Arquivos DPO Outsourcing - Pryor Global

LGPD: Dosimetria para Aplicação de Penalidade e Início dos Julgamentos

prylocawp23 prylocawp23 — Sun, 02 Apr 2023 13:33:29 +0000

In 2018, Law No. 13,709/18, the General Data Protection Law (LGPD) was published, regulating the protection of personal data in Brazil, following an international trend, and inspired by the General Data Protection Regulation (GDPR), a standard that regulates data protection in the European Union (EU). With the sanction of the LGPD, we have taken an important step to protect a precious asset of society, its personal data.

Since September 2020, after the legal vacancy, an adaptation period for companies, the law has been applicable to legal entities of public and private law, protecting the data considered to be of a personal nature, whether in physical or digital media.

The full application of the law, however, depended on the regulation that would define the dosimetry of the sanctions established in the LGPD. Without the application of penalties, the legal standard becomes a dead letter.

On February 27, 2023, in order to guarantee the application of the law and safeguard the right to the protection of personal data, the National Data Protection Authority (ANDP), the national authority responsible for the supervision and application of penalties related to non-compliance with the law, published the Regulation on Dosimetry and Application of Administrative Penalties (Resolution CD/ANPD no. 4, of February 24, 2023), establishing the criteria and parameters for the application of administrative sanctions to which companies are subject if they fail to comply with the law, in addition to defining procedures for the calculation of the base value of fines, complying with the determination of article 53 of LGPD.

The publication of the regulation is certainly one of the most important milestones since the publication of the LGPD, because the parameters used to impose sanctions by the national authority become clear.

One of the aspects analyzed to apply the penalty in case of non-compliance with LGPD is the damage or harm that the company has caused to the data subjects. The regulation aims to ensure balance between the seriousness of the agent’s conduct and the sanction applied.

Warning;
Simple fine, of up to 2% (two percent) of the legal entity’s revenue, limited, in total, to R$ 50,000,000.00 (fifty million reais) per infraction;
Daily fine, with a total limit of R$ 50,000,000.00 (fifty million reais);
Publicization of the infraction;
Blocking of personal data to which the infraction refers;
Deletion of the personal data to which the infraction refers;
Partial suspension of the operation of the database to which the infraction refers for a maximum of 6 (six) months, extendable for an equal period, until the situation is regularized;
Suspension of the activity of processing personal data for a maximum of 6 (six) months, extendable for an equal period;
Partial or total prohibition to exercise activities related to data processing.

Resolution CD/ANPD No. 4/2023 aims to establish the application method for applying the penalty of a simple fine and/or a daily fine, as established in articles 11 and 16.

In addition to punishments such as fines, the national authority may require the adoption of corrective measures to prevent further infractions of the LGPD.

The minimum amounts of the simple fine to be applied in cases of natural person and legal entity with no revenue have been established as follows:

In addition to the regulation of the dosimetry for the application of penalties, which guarantees the legal certainty of the process, the first trials by the ANPD have also begun. Initially, the first batch will be judged, with 8 lawsuits, most of them involving federal public sector bodies and personal data leakage.

In an interview with Valor Econômico newspaper, the Director of the ANPD, Nairane Leitão, informed that the ANPD already has a second batch of cases, which will be better evaluated, involving private companies and cases of security incidents and sale and sharing of data, among others.

After the judgments in the first instance by the regulatory agency, there will be an appeal to the ANPD’s board of directors and, at the end of the administrative instance, the agents may appeal to the judiciary to try to review or even cancel the penalties applied.

According to the regulator, 40 inspection proceedings have already been opened regarding possible non-compliance with the legislation, and the ANPD has already received 1,110 reports, in addition to 703 petitions from data owners requesting the opening of proceedings and the adoption of measures for non-compliance with the law.

Companies need to be aware of and comply with the legal requirements, which include mapping the personal data collected, processed, and stored, as well as identifying the purpose and legal basis for processing, creating internal policies and procedures, conducting employee training and awareness in relation to personal data protection, to appointing a Data Protection Officer (DPO) who is responsible for ensuring the company’s compliance with the LGPD and for communicating with the ANPD.

If you have not yet appointed or have no DPO, Pryor Global can help you. We offer the DPO service autonomously and independently, complying with all legal requirements.

Count on our services! We have an expert team in LGPD and personal data protection.

https://www.pryorglobal.com/contato/

O post LGPD: Dosimetria para Aplicação de Penalidade e Início dos Julgamentos apareceu primeiro em Pryor Global.

