Privacy and Personal Data
Protection

LGPD Compliance

• Advising private companies and public entities on comprehensive compliance projects under the Brazilian General Data Protection Law (LGPD), including the drafting and review of policies and documentation, implementation of privacy governance programs, and employee training.
• Drafting and reviewing privacy policies, privacy notices, terms of use, consent forms, questionnaires, and other documentation to ensure compliance with the LGPD and other applicable data protection laws.
• Adapting international privacy policies, terms of use, and related documentation to comply with Brazilian data protection legislation.

Advisory and Assessments

• Providing legal advice on privacy and data protection issues across a broad range of business activities.
• Advising on the development of products and services with a focus on privacy by design, personal data protection, cybersecurity, and technology.
• Preparing and reviewing Data Protection Impact Assessments (DPIAs).
• Preparing and reviewing Legitimate Interest Assessments (LIAs), Transfer Impact Assessments (TIAs) for international data transfers, and the documentation required to support cross-border data transfers.
• Assessing the maturity and effectiveness of existing privacy governance programs and organizations’ compliance with the LGPD.
• Reviewing Records of Processing Activities (ROPAs) and data mapping exercises to validate the legal bases for data processing.
• Assessing website compliance with the LGPD, including the use of cookies, privacy notices, and terms of use.
• Advising on the design and implementation of procedures for responding to data subject requests and exercising data subject rights under the LGPD.
• Providing strategic support in responding to data subject requests.
• Representing and advising clients in communications with the Brazilian National Data Protection Authority (ANPD), including matters involving data breaches, regulatory inquiries, and data subject rights.
• Advising on the investigation, notification, and management of personal data breaches, including coordination and negotiations with business partners.
• Assessing and developing incident response plans for cybersecurity incidents involving personal data.
• Conducting data protection due diligence on suppliers and business partners.
• Conducting data protection and cybersecurity due diligence in connection with mergers and acquisitions (M&A) and investment transactions.