We advise businesses on the development and enhancement of privacy and personal data protection programs, combining legal expertise, business insight, and an understanding of the technological challenges involved in data processing.
Key Areas of Practice
- LGPD Governance and Compliance Programs: Compliance assessments, personal data mapping, drafting of policies, privacy notices, and internal procedures, risk assessments, and implementation of governance programs and training.
- Regulatory Advice and Representation Before the ANPD: Interpretation of applicable legislation and regulations, monitoring of regulatory developments and guidance, handling of requests from the Brazilian Data Protection Authority (ANPD), and representation in supervisory and enforcement proceedings.
- Security Incidents and Crisis Response: Risk and impact assessments, guidance on notifications to the ANPD and affected data subjects, support in incident investigations, and development of containment and remediation measures.
- Contracts, Vendors, and Data Sharing: Drafting and reviewing data protection clauses and data processing agreements, vendor assessments, and allocation of responsibilities among data controllers, processors, and sub-processors.
- International Data Transfers: Analysis of international data flows, assessment of applicable legal transfer mechanisms, and drafting and review of contractual clauses for international data transfers.
- Data Subject Rights and Consumer Relations: Establishment of processes for handling data subject requests, review of privacy notices and transparency mechanisms, and advice on data subject complaints and inquiries from consumer protection authorities.
- Data Protection Officer (DPO) and Ongoing Legal Support: Advice to DPOs and internal teams, privacy assessments of new projects and products, guidance on day-to-day privacy matters, and updates to internal policies and procedures.
