The LGPD, or the Brazilian Data Protection Act, is a Brazilian privacy law that went into effect in August 2020. It regulates how the personal data of individuals in Brazil can be collected, used, and processed. The law affects Brazilian companies and any business that targets individuals who manage, uses, or processes the personal data of Brazilian citizens regardless of where the company is located. Essentially, this means the LGPD will apply to most organizations that process the personal data of Brazilian individuals irrespective of where they are established and where their processing activities occur.

While inspired by the GDPR, the law differs in several ways–beginning with the ten legal bases. The law grants enhanced rights to users and protects both data processed in Brazil and the personal data of Brazil-based users regardless of where the data controller is based.

 

Requirements Around The LGPD Protection Law

The Brazilian General Data Protection Law (LGPD) can be considered Brazil’s answer to the GDPR–with the Brazilian law aligning with the European Regulation while differing from others. It’s intended to replace or supplement its current dispersed legal landscape of over 40 federal sector-based norms with one main regulatory framework.

Security Incidents And The LGPD Law

The law determines security obligations for data processing data handlers and collectors. The LGPD imposes security obligations on data processing handlers and collectors, requiring reporting to the National Data Protection Authority (ANPD) and the data owners in security incidents. There are uncertainties about how this process will take place. To draw some general lines about the idea of security in the law is what the intention is.

Under LGPD, organizations must incorporate best practices in cybersecurity and data security for personal data. The LGPD notes that the law doesn’t apply to any personal data that’s encrypted or anonymized to the degree that makes it unintelligible and can’t quickly be returned to its original state by those who might breach the data.

9 Fundamental Rights For Consumer Data Under LGPD

 

LGPD (Brazilian General Data Protection Law) regulated the use of personal and sensitive data by companies. The law stipulates nine specific requirements data collectors need to ensure when handling consumer

• 1. Confirmation of data processing process and procedures.
• 2. Access to data
• 3. Correction of incomplete, inaccurate, or outdated data
• 4. Anonymizing, blocking, or deleting data
• 5. Data portability
• 6. Exclusion of personal data
• 7. Information about data sharing with other companies
• 8. Information about the possibility of not providing data
• 9. Withdrawal of consent

LGPD changes the routine of Brazilian and foreign companies. The law determines that companies operating in Brazil have more attention when dealing with information and personal data. It also stipulates rules that involve privacy and security.

LGPD will come into force in August 2020. As this is a new regulation, it has raised many questions, particularly from business owners and managers. Here are some essential guidelines and recommendations for any organization collecting information in Brazil.

• Choose a person to be responsible for the data.

LGPD determines companies to create the position of DPO (Data Protection Officer). The law calls the DPO the “person in charge.”

• Collect only information essential to your business

The law reinforces necessary data. Your company should only collect important information about your business.

• Be clear about data usage time.

Under the law, companies need to define a data lifetime. Personal data processing must end when the goal set by the company has been achieved.

• Adapt your website and any other data collection point

LGPD requires your company to be transparent. Companies need to make their intentions clear to the user when collecting and using specific data.

• Create a communication channel with customers and users

According to the law, customers need to know how their information has been used.

• In case of a data breach, inform the authority and the data owner

In security incidents cases, the law states that the company must notify the national sovereignty and the data subjects.

• Adopt attack and leak prevention and protection solutions

The law is apparent regarding information security. It requires companies to use technical and administrative measures to protect the data.

• Create a data protection impact report

There is a mention in the law that mentions a document called the Personal Data Protection Impact Report, which the data protection authority may request, including the National Data Protection Authority (ANPD).

LGPD Email Encryption Requirements

 

According to an article from the International Association of Privacy Professionals (IAPP), Brazil has drafted over 40 legal normalities on a federal level that deal with data privacy. The only downside of these laws is that they are sectoral, meaning that they’re related to specific industries and don’t cover all aspects at an overall level. Therefore, Brazil’s new data protection provides a more comprehensive legal, regulatory framework.

Under the LGPD, organizations must incorporate best practices in cybersecurity and data security for personal data. The LGPD notes that the law doesn’t apply to any personal data that’s encrypted or anonymized to the degree that makes it unintelligible and can’t quickly be returned to its original state by those who might breach the data.

Like GDPR and CCPA, LGPD does not explicitly require organizations to encrypt their data but still requires reasonable security when dealing with consumers’ personal information. The easiest and most efficient way to facilitate this is through encryption.

Role Of Data Loss Prevention In LGPD Compliance

 

DLP is an effective tool for managing sensitive data. Businesses involved with using or operating the PII of individuals must follow security guidelines to avoid penalties.

Data Loss Prevention solves three significant objectives that apply to most organizations.

• First, is the organization collecting and storing consumer users’ personally identifiable information?
• Second, does the organization have the process and capability to remove the client’s data upon request?
• Third, does the organization have a secure access policy to enable multi-factor authentication based on user actions?

