Brazil
3.1.1. Definition of personal data Personal data is defined as any information related to an identified or identifiable natural person. Under the LGPD, personal data encompasses not only directly identifying information, such as names and identification numbers, but also information that, when combined or utilized in conjunction, enables the identification of an individual. 3.1.2. Definition of different categories of personal data Sensitive personal data is classified as any personal information related to an individual's racial or ethnic origin, religious beliefs, political opinions, membership in trade unions, or religious, philosophical, or political organizations, as well as data concerning health, sexual life, and genetic or biometric details. The processing of these categories of personal data poses significant risks to an individual's fundamental rights and freedoms, necessitating a higher standard of protection under the Law. Anonymized data refers to information about a data subject that cannot be identified, considering the use of reasonable technical means available at the time of processing. The anonymized data falls outside the scope of the Law. 3.1.3. Processing of personal data and its different categories The LGPD mandates that the processing of personal or sensitive https://klalaw.com.br/en/home/
personal data must follow the legal bases established for each category of data, as detailed in Articles 7 and 11. Information on the legal bases can be found in Section 5.1 of this Guideline. 3.2 Statutory exemptions The LGPD and its regulations are designed to govern the processing of personal data about identified or identifiable natural persons. Consequently, data exclusively associated with legal entities (for example, the Brazilian National Registry of Legal Entities) falls outside the purview of the legislation. Furthermore, the LGPD does not apply to data processing that is conducted by natural persons solely for personal, non-commercial purposes, or data processed exclusively for journalistic, artistic, public security, national defense, state security, or in activities connected with the investigation and repression of crimes. Additionally, data originating from outside Brazil that is not subject to communication or shared use with Brazilian processing agents is also exempt from the scope of the LGPD. 3.3.Territorial and extra-territorial application Article 3 of the LGPD states that any processing activity conducted by a natural person or a legal entity is subject to the law, irrespective of where the entity is located or where the data resides.
Made with FlippingBook - PDF hosting