On October 28, 2021, the Official Gazette published Resolution CD\/ANPD No. 1, approving the regulation that addresses the criteria for inspection and penalties to be applied in cases of non\u2011compliance with the Brazilian General Data Protection Law (“LGPD<\/u>“).<\/p>\n
The regulation applys to data subjects, processing agents, natural or legal persons, public or private law, and other parties concerned with the processing of personal data.<\/p>\n
The inspection of activities involving the processing of personal data includes monitoring<\/u>, guidance<\/u>, preventive action<\/u>, and, in some cases, repressive activity<\/u>:<\/p>\n
(i)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 The monitoring activity is intended to gather relevant information and data to support decision-making by the National Data Protection Authority (“ANPD<\/u>“) in order to ensure the full functioning of the regulated environment;<\/p>\n
(ii)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 The guidance activity is characterized by cost-effectiveness and the use of methods and tools aimed at promoting guidance, awareness, and education of data processors and data subjects;<\/p>\n
(iii)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Preventive activity consists of action based, preferably, on the joint construction and dialogue of solutions and measures aimed at bringing the processing agent back into full compliance or to avoid or remedy situations that could entail risk or damage to the personal data subjects and other processing agents;<\/p>\n
(iv)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 The repressive activity is characterized by the coercive actions of the ANPD, aimed at interrupting situations of damage or risk, bringing them back into full compliance, and punishing those responsible by applying the sanctions provided for in Article 52 of the LGPD, through an administrative sanctioning process.<\/p>\n