Como proteger os dados da sua empresa e de seus clientes

prylocawp23 prylocawp23 — Mon, 06 Mar 2023 18:15:09 +0000

Protecting company and customer data has become a real challenge. Not only because of the need to comply with Brazilian GDPR (General Data Protection Regulation), but above all because data itself is highly vulnerable. Data security breaches can be both intentional, such as hacker attacks, and accidental, the result of human error, for example, which multiplies the risks.

Corporate data has become very valuable and is constantly targeted by hackers as it is used to unravel business models and collect information about customers and partners, among other things. In possession of this information, cybercriminals are able to commit numerous crimes.

If your company stores data like this on its servers, you must have proper protection mechanisms in place. Here are some tips.

1) Data backup

Your company needs to protect itself against all system failures, so it is imperative to create backup routines. This can be through physical media, for example, but also through a private cloud service.

Data backup must also be protected against attacks from malware or intrusions. Physical backups should therefore be stored offline, in a secure location away from the company’s servers. Make sure that all important data is part of the backup routine. It is also important that recovery tests are regularly performed.

2) Data access control

Most software used in a professional context allows you to manage data access on an individual basis, so that employees can only see certain information. You can also restrict the right to delete and export data. Thus, you can protect your company’s data from tampering, information theft, or intentional destruction.

3) The use of encryption

Encrypting data makes it unreadable without a decryption key. This process enables the secure exchange of data between users (by e-mail, for example), but can also be applied to attachments, databases, and payment information.

Some tools and software store the data encrypted, so that the data is only accessible by using the software itself and a password.

It is also important that the company adopts a disk encryption solution on its devices, especially portable ones, as a way to prevent improper access to the data in case the devices are lost or stolen.

4) Have a plan in case of a data breach

No company would like to go through this, but it is recommended to have a security incident procedure so that you know exactly what to do in case of a data breach. This procedure must also include templates for immediate notification of your customers, suppliers, and authorities.

In addition to these tips, it is essential to comply with the guidelines of the GDPR, which was created to establish a strict framework for the treatment of personal data and sensitive personal data throughout the national territory.

Here at Pryor Global, our DPO outsourcing sector has a highly specialized team in digital security, which helps companies to be in compliance with GDPR.

O post Como proteger os dados da sua empresa e de seus clientes apareceu primeiro em Pryor Global.

LGPD aplicada ao setor da saúde

prylocawp23 prylocawp23 — Mon, 30 Jan 2023 13:06:23 +0000

The Brazilian General Data Protection Regulation (GDPR) provides legal guidelines for the processing of personal data. In healthcare, this means that any person treated by a professional, institution, or health network has the right to the confidentiality of information concerning him or her. This confidentiality covers, except in cases already provided for by law, all information concerning the data subject that comes to the attention of the healthcare professional.

According to the Brazilian GDPR, personal data is all information relating to an identified or identifiable natural person, that is, a natural person who can be identified, directly or indirectly. Health-related data and genetic data of identified or identifiable persons are, by definition, sensitive personal data that have a higher criticality and must therefore be protected. To quote the law:

II – sensitive personal data: personal data concerning the racial or ethnic origin, religious conviction, political opinion, membership of a labor union or of a religious, philosophical, or political organization, data concerning health or sex life, genetic or biometric data, when linked to a natural person.

An individual’s health-related data is diverse and poses a major security challenge. While the development of digital technologies has enabled increasingly comprehensive and assertive processing, the privacy issues that such processing entails become more apparent.

What do data subjects need to pay particular attention to?
Consent: when the processing of personal data requires the consent of the data subject, such consent is only legally valid if it is given on the basis of correct information, in a free and clear manner. Consent is usually required for most processing of sensitive data not carried out by health professionals, explicitly in the case of sensitive data.

The processing of health data through digital technologies is increasingly common. Therefore, private actors will have to be vigilant when collecting individuals’ consent by electronic means, in particular by creating an effective system that is transparent to users.

Data Protection: patient data must be protected from unauthorized or unlawful access and from loss, sharing, or destruction, even accidental. It is therefore necessary to establish appropriate security measures.

The adoption of security measures must cover physical, technical, and organizational aspects. This becomes even more important in the case of tools and systems for the provision of online health services, including telemedicine.

