LGPD compliance
Privacy program from data mapping to day-to-day routine.
- 01THE PROBLEMLGPD (Brazil's General Data Protection Law) obligations without clear owners, without data mapping or without a process to respond to data subjects.
- 02WHO IT IS FOROrganizations that process personal data and need to structure or review their privacy program.
- 03INTENDED OUTCOMEProcessing activities mapped, legal bases recorded, policies published and a working process for responding to data subjects.
FOR DECISION MAKERS
What changes for decision makers.
- FOR THECEOPrivacy as a business decision“An incident involving personal data becomes a problem with customers, the regulator and the press at the same time.”A program with clear owners, known risks and leadership kept informed.
- FOR THECFOExposure measured“Nobody knows how much of the privacy risk is already handled or how much remains.”A risk-prioritized plan, with progress visible at every periodic review.
- FOR THELegalLegal bases and contracts“Contracts, policies and legal bases reviewed case by case, without a view of the whole.”Processing activities mapped with a recorded legal basis and supplier contracts aligned.
- FOR THEDPOA program that sustains itself“The Data Protection Officer carries the program alone, with no inventory or routine.”Inventory, records and a maintenance routine that do not depend on one person.
PROCESS MAPPING
Every process, every data point, every purpose.
Compliance starts in the business units. We interview the people who run each process and record what data comes in, why, under which legal basis, for how long and with whom it is shared.
Scroll sideways to see the whole diagram
- HR
- Onboarding, payroll, benefits
- Sales
- CRM, proposals, events
- Customer service
- Customer support and ombudsman
- Finance
- Collections and billing
- IT
- Access, logs, backups
VISIBILITY
Eight pillars in n.360.
The program is tracked in n.360 in real time, pillar by pillar: what is done, what is in progress and who is accountable for each item. At each periodic review, leadership sees what has moved forward.
DATA LIFECYCLE
Five questions for each processing activity.
The mapping follows data from collection to deletion. Wherever a question goes unanswered, that is where the risk lies.
- STAGE 01CollectionWhat is the legal basis, and was the data subject informed?
- STAGE 02UseDoes the use respect the stated purpose?
- STAGE 03SharingIs there a contract with each processor and third party?
- STAGE 04StorageWhere is it kept, who has access and with what protection?
- STAGE 05DeletionWhen is it disposed of, and how is that proven?
WHAT THE PROGRAM COVERS
Beyond mapping.
The record of processing activities is the foundation. From it, each obligation gets an owner and evidence.
- ARTS. 7 AND 11Legal bases and consentLegal basis per processing activity; consent only when it is the appropriate basis, with records and withdrawal.
- ART. 18Data subject rightsRequest channel, identity verification and a complete response within 15 days.
- ARTS. 33 AND 39Processors and third partiesData protection clauses and international transfer assessment.
- ART. 48IncidentsResponse plan and notification to the ANPD and data subjects within the regulatory deadline.
- ART. 41Data Protection Officer (DPO)Appointment, public contact channel and a routine with business units.
- ART. 46Security and cultureTechnical and administrative measures proportional to risk, with training for business units.
WHAT SETS US APART
Why trustness.
- 01Eight pillarsData mapping; systems inventory; risks and data protection impact assessments; policies, standards and procedures; governance and structure; security controls audit; training and culture; monitoring and maintenance.
- 02From legal to ITThe program brings together legal, IT, HR and business areas: privacy does not stay only on paper or only in the system.
- 03Audited security controlsData security is verified in the controls, not just declared in the policy.
- 04Tracking in n.360Each pillar with an owner, evidence and status, in real time.
- 05Experience in compliance programs and DPOtrustness. runs LGPD (Brazil's General Data Protection Law) programs and serves as Data Protection Officer for organizations across sectors.
HOW IT WORKS
Stages of the work.
- 01Assessment and data mapping
- 02Prioritized compliance plan
- 03Policies, contracts and impact assessments
- 04Training and handover to routine operations
SCOPE
What is included.
Included3✓Mapping of in-scope processing activities✓Compliance plan✓Policy and record templates
Subject to contract3○Contract review with vendors○Additional impact assessments○Follow-up after compliance work
PEOPLE, TOOLS AND THIRD PARTIES
How we work with what you already have.
We work with legal, IT, HR and business units. The program can be tracked in n.privacy.
- 01Your teamLegal, IT, HR and business areas are accountable for their processing activities; trustness. runs the method.owners of processing activities
- 02Your DPOIf you already have one, trustness. works with them. If not, it can take on the role.kept or taken on
- 03SuppliersContracts and processors are included in the mapping and the plan.contracts aligned
| Activity | trustness. | Your team | Third parties |
|---|---|---|---|
| Data and systems mapping | coordinates | executes | — |
| Risks and data protection impact assessments | executes | approves | — |
| Policies, standards and procedures | executes | approves | — |
| Supplier contracts | supports | executes | supports |
| Training and culture | executes | supports | — |
HOW TO ENGAGE
Three models, as set in the contract.
- MODEL 01Compliance programA complete program, from mapping to routine, across the eight pillars.
- MODEL 02Posture assessmentAn assessment of where the organization stands and a risk-prioritized plan.
- MODEL 03AuditIndependent verification of the program and the controls already in place.
FREQUENTLY ASKED QUESTIONS
What people usually ask us.
How long does it take?
It depends on the scope and the number of processing activities. The compliance plan comes out of the assessment, with timelines per pillar.
Do we need a Data Protection Officer?
In most cases, yes. If there is nobody for the role, trustness. offers DPO as a Service.
Do you review contracts?
Yes, supplier contract review can be part of the scope, together with your legal team.
What happens after the compliance program?
The monitoring and maintenance pillar keeps the program alive, with tracking in n.360.
We already have part of the program. Do we need to start from scratch?
No. The posture assessment shows what already exists and what is missing; the plan starts from there.
Want to know if LGPD compliance fits your situation?
- conversation
- assessment
- proposal