Brazil: Implemented General Data Protection Law (LGPD) including cybersecurity regulation

After an initial grace period, the Brazilian data protection law (Law N° 13.709) is fully implemented and can be enforced by the Brazilian courts and responsible agencies, with the possibility to apply the penalties contained in the law. The Law unifies over 40 different statutes governing personal data protection and establishes the National Data Protection Authority as the main enforcer. Moreover, the Law introduces the rights for data subjects (users). Among others, the users have a right to transfer personal data from one controller to another (data portability). Furthermore, the Law would require entities collecting and processing personal data to implement preventive, detective and responsive security measures and notify data breaches.