Transparency: this is one of the principles of the Brazilian GDPR. Any data processing must be done in a transparent manner. The Data Controller must be aware of which personal data will be processed, the form of processing, in addition to other information. Thus, he or she can consciously decide whether or not to share his/ her personal data.

Purpose: this is another important principle of the GDPR. The data collected should only be used for legitimate, specific, and explicitly informed purposes to the Data Controller.

Right of revocation: when data processing is based on the data subject’s consent, he/she can revoke his/her consent and stop the processing at any time. It is also possible to request the deletion of the previously processed data.

Right of access: any person has the right to request from the data controller all information regarding the processing of their personal data, as well as the relationship of third parties with whom the data may have been shared.

A company that handles sensitive data, such as that concerning an individual’s health, may be required to appoint a DPO (Data Protection Officer), which we have talked about before. This may be the case depending on the volume of data handled.

Here at Pryor Global, we offer DPO outsourcing services so that our clients can count on the support of a technical team skilled in data security and privacy. Talk to one of our specialists now!

O post LGPD aplicada ao setor da saúde apareceu primeiro em Pryor Global.

DPO: internalizar ou terceirizar a função?

prylocawp23 prylocawp23 — Wed, 09 Nov 2022 16:43:44 +0000

The company can assign the role to a current employee or outsource.

For many companies, the appointment of a Data Protection Officer (DPO) is a mandatory requirement to comply with the General Data Protection Regulation (GDPR). This professional must have a high degree of knowledge not only of the new regulation but also of the company’s field of activity.

Since the law’s entry into force in 2020 and the need to adapt to it at the risk of incurring fines and administrative sanctions, some companies have sought to resolve the DPO issue by assigning the role to a current employee or a senior executive, for example.

However, considering the independence required for a Data Protection Officer to perform his or her role, companies must be careful about potential issues of conflicts of interest with other functions, including those previously performed by the employee.

One of the main duties of the DPO is to be the mediator between the interests of the data controller (on the part of the company), the data subject (employees, business partners, and customers, for example), and the national authority, the National Data Protection Agency (ANPD). In addition, it must provide guidance on the correct procedures to be adopted for the privacy and protection of personal data, as well as verify if they are being complied with.

The DPO must have the autonomy to work, reporting directly to the highest level of the organization. In addition, they must have at their disposal the resources necessary to perform the tasks, such as information to help them make informed decisions in support of the privacy and protection of personal data.

To assign the role to a current employee or outsource?

When assigning the role internally, there is the issue of conflict of interest, which we have already mentioned above, as well as the overlap of duties, since the position will be offered to a current employee. This leads to other issues, such as the time dedicated to privacy and data protection activities and the other activities previously performed by the employee, as well as the GDPR expertise and experience he or she needs to have.

In one of our last articles, we talked about the Normative Instruction SGD/ME 117, which provides for the indication of the Person in Charge of the Processing of Personal Data in bodies and entities of the federal public administration: “[the DPO] must have essential multidisciplinary knowledge to its attribution, preferably, those related to the themes of privacy and protection of personal data, legal analysis, risk management, data governance and access to information in the public sector”.

The other option would be to outsource the function, something that is already recurrent among companies that need to have a DPO. By hiring a service provider with technical teams and experience in the area, you will have access to the best guidance on what to do and how to protect the personal data of employees, partners, and customers. In addition, the cost is almost always lower (after all, when internalizing the function, there are the CLT costs).

Aiming to meet this demand from current and potential future clients, Pryor Global has created a DPO outsourcing department, with teams specialized in personal data protection and GDPR. It is important to count on a reliable partner for something that only tends to grow in relevance, such as the issue of personal data protection.

Count on us in this challenge!

O post DPO: internalizar ou terceirizar a função? apareceu primeiro em Pryor Global.

Devo ter um DPO jurídico ou de tecnologia?

prylocawp23 prylocawp23 — Tue, 27 Sep 2022 18:10:44 +0000

The Data Protection Officer must gather the right knowledge to perform his or her tasks

By now, companies are familiar with the General Data Protection Regulation (GDPR). After all, it came into force in August 2020, two years ago, and since last year administrative sanctions can and must be applied. However, the law is not entirely clear on some aspects, one of which is the Data Protection Officer, or DPO.

