General Data Protection Law is enacted in Brazil
On August 14, 2018, Law No. 13,709/2018 – the General Data Protection Law was enacted to regulate the protection of personal data in Brazil.
The new legislation was inspired by the European Union’s General Data Protection Regulation (GDPR) and establishes similar provisions, such as the definition of personal data as any information that allows the identification of an individual and the need to obtain previous and explicit consent from the data subject.
Among the main vetoes is the rejection of the creation of the National Data Protection Authority (ANPD), an entity that would be part of the Ministry of Justice to guide and supervise the interpretation and enforcement of the law.
Fines in case of breach of the law will be of up to 2% of the incomes received by the private company, group or conglomerate in the last fiscal year, limited to R$ 50,000,000 (approximately USD 13,5000,000).
Law No. 13,709/2018 was published in the Official Gazette on August 15, 2018 and will enter into force in 18 months.