Interview Questions and Answers

LGPD aims to protect the privacy and security of individuals' personal data.

Example:

For instance, individuals have the right to know what data is being collected and how it will be used.

Rights include access, correction, deletion, opposition, portability, and the right to revoke consent.

Example:

An individual may request to see the personal data a company holds about them and ask for corrections if needed.

LGPD applies to the processing of personal data carried out in Brazil or when the data relates to individuals located in Brazil.

Example:

A foreign company processing personal data of Brazilian citizens must comply with LGPD regulations.

ANPD is responsible for overseeing and enforcing LGPD, promoting awareness, and providing guidance on data protection matters.

Example:

ANPD may conduct investigations into data processing activities to ensure compliance with LGPD.

The key principles include legality, purpose, necessity, data quality, transparency, security, prevention, non-discrimination, accountability, and data subject rights.

Example:

Companies must ensure they collect data for specific, explicit, and legitimate purposes.

The DPO is responsible for ensuring compliance with LGPD, advising on data protection impact assessments, and serving as a point of contact for data subjects.

Example:

A DPO might conduct regular privacy audits to ensure data processing activities are in compliance.

A Data Processing Agent is a natural or legal person who processes personal data on behalf of another.

Example:

A company outsourcing its HR data processing to a third-party service is considered a Data Processing Agent.

Sensitive Personal Data includes information on racial or ethnic origin, religious belief, political opinion, health, sex life, genetic or biometric data, among others.

Example:

A company collecting health-related information needs to follow stricter rules under LGPD.

Organizations should implement technical and organizational measures to protect personal data, including encryption, access controls, and regular security assessments.

Example:

Using secure encryption protocols to safeguard sensitive data during transmission.

A Data Controller determines the purposes and means of personal data processing, while a Data Processor processes data on behalf of the Data Controller.

Example:

A company collecting customer data for its own marketing purposes is a Data Controller, while a cloud service managing that data is a Data Processor.

Consent must be freely given, specific, informed, and unambiguous. Organizations should use clear language, provide opt-in mechanisms, and allow individuals to easily withdraw consent.

Example:

A website asking users to subscribe to newsletters should have a clear checkbox for users to opt in, with a link to the privacy policy.

A Privacy Impact Assessment is a systematic evaluation of the potential impact of a data processing activity on individuals' privacy, helping organizations identify and mitigate risks.

Example:

Before implementing a new customer relationship management system, a company conducts a PIA to assess its impact on customer privacy.

Data minimization involves collecting only the necessary personal data for a specific purpose. Organizations should avoid excessive data collection and regularly review data storage practices.

Example:

A company that only collects and stores customer data necessary for order fulfillment demonstrates data minimization.

Accountability requires organizations to demonstrate compliance with LGPD principles and be able to provide evidence of effective data protection measures.

Example:

A company maintains detailed records of its data processing activities, risk assessments, and compliance efforts to demonstrate accountability.

Processing children's personal data requires specific consent from a parent or legal guardian, and the processing must be in the child's best interest.

Example:

An online platform collecting data from users under 13 years old obtains parental consent before processing any personal information.

Penalties can include fines, warnings, and partial or total suspension of data processing activities.

Example:

A company failing to implement security measures leading to a data breach may face significant fines.

Processing must have a lawful basis, such as consent, contract execution, legal obligation, protection of life, health, or legitimate interests.

Example:

A company can process personal data without consent if necessary for the performance of a contract with the data subject.

International transfers require compliance with LGPD, and adequate safeguards must be in place, such as Standard Contractual Clauses or approval from the National Data Protection Authority (ANPD).

Example:

A Brazilian company using a cloud service with servers located outside Brazil must ensure the transfer is legally compliant.

Data controllers must notify the National Data Protection Authority (ANPD) and data subjects about a data breach as soon as possible, providing details on the incident and possible measures to mitigate its effects.

Example:

A company experiencing a significant data breach promptly notifies ANPD and affected individuals about the incident.

Data subjects have the right to obtain information about the logic, significance, and consequences of automated decision-making processes and can request human intervention in these processes.

Example:

An individual denied a loan based on an automated credit scoring system has the right to understand the decision-making process.