Hiring a DPO is mandatory for all companies that handle personal data, whether it belongs to employees, customers, or business partners. The exception is only for micro and small enterprises – we have already discussed this topic here. The main function of this professional is to ensure that personal data is processed in compliance with local law. Other duties include:

I – to accept complaints and communications from the titleholders, provide clarifications, and adopt measures;

II – to receive communications from the national authority and adopt measures;

III – to orient the entity’s employees and contractors regarding the practices to be adopted for protecting personal data; and

IV – to execute the other attributions determined by the controller or established in complementary norms.

However, the GDPR does not determine specific training for this professional. To this end, the Normative Instruction SGD/ME 117 was published by the Ministry of Economy, which provides for the appointment of the Data Protection Officer in the scope of bodies and entities of the public administration.

According to the regulation, the DPO “must have multidisciplinary knowledge essential to the fulfillment of his/her tasks, preferably on the topics of privacy and protection of personal data, legal analysis, risk management, data governance and access to information in the public sector. In addition, “they must not be located in the Information Technology units or be the responsible manager of information systems of the body or entity”.

Therefore, although no specific training is required, the Data Protection Officer must gather the right knowledge to perform his or her tasks. In practical terms, this professional must know the law in depth, checking that data processing activities comply with current legislation. Likewise, he or she must understand the processes and avoid incidents that lead to the unauthorized disclosure of personal data.

In the end, the best professional will be the one who brings together knowledge of the legal area and of technology and information security. Because it is difficult to find a single professional who has all the necessary expertise, it is best to have a privacy team. To make sure you have the best possible support in data protection issues, Pryor Global offers DPO as a service, with experienced and specialized professionals working to keep your company in compliance with the law. Contact us to learn more about this service.

O post Devo ter um DPO jurídico ou de tecnologia? apareceu primeiro em Pryor Global.

Quais as skills necessárias para ser um DPO?

prylocawp23 prylocawp23 — Tue, 16 Aug 2022 18:26:38 +0000

To become a data protection officer, it is recommended to undergo appropriate training and acquire a DPO certificate

The Data Protection Officer (DPO) is a relatively new position for many companies. Its role and responsibilities are given by the Brazilian General Data Protection Regulation (GDPR), in force since August 2020.

The GDPR requires some companies to appoint a DPO, which ended up creating a demand in the market for individuals with proven knowledge and experience to act in the role. For small businesses, the responsibilities of a data protection officer can be added to those of an existing employee. For larger organizations, a full-time position is often created.

Generally speaking, the DPO is a data protection expert who is responsible for advising an organization on how to comply with legal requirements regarding data processing, as well as investigating violations and responding when individuals have questions and/or complaints.

According to paragraph 2 of the Brazilian GDPR, the DPO’s activities consist of:

I – to accept complaints and communications from the data subjects, provide clarifications, and adopt measures;

II – to receive communications from the national authority and adopt measures;

III – provide support and guidance to the company on procedures related to the protection of personal data;

IV – to execute the other attributions determined by the controller or established in complementary norms.

There is no specific qualification for an individual to become a data protection officer, but he or she must have specialized knowledge of the regulation and practical experience in the role. In addition, the DPO must not have any current duties and responsibilities that may conflict with his or her data protection responsibilities.

To become a data protection officer, it is recommended to undergo appropriate training and acquire a DPO certificate. The courses will help you understand all the technical requirements of the GDPR and give you the experience to face the tasks of the profession. Two certifications at the international level stand out: EXIN and IAPP.

In addition to a strong understanding of the General Data Protection Regulation, the DPO needs to have good communication skills, as he or she will work guiding a company’s staff, as well as answering questions from others and mediating communication with the national authority.

The GDPR does not specify whether the data protection officer should be an individual or a company. It is possible, therefore, to hire the DPO as a service. Here at Pryor Global, we offer DPO outsourcing, so that a highly qualified and experienced professional can act within your company. Contact us for more information.

O post Quais as skills necessárias para ser um DPO? apareceu primeiro em Pryor Global.

Multas da LGPD já estão em vigor, saiba quais são

prylocawp23 prylocawp23 — Wed, 13 Jul 2022 16:28:26 +0000

Companies and public agencies that fail to comply with the law can now face the consequences

Since it came into force in September 2020, the Brazilian General Data Protection Regulation (GDPR) has raised the most diverse concerns. Here on the blog, we have already talked about the reasons to adapt to the new regulation and the importance of the DPO (Data Protection Officer) for compliance with GDPR. Today, we will clarify another very important issue: the fines and penalties for the companies who break the law.

