Today, the importance of complying with data protection regulations seems evident, but this awareness is actually something very recent, with less than a decade of enforcement legalIndeed, in Brazil specifically, the General Data Protection Law (LGPD) only came into effect in 2020, and since then, much of what has been done is still insufficient in the context of expectations and what is understood to need to be done in the long term.

The Role of the ANPD and Building a Data Protection Culture

While data controllers, especially business entities providing services, public administration bodies, and often non-profit institutions, have been adapting since the publication of the LGPD (Brazilian General Data Protection Law) in 2018, the law also established a National Data Protection Authority (ANPD) with a central role in the implementation and oversight of the new regulation.

The ANPD (National Data Protection Authority) has been dedicated to regulating the rights of data subjects, creating detailed procedures so that these rights can be exercised. These rights include access to information, rectification of inaccurate data, erasure of unnecessary data, data portability, and objection to the processing of personal data. Establishing these procedures is important to ensure that data subjects can effectively exercise their prerogatives and that controllers know how to handle these requests appropriately and in accordance with legal expectations.

Therefore, A central focus of ANPD's activities is to foster a data protection culture in Brazil.To achieve this goal, the Authority has invested in educational and awareness initiatives aimed at both the general public and specific segments, such as the business sector and government. Holding workshops and seminars, as well as publishing guides and manuals, are strategies used by the ANPD to promote best practices and clarify doubts related to data protection. An example of this was... 1st National Meeting of Supervisors held in Brasilia in August 2024.

The challenge of attempting to institute a cultural change is enormous. This is especially true considering the Brazilian tendency to judicialize issues, particularly consumer matters – which are closely intertwined with the handling of personal data in daily life.

This is because, as is well known, the need for adaptation and updating is inherent to the data society and the connected world in which people are, for example, constantly updating their operating systems and replacing their hardware with more modern equipment – ​​which does not mean that the previous system or old device is defective or inadequate from a functional or legal point of view.

Empowering Data Subjects

Furthermore, protecting privacy in the digital age goes beyond technical and legal security; it is also a matter of empowering citizens.Therefore, an essential part of establishing a safe and adequate data protection culture is digital literacy, an effort that involves data controllers, the State, and each data subject.

When people understand the importance of protecting their personal data and know how to do so, they can make informed and assertive decisions about the use of their information. This not only reinforces the protection of individual privacy but also contributes to a more just and democratic society, where the rights of individuals are respected and protected.

Empowering citizens to understand and exercise their data protection rights in an informed and proactive manner fosters a culture of prevention and accountability that benefits both data subjects and data controllers. This movement eases pressure on the judicial system and strengthens the effectiveness of data protection regulations, helping to build a safer and more equitable digital environment.

It is vital that data processing agents take into account their role in digital education in their adaptation processes. "Internal" – thinking about employees – and "external" – thinking about society and its users/clients. This type of conduct is a strong indication of adherence to good practices (according to ANPD incentives) and has value within a well-established governance because it is a positive reputational reinforcement, including in terms of ESG.

It is important to bear in mind, after all, that the LGPD (Brazilian General Data Protection Law) is a law with a strong principled basis that promotes economic, technological and innovation development, but which does not relinquish fundamental pillars such as transparency, security, prevention, accountability, necessity and adequacy (among others enshrined in Article 6).

This means that the more closely data controllers adhere to the LGPD (Brazilian General Data Protection Law) regulations – which implies taking their legal compliance seriously – They tend to grow and increase in value in the market., with better chances of secure growth, including from a legal standpoint (considering the risk of litigation regarding issues related to the protection of personal data).

If data subjects have access to clear information through a functional and efficient flow of interaction with the data controller, the greater the chances that everyday issues will be resolved within the relationship between the two. In the event that this is not the case, the record of these flows and the demonstration of their adequacy by the latter will serve both for any eventual complaint or defense before the ANPD (National Data Protection Authority) and in the Judiciary, and more than that, will function as... A positive example of good practices that could guide or influence the future actions of these bodies regarding the matter.

Learn more about the regime of accountability created by ANPD here.