Interview Questions and Answers

Penalties can include fines, warnings, and partial or total suspension of data processing activities.

Example:

A company failing to implement security measures leading to a data breach may face significant fines.

Processing must have a lawful basis, such as consent, contract execution, legal obligation, protection of life, health, or legitimate interests.

Example:

A company can process personal data without consent if necessary for the performance of a contract with the data subject.

International transfers require compliance with LGPD, and adequate safeguards must be in place, such as Standard Contractual Clauses or approval from the National Data Protection Authority (ANPD).

Example:

A Brazilian company using a cloud service with servers located outside Brazil must ensure the transfer is legally compliant.

Data controllers must notify the National Data Protection Authority (ANPD) and data subjects about a data breach as soon as possible, providing details on the incident and possible measures to mitigate its effects.

Example:

A company experiencing a significant data breach promptly notifies ANPD and affected individuals about the incident.

Data subjects have the right to obtain information about the logic, significance, and consequences of automated decision-making processes and can request human intervention in these processes.

Example:

An individual denied a loan based on an automated credit scoring system has the right to understand the decision-making process.