The Brazilian GDPR which was sanctioned in August 2018, took two years to come into force. Administrative sanctions became applicable as of August 1, 2021. This time was necessary for companies and public agencies to understand the new regulation and adapt to the changes in the treatment of personal data. The law provides rights to data subjects and duties to data controllers and operators. The supervision of compliance with the law and the application of the respective fines and penalties are the responsibility of the ANPD.

The National Data Protection Authority (ANDP) is the public administration body responsible for ensuring compliance with the GDPR in Brazil, guaranteeing the protection of individuals’ rights to freedom and privacy. It also works in partnership with other entities, such as the National Consumer Secretariat (Senaco-MJSP), to coordinate actions, such as addressing consumer complaints.

On the website, individuals can create a petition against the controller of personal data, report non-compliance with LGPD, and report security incidents, for example.

In case of breach of the rules provided by the law, data processing agents are subject to the following administrative sanctions applicable by the ANDP:

Warning, indicating the deadline for the adoption of corrective measures;
Simple fine up to 2% (two percent) of the legal entity’s revenue, limited, in total, to R$ 50,000,000.00 (fifty million reais) due to infraction;
Daily fine, subject to the total limit referred to in the previous item;
Publication of the violation after its occurrence has been verified and confirmed;
Blocking of personal data to which the violation relates until its regularization;
Destruction of personal data to which the violation refers;
Partial suspension of the operation of the database referred to in the infraction for a maximum period of 6 (six) months, extendable for the same period until the regularization of the processing activity by the controller;
Suspension of the activity of processing personal data referred to in the infraction for a maximum period of 6 (six) months, extendable for an equal period;
Partial or total prohibition of the exercise of activities related to data processing.

The fines and penalties are severe. Therefore, it is important that companies and public agencies act in a preventive manner, in order to avoid possible non-compliance with the law, and act quickly in cases of security incidents, through efficient mechanisms. For data subjects, punishments reinforce compliance with the GDPR and ensure greater security.

At Pryor Global, we offer DPO services, the person in charge of personal data processing, who, among other things, mediates communications between the company and the ANPD. Contact us to learn more!

O post Multas da LGPD já estão em vigor, saiba quais são apareceu primeiro em Pryor Global.

LGPD: saiba como ela impacta na estratégia do seu negócio

prylocawp23 prylocawp23 — Fri, 27 May 2022 13:28:43 +0000

Although many companies consider the new regulation an unexpected problem, GDPR can help optimize many professional activities and processes

The Brazilian General Data Protection Regulation (GDPR) is the main federal legislation for the privacy of personal data, just as the GDPR (General Data Protection Regulation) is for the European Union. The regulation, which came into force in August 2020, has implications for companies and individuals throughout the national territory, regardless of the medium, the country of their headquarters, or the country in which the data is located, provided that:

(a) the data processing is carried out in Brazil;

b) the purpose of the processing is to offer goods or services or to process data of individuals located in Brazil;

c) the personal data processed have been collected in the national territory.

Although many companies consider the new regulation an unexpected problem, GDPR can help optimize many professional activities and processes. If managers invest in meeting the demands of the law, they may discover several unique business opportunities that await them. Here are a few of them.

1. Credibility and brand reputation

A company can gain credibility and improve its brand reputation if it meets the requirements of the GDPR. By complying with the law, the organization demonstrates that it has achieved a high level of accountability and protection of personal data, something that all customers, employees, and business partners will certainly appreciate. Today, privacy and information security are seen as key differentiators to stand out in the market.

2. Process optimization

GDPR implementation in companies requires that all departments take a close look at all stages of the processing of the personal data to which they have access. To do so, they must map the flow of personal data and check several issues, including data collection, storage, disposal, and protection measures. By doing this, it is possible to identify processes that can be changed and improved. There are numerous advantages to be gained by complying with the legislation, in addition to privacy itself. Process optimization is certainly one of them.

3. Incentive for innovation

GDPR can be an incentive for innovation for companies that know how to make use of it. For example, improvements in secure software development processes (DevSecOps), or the creation and development of new functionalities to assure customers that their personal data is securely treated. The protection of personal data has become a strategic issue for companies that want to participate in a global innovation movement.

4. Putting the consumer first

GDPR puts the consumers first by strengthening their existing rights and introducing new ones. Privacy and protection of personal data are part of a global movement, and consequently, there will be a cultural change in companies as well. The adaptation to GDPR requires effort and dedication, but it is certainly a strategic and important issue for the future of the company. Ensuring a secure environment for clients’ personal data is a guarantee of standing out in a competitive market.

