LGPD compliance, outsourced DPO and incident response
Brazil's General Data Protection Law (LGPD) is not met by publishing a policy on a website. It requires knowing which data the company processes, for what purpose and on what legal basis, who has access and what to do when something goes wrong. We build this program in proportion to the size and risk of the business.
Personal data of customers, staff and suppliers collected without clear mapping.
Vendors and systems accessing personal data without data protection clauses.
No data protection officer or channel to serve data subjects.
Data leak, unauthorized access or attack on systems.
Our data protection program starts with real mapping of processing activities: which data comes in, where it flows, where it is stored and with whom it is shared. Without this picture, policies and contracts are just paper.
Based on it, we prioritize what carries the most risk, adjust documents, contracts and routines and train teams. When an incident occurs, we handle legal containment, assess whether notification is required and manage communication with the Brazilian Data Protection Authority (ANPD) and data subjects.
The record of processing activities is the basis for defining legal bases, retention periods and security measures.
Technology, payroll, marketing and customer service vendors receive clear data protection clauses.
Employee and customer data are handled together with the labor and consumer law practices.
From assessment to an ongoing privacy program, including incident response.
Record of processing activities, identification of legal bases and gap analysis against the LGPD.
Internal policies, privacy notices, terms of use and cookie policies aligned with what the company actually does.
Data processing clauses and agreements with processors, setting obligations, security and liability.
Acting as the data protection officer (encarregado), serving data subjects and communicating with the ANPD.
Response plan, incident risk assessment, notice to the ANPD and data subjects when required, and recording of the event.
Training for managers and teams that handle personal data daily, focused on practical situations.
First conversation
In a first conversation, we understand the main processing activities and indicate compliance priorities.
Service via WhatsApp, in English or Portuguese
Talk to the LGPD and Data Protection team at Pilli & Fanucchi.
Meetings in Campinas or by videoconference, in English or Portuguese.
Tell us briefly about your company and its main question or need.
We schedule a call, a videoconference or an in-person meeting.
We indicate the possible paths and, if appropriate, present a fee proposal.
Briefly describe your company's need. One of our lawyers will get in touch.