Data protection law is not just for companies that operate online

nila44

On Tuesday (14/8), the Presidency of the Republic sanctioned the General Data Protection Law (Law 13,709/2018), the first Brazilian legislation to specifically address the right to privacy.


Although it came in the wake of technological advances — and was greatly influenced by the recently approved European GDPR (General Data Protection Regulation) —, the standard does not only cover digital media. In its first article, the following is determined:

“Art. 1 This Law provides for the processing of personal data, including in digital media , by natural persons or legal entities governed by public or private law, with the aim of protecting the fundamental rights of freedom and privacy and the free development of the person's personality. natural” (emphasis added).

Article 3 reinforces:

“Art. 3 This Law applies to any processing B2B Lead operation carried out by a natural person or legal entity governed by public or private law, regardless of the medium , the country of its headquarters or the country where the data is located, provided that:

I – the processing operation is carried out within the national territory;

II – the purpose of the processing activity is to offer or supply goods or services or to process data from individuals located in the national territory;

III – the personal data subject to processing were collected in the national territory” (emphasis added).

Also according to the provision (article 5, item I), personal data would be “information related to the identified or identifiable natural person”. In other words, it applies to any and all information that allows someone to be identified (name, surname, address, etc.).

Sensitive personal data, subject to greater protection, are defined by section II of the same article:

“II – sensitive personal data: personal data on racial or ethnic origin, religious conviction, political opinion, membership of a trade union or organization of a religious, philosophical or political nature, data relating to health or sexual life, genetic data or biometric, when linked to a natural person”.



Although it is sometimes reported as something that affects companies linked to the internet, the standard covers all other means, including physical registrations and even manuscripts, and there is also no restriction on its applicability to people and companies that operate online.

Note, for example, the inclusion of health data in the list of “sensitive” data, which directly affects hospitals, offices, health plans, laboratories, drugstores, etc.