DLP solutions like Trustifi can classify intellectual property in unstructured and structured forms. Data visibility helps organizations gain more insight into how individuals within an organization interact with data. DLP can remediate a variety of security challenges, including: 

• Data breaches cause damage to the brand, regulatory violations, and loss of trust with customers.
• Data Loss Prevention solutions require involving stakeholders.
• Data Loss Prevention solutions must be implemented correctly and well maintained.
• Data Loss Prevention solutions are complex. Encryption is necessary because it protects data.

Email Encryption And DLP – One Solution For LGPD Compliance

Management of DLP tools over time requires continuous evaluation and tuning. Over time, these tools become unmanaged and lose their effectiveness. Many organizations only turn on “the basic DLP” rules because of the lack of resources to manage the solution full-time. Hackers know this. The hacker community knows that most security adaptive controls rarely get fully deployed, except for organizations that spend big dollars outsourcing to an MSSP or MSP service.

The following events are some of the leading causes of data leaks in 2022.

1. Misconfigured Software Settings.
2. Social Engineering
3. Recycled Passwords
4. Poor Encryption
5. Software Vulnerabilities
6. Use of Default Passwords.

Gartner often references in their security reports the challenges of misconfigured security solutions impact expected outcomes of SecOps protection strategies.

Data Loss Prevention identified protected compliance content within the email message in parallel with email encryption. It instilled rules to prevent LGPD-protected data from leaving through the email channel by enacting email encryption to protect information attempting to leave the organization unprotected.

As the LGPD privacy compliance is implemented, enterprises need to review their security controls to ensure proper governance. The organizations should also review their policies around encryption, data sensitivity, and granular visibility.

Enterprises should review:

• Encrypt any email with LGPD information. Enabling DLP policies as a system-wide adaptive control will ensure all messages that match an LGPD  privacy rule encrypt the outbound message.
• The organization must enable policies and standards monitoring for risky behavior, external threats, and intentional violation of LGPD.

Email Encryption Solution From Trustifi

 

Trustifi One-Click Compliance™ and Data Loss Prevention features make it easy to prove LGPD compliance and ensure your data remains secure, even if a Brazilian data owner forgets to encrypt an email manually. The email administrator quickly selects which standards and Data Loss Prevention policies must comply with LGPD. Trustifi’s intelligent AI Engine will scan all outbound emails for sensitive content such as student records and automatically encrypt them.

With Trustifi’s One-Click Compliance™, the solution takes the complexity out of compliance.

For an additional layer of security between potential attackers and your sensitive data, you can request that recipients verify their identities via multi-factor authentication(MFA).

With Trustifi, LGPD data collectors can send secure encrypted emails without remembering to click the encrypt email button. Just as quickly, recipients open an encrypted email with a single click even if they don’t have Trustifi themselves.

The email administrator sets all the DLP and email encryption policies on the backend to prevent accidental data leakage of LGPD confidential information being sent externally. Other solutions require users to log in to a portal to access encrypted emails, adding complexity to sending and receiving messages.

“One-Click” Encrypt And Decrypt With Trustifi

Trustifi makes sending and opening emails simpler than ever. No log-ins, portals, or passwords are needed.

 

Groundbreaking Technology Supporting Optical Character Recognition Technology

 

Trustifi’s OCR technology uses machine learning to scan email attachments such as images and PDF files. It recognizes elements such as a credit card scan or a screenshot of a financial statement and categorizes those attachments as sensitive. The attachment files are automatically encrypted, reducing the opportunity for employees/individuals to transmit unprotected confidential material.

 

Emails Get Automatically Scanned

 

The system automatically scans outgoing emails, applies the rules your administrator sets, and then finds the https://trustifi.com/outbound/email-encryption/with no input from the user. This ensures that sensitive data and attachments are not at risk before they reach their intended recipient and are protected from the prying eyes of hackers.

 

Culture

 

Trustifi’s email security services feature a comprehensive suite of email tools for advanced threat protection, easily configurable Data Loss Prevention, and enterprise email encryption. Trustifi’s easy-to-use software is unmatched in its user-friendliness, flexibility, and cost-effectiveness. Trustifi’s time to value, ease of deployment, and lower cost of ownership for SecOps make the company culture secure and a financial match for any client seeking email security, data exfiltration, and message encryption.

Why Trustifi?

 

Trustifi is a cyber security firm featuring solutions delivered on software as a service platform. Trustifi leads the market with the easiest to use and deploy email security products, providing both inbound and outbound email security from a single vendor.

As a global cybersecurity provider of both inbound and outbound email protection, Trustifi currently supports customers from countries including the USA, Canada, Brazil, the Dominican Republic, the UK, the Netherlands, India, the UAE, China, and Japan, Cyprus, the Philippines, and more. The company has also developed “One-Click Compliance” capabilities that cater to world security regulations, including PDPO for Hong Kong, POPI for South Africa, GDPR for Europe, and LGPD for Brazil.