Protection of Personal Data and Privacy.
Reference
BRAZIL. Ordinance CD/ANPD No. 1, of March 8, 2021. Establishes the Internal Regulations of the National Data Protection Authority - ANPD. Official Gazette of the Union, Brasília, March 9, 2021. Section 1, p. 3.
(See Article 59)
Spaces open to the public, such as squares, shopping centers, public streets, bus, subway, and train stations, airports, ports, public libraries, among others.
Reference
BRAZIL. Resolution CD/ANPD No. 2, of January 27, 2022. Approves the Regulation for the implementation of Law No. 13.709, of August 14, 2018, the General Data Protection Law (LGPD), for small-scale data processing agents. Official Gazette of the Union, Brasilia, January 28, 2022. Section 1, p. 6.
(See item IV of Article 2)
Any form of intervention by the ANPD (National Data Protection Agency) regarding the environment and data processing agents aimed at regulatory activities, such as issuing normative acts, conducting public consultations, and public hearings.
Reference
BRAZIL. Ordinance No. 16, of July 8, 2021. Approves the regulatory process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, December 9, 2021. Section 1, p. 4.
(See item I of Article 3)
Instrument used by the Board of Directors to plan and set priorities for the ANPD’s Regulatory Actions within a given period.
Reference
BRAZIL. Ordinance No. 16, of July 8, 2021. Approves the regulatory process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, December 9, 2021. Section 1, p. 4.
(See item II of Article 3)
Processing agents and other parties involved in or interested in the processing of personal data.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See item I of Article 4)
A procedure, beginning with the identification of the regulatory problem, consisting of a prior evaluation before the issuance of normative acts referred to in Decree No. 10,411 of June 30, 2020, which shall contain information and data about their probable effects, in order to assess the reasonableness of the impact and support decision-making.
Reference
BRAZIL. Ordinance No. 16, of July 8, 2021. Approves the regulatory process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, Dec. 9, 2021. Section 1, p. 4.
(See item III of Article 3)
The act of closing the Regulatory Impact Analysis (AIR), which must include the elements that supported the choice of the most appropriate alternative to address the identified regulatory problem and, if applicable, the draft of the normative act to be issued.
Reference
BRAZIL. Ordinance No. 16, dated July 8, 2021. Approves the regulation process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, December 9, 2021. Section 1, p. 4.
(See item VIII of Article 3)
Verification of the effects resulting from the issuance of a regulatory act, considering the achievement of the originally intended objectives and other impacts observed on the market and society as a result of its implementation.
Reference
BRAZIL. Ordinance No. 16, of July 8, 2021. Approves the regulatory process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, December 9, 2021. Section 1, p. 4.
(See item IV of Article 3)
A contractual instrument signed between the Parties or, at least, between one of them and a third-party, including a Third-Party Controller, that shares a common purpose, linkage, or dependency relationship with the contract governing the International Data Transfer.
Reference
BRAZIL. Resolution CD/ANPD No. 19, of August 23, 2024. Approves the Regulation on International Data Transfer and the content of the standard contractual clauses. Official Gazette of the Union, Brasília, August 23, 2024. Section 1, p. 213.
(See Clause 6, Item"d", of the STANDARD CONTRACTUAL CLAUSES)
Act of the controller notifying the ANPD and the data subject of the occurrence of a security incident that may result in risk or significant harm to data subjects.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See item IV of Article 3)
ANPD's coercive action, aimed at interrupting situations of damage or risk, restoring full compliance and punishing those responsible by applying the sanctions provided for in Article 52 of the LGPD, through administrative sanctioning process.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See Paragraph 4 of Article 15)
A set of types of communication, including the petition from the data subject and the complaint.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See item VI of Article 4)
A preventive measure aimed at situations where regularization must occur within a specified timeframe, and where the complexity does not warrant the creation of a compliance plan. It will include a description of the situation and sufficient information for the data processing agent to identify the necessary actions, and the agent must demonstrate regularization within the determined timeframe.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See Article 32, and paragraph 2 and the heading of Article 35)
A body or entity of the direct or indirect public administration, or a non-profit legal entity under Brazilian law, with its headquarters and jurisdiction in Brazil, whose institutional mission or social/statutory purpose includes basic or applied research of a historical, scientific, technological, or statistical nature.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Data Protection Law (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item XVIII of Article 5)
A decision regarding the normative provision within the scope of the ANPD’s authority.
