Privacy and Personal Data
Protection
LGPD Compliance
- Advising private companies and public entities on comprehensive compliance projects under the Brazilian General Data Protection Law (LGPD), including the drafting and review of policies and documentation, implementation of privacy governance programs, and employee training.
- Drafting and reviewing privacy policies, privacy notices, terms of use, consent forms, questionnaires, and other documentation to ensure compliance with the LGPD and other applicable data protection laws.
- Adapting international privacy policies, terms of use, and related documentation to comply with Brazilian data protection legislation.
Advisory and Assessments
- Providing legal advice on privacy and data protection issues across a broad range of business activities.
- Advising on the development of products and services with a focus on privacy by design, personal data protection, cybersecurity, and technology.
- Preparing and reviewing Data Protection Impact Assessments (DPIAs).
- Preparing and reviewing Legitimate Interest Assessments (LIAs), Transfer Impact Assessments (TIAs) for international data transfers, and the documentation required to support cross-border data transfers.
- Assessing the maturity and effectiveness of existing privacy governance programs and organizations’ compliance with the LGPD.
- Reviewing Records of Processing Activities (ROPAs) and data mapping exercises to validate the legal bases for data processing.
- Assessing website compliance with the LGPD, including the use of cookies, privacy notices, and terms of use.
- Advising on the design and implementation of procedures for responding to data subject requests and exercising data subject rights under the LGPD.
- Providing strategic support in responding to data subject requests.
- Representing and advising clients in communications with the Brazilian National Data Protection Authority (ANPD), including matters involving data breaches, regulatory inquiries, and data subject rights.
- Advising on the investigation, notification, and management of personal data breaches, including coordination and negotiations with business partners.
- Assessing and developing incident response plans for cybersecurity incidents involving personal data.
- Conducting data protection due diligence on suppliers and business partners.
- Conducting data protection and cybersecurity due diligence in connection with mergers and acquisitions (M&A) and investment transactions.
Contracts and Policies
- Drafting, reviewing, and negotiating complex agreements involving the processing of personal data.
- Drafting and reviewing agreements, legal instruments, policies, and terms applicable to employees, contractors, clients, business partners, websites, and software.
- Drafting and reviewing privacy and data protection clauses for a wide range of legal instruments.
Training and Awareness
- Delivering privacy and data protection training programs for employees, business partners, and service providers.
- Preparing presentations, guidelines, and other awareness materials on privacy and data protection.
Data Protection Officer (DPO) Support
- Supporting the organization’s appointed Data Protection Officer (DPO) in carrying out their responsibilities, including providing legal advice on privacy and personal data protection matters.
Legal Opinions
- Preparing legal opinions regarding the legality and feasibility of business operations, products, and commercial arrangements under the LGPD and other applicable laws.