Reference
BRAZIL. Ordinance CD/ANPD No. 1, of March 8, 2021. Establishes the Internal Regulations of the National Data Protection Authority – ANPD. Official Gazette of the Union, Brasília, March 9, 2021. Section 1, p. 3.
(See item I of Article 51)
Business company, headquartered in Brazil, which is liable for any violation of binding corporate rules, even when such violation results from an act committed by a member of the corporate group or conglomerate headquartered in another country.
Reference
BRAZIL. Resolution CD/ANPD No. 19, of August 23, 2024. Approves the Regulation on International Data Transfer and the content of standard contractual clauses. Official Gazette of the Union, Brasília, August 23, 2024. Section 1, p. 213.
(See item VII of Article 3)
A process intended for investigating violations of data protection legislation under the jurisdiction of the ANPD, in accordance with Article 55-J, IV, of the LGPD.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See Article 37)
A sanction consisting of the temporary suspension of any processing operations with the personal data related to the violation, by storing the data until the violator regularizes their conduct.
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See Paragraph 1 of Article 22)
A sanction consisting of the deletion of data or a set of data stored in a database, regardless of the procedure used.
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See Paragraph 1 of Article 23)
A sanction that consists of the partial or total prohibition of personal data processing operations. This sanction may be applied in the following cases:
I - In the event of recurrence of a violation previously punished with the partial suspension of database operation or the suspension of the exercise of personal data processing activity;
II - When personal data is processed for unlawful purposes or without legal grounds;
III - When the violator loses or fails to meet the technical and operational conditions necessary to maintain proper personal data processing.
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See items I, II, and III of Article 26)
A sanction that suspends the operation of a database that is not in compliance with personal data protection legislation. This sanction will be applied for a maximum period of 6 (six) months, extendable for an equal period, until the data processing activity is regularized by the data controller, considering the complexity of the regularization process and the classification of the violation.
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See Paragraphs 1 and 2 of Article 24)
A sanction consisting of the public disclosure of the violation by the violator themselves, after the occurrence of the violation has been duly investigated and confirmed.
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See Paragraph 1 of Article 20)
A sanction that suspends the exercise of personal data processing activities related to the violation, in order to ensure compliance with legal and regulatory standards. This sanction will be applied for a maximum period of 6 (six) months, extendable for an equal period.
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See Paragraph 1 of Article 25)
Any confirmed adverse event related to the violation of the confidentiality, integrity, availability, and authenticity of personal data security.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See item XII of Article 3)
Procedure instituted by ANPD to investigate the occurrence of a security incident that has not been reported by the controller.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See item XVI of Article 3)
The administrative report process instituted within the scope of the ANPD that encompasses both the investigation and notification procedures for security incidents.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See Article 3, item XVIII)
Procedure instituted within the scope of the ANPD after receiving a security incident report.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See item XVII of Article 3)
When it may significantly affect the interests and fundamental rights of data subjects and, cumulatively, involves at least one of the following criteria:
I - sensitive personal data.
II - data of children, adolescents, or elderly people.
III - financial data;
IV - authentication data in systems;
V - data protected by legal, judicial, or professional secrecy; or
VI - large-scale data.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See Article 5, heading and clauses)
Technical and/or administrative measures adopted to protect personal data from unauthorized access and accidental or unlawful situations of destruction, loss, alteration, communication, or dissemination.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See item XIV of Article 3)
Cookies designed to collect and temporarily store information while users access a website. They are typically deleted once the session ends, that is, when the user closes the browser. They are commonly used to store information that is only necessary for providing a service requested by users or for a specific, temporary purpose.
Reference
ANPD - National Data Protection Authority. Guidance Guide: Cookies and personal data protection. Brasília: ANPD, Version 1.0, 2022. 39p. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/guia-orientativo-cookies-e-protecao-de-dados-pessoais.pdf. Accessed on: November 7, 2023.
(See page 11)
Personal data concerning racial or ethnic origin, religious belief, political opinion, affiliation to trade unions or to a religious, philosophical, or political organization, data relating to health or sexual life, and genetic or biometric data, when linked to a natural person.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Law on the Protection of Personal Data (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item II of Article 5)
The violation shall be considered severe when:
I - the hypothesis of a medium-level infringement are present and, cumulatively, at least, one of the following condition applies:
II – it constitutes obstruction to the enforcement activity.
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59..
(See Paragraph 3 of Article 8)
Communication, dissemination, international transfer, interconnection of personal data, or shared processing of personal data databases by public agencies and entities in the performance of their legal duties, or between them and private entities, reciprocally, with specific authorization, for one or more processing operations allowed by these public entities, or between private entities.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Data Protection Law (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See item XVI of Article 5)
Microenterprises, small businesses, startups, and private legal entities, including nonprofit organizations, in accordance with the applicable legislation, as well as natural persons and unincorporated private entities that carry out personal data processing activities, assuming the typical obligations of a controller or processor.
Reference
BRAZIL. Resolution CD/ANPD No. 2, of January 27, 2022. Approves the Regulation for the application of Law No. 13.709, of August 14, 2018, General Law on the Protection of Personal Data (LGPD), for small-scale data processing agents. Official Gazette of the Union, Brasília, January 28, 2022. Section 1, p. 6.
(See item I of Article 2)
Mechanism for international data transfer in which the controller may request ANPD to approve specific contractual clauses, which offer and prove guarantees of compliance with the principles, the rights of the data subject and the data protection regime provided in Law No. 13,709, of August 14, 2018, and in this Regulation, provided that the international data transfer cannot be carried out based on standard contractual clauses, due de facto or de jure exceptional circumstances, duly proven by the controller.
Reference
BRAZIL. Resolution CD/ANPD No. 19, of August 23, 2024. Approves the Regulation on International Data Transfer and the content of standard contractual clauses. Official Gazette of the Union, Brasília, August 23, 2024. Section 1, p. 213.
(See Paragraph 1 of Article 21 and heading)
The repetition of an offense by the same offender against the same legal or regulatory provision, within a period of 5 (five) years, counted from the final judgment of the administrative sanctioning process until the date of the new offense.
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See item VIII of Article 2)
International data transfer mechanism that establishes minimum guarantees and valid conditions for carrying out international data transfers and that presupposes the full and unmodified adoption of the text available in Annex II of the Regulation on International Data Transfers, approved by Resolution No. 19, of August 23, 2024.
Reference
BRAZIL. Resolution CD/ANPD No. 19, of August 23, 2024. Approves the Regulation on International Data Transfer and the content of standard contractual clauses. Official Gazette of the Union, Brasília, August 23, 2024. Section 1, p. 213.
(See Articles 15 and 16)
Expresses a decision regarding the interpretation of personal data protection legislation and establishes an understanding on matters within the ANPD's competence, with binding effect on the Agency.
Reference
BRAZIL. Ordinance CD/ANPD No. 1, of March 8, 2021. Establishes the Internal Regulations of the National Data Protection Authority – ANPD. Official Gazette of the Union, Brasília, March 9, 2021. Section 1, p. 3.
(See item II of Article 51)
Processing agent hired by the Importer, with no link with the Exporter, to process Personal Data after an International Data Transfer.
Reference
BRAZIL. Resolution CD/ANPD No. 19, of August 23, 2024. Approves the Regulation on International Data Transfer and the content of standard contractual clauses. Official Gazette of the Union, Brasília, August 23, 2024. Section 1, p. 213.
(See item “s” of Clause 6 of the STANDARD CONTRACTUAL CLAUSES)
A party contracted by the data processor to assist in processing personal data on behalf of the controller.
Reference
ANPD. Guideline for Definitions of Data Processing Agents and the Data Protection Officer. Version 2.0, 2022. p. 26. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/guia_agentes_de_tratamento_e_encarregado_defeso_eleitoral.pdf. Accessed on: November 8, 2023
(See page 19, item 65)
Any personal data used as a credential to determine access to a system or to confirm a user's identification, such as login accounts, tokens and passwords.
Reference
BRAZIL. Resolution CD/ANPD No. 15, of April 27, 2024. Approves the Regulation on Reporting Security Incident. Official Gazette of the Union, Brasília, April 28, 2024. Section 1, p. 114.
(See item VI of Article 3)
Business or corporate organizations, either newly established or recently in operation, whose activities are characterized by innovation applied to business models or the products or services offered, meeting the criteria set forth in Chapter II of Complementary Law No. 182, dated June 1, 2021.
Reference
BRAZIL. Resolution CD/ANPD No. 2, of January 27, 2022. Approves the Regulation for the implementation of Law No. 13.709, of August 14, 2018, the General Data Protection Law (LGPD), for small-scale data processing agents. Official Gazette of the Union, Brasilia, January 28, 2022. Section 1, p. 6.
(See item III of Article 2)
Measures able to protect the personal data from unauthorized access and from accidental or unlawful situations of destruction, loss, alteration, communication, or any form of improper or unlawful processing.
Reference
BRAZIL. Law No. 13.709, of August 14, 2018. General Law on the Protection of Personal Data (LGPD). Official Gazette of the Union, Brasília, August 15, 2018. Section 1, p. 59.
(See Article 46)
Personal Data Controller who authorizes and provides written instructions for the carrying out of the International Data Transfer between Processors governed by these Clauses, on his behalf, pursuant to Clause 4 (“Option B”).
Reference
BRAZIL. Resolution CD/ANPD No. 19, of August 23, 2024. Approves the Regulation on International Data Transfer and the content of standard contractual clauses. Official Gazette of the Union, Brasília, August 23, 2024. Section 1, p. 213.
(See item “t” of Clause 6 of the STANDARD CONTRACTUAL CLAUSES)
Cookies created by a domain that is different from the one the user is visiting. They result from functionalities of other domains that are incorporated into a web page, such as the display of advertisements.
Reference
ANPD - National Data Protection Authority. Guidance Guide: Cookies and personal data protection. Brasília: ANPD, Version 1.0, 2022. 39p. Available at: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/guia-orientativo-cookies-e-protecao-de-dados-pessoais.pdf. Accessed on: November 7, 2023.
(See page 9)
Processing operation through which a processing agent transmits, shares, or provides access to personal data to another processing agent.
Reference
BRAZIL. Resolution CD/ANPD No. 19, of August 23, 2024. Approves the Regulation on International Data Transfer and the content of standard contractual clauses. Official Gazette of the Union, Brasília, August 23, 2024. Section 1, p. 213.
(See Article 3, Item III)
Non-compliance with an obligation established in Law º 13,709, of August 14, 2018 (LGPD), and in the regulations issued by the ANPD
Reference
BRAZIL. Resolution CD/ANPD No. 4, of February 24, 2023. Approves the Regulation for the Dosimetry and Application of Administrative Sanctions. Official Gazette of the Union, Brasília, February 27, 2023. Section 1, p. 59.
(See item II of Article 2)
A preventive measure that contains a description of the situation and sufficient information for the processing agent to be able to identify the necessary measures.
Reference
BRAZIL. Resolution CD/ANPD No. 1, of October 28, 2021. Approves the Regulation of the Enforcement Process and the Administrative Sanctioning Process within the scope of the National Data Protection Authority. Official Gazette of the Union, Brasília, October 29, 2021. Section 1, p. 6.
(See Articles 32 and 34)