To help our clients comply with the GDPR, Pryor Global offers the services of a Data Protection Officer (DPO). This professional will help your company to provide solutions for the security of the personal data of customers, employees, and business partners.

O post LGPD: saiba como ela impacta na estratégia do seu negócio apareceu primeiro em Pryor Global.

Quais são as responsabilidades de um DPO?

prylocawp23 prylocawp23 — Wed, 27 Apr 2022 14:01:40 +0000

Data Protection Officers are involved in all matters relating to the protection of personal data, being essential for compliance with the LGPD

The appointment of a Data Protection Officer (DPO) is mandatory, according to Article 41 of the Brazilian General Data Protection Law (LGPD), except for small businesses, as we have already mentioned in another article. In short, the DPO ensures the protection of personal data in accordance with the applicable rules, as well as mediates the interests of both the company, which is the data controller, and the data subject.

The responsibilities of the Data Protection Officer include:

Compliance – The DPO must ensure that the company conducts the processing of personal data in compliance with the General Data Protection Law, in addition, to interpreting the law for the processing agents (the controller and the operator) and all those involved in data processing, advising on the best actions to be taken.

Orientation and training – The DPO is responsible for promoting education and awareness-raising on the correct protection of personal data, offering employee training, suggesting procedures and creating a true data protection culture in the company.

Autonomy – Data Protection Officers must act autonomously in the performance of their duties, without influence from the controller or operator of the personal data. They must not be dismissed or penalized for fulfilling their role, for example, when pointing out the risk of non-compliance with the law in a particular company action. The ethical and practical considerations must come first.

Accountability – The DPO should be available to answer any questions that data subjects may have about the protection of their personal data. While performing his or her duties and to fulfill his or her obligations, the DPO must be provided with all appropriate resources, including access to personal data and processing activities.

Representation before the National Data Protection Authority (ANPD) – The DPO is the one who will receive the communications from the national authority and take the appropriate actions.

In short, Data Protection Officers are involved in all matters relating to the protection of personal data. Their role within an organization is essential for compliance with the LGPD.

It is worth noting that ANPD “may establish complementary rules on the definition and the attributions of the person in charge, including the hypothesis of exemption from the need to indicate him/her, according to the nature and size of the entity or the volume of data processing operations”, as stated in paragraph 3.

Pryor Global helps your company comply with LGPD by offering DPO as a service. Only a qualified professional will be able to provide the necessary security for your business to legally operate. Contact us and get all your questions answered!

O post Quais são as responsabilidades de um DPO? apareceu primeiro em Pryor Global.

Vantagens do DPO as a service

prylocawp23 prylocawp23 — Thu, 24 Mar 2022 13:21:52 +0000

A practical and efficient solution for companies that do not have the necessary knowledge to comply with the obligations set forth in the Brazilian General Data Protection Law

Brazil is the sixth country in the world that suffers most from data leakage. This is the result of a survey conducted by Surfshark, an online privacy and security company. From November to January 2021, the data of almost 25 million Brazilians were exposed as a result of cyberattacks or failures in the companies’ systems.

This is another statistic that proves the scenario of digital insecurity in Brazil. That is why the creation and entry into force of the Brazilian General Data Protection Law (LGPD) is so important, as it guarantees the right to privacy of Brazilian or foreign citizens who are in the country, in addition to imposing fines and sanctions on those responsible by data leakage.

The changes are drastic, but mandatory for all companies. The processing of personal data, from the collection, storage and sharing, must respect the principles of the LGPD, in addition to having a valid legal basis. Companies must also appoint a DPO (Data Protection Officer) to act as a supervisor and be responsible for maintaining compliance with data protection legislation.

Before the LGPD, digital security was not a priority for many companies. Now, having to adapt to the changes proposed by the law, many of them do not know where to start. Therefore, it may be more advantageous to rely on the help of an outsourced service provider, who has the expertise and experience necessary to ensure that companies act in compliance with the rules in force.

Why outsource the role of a DPO?

DPO as a service (DPOaaS) offers a specialized professional to perform the role of Data Protection Officer in companies. This person will act in a dedicated and independent way, providing unlimited support to the entire staff, acting as the official point of contact with the national authority, the ANPD (National Data Protection Authority) and managing the data governance program in both its legal and information security aspects.

This is a practical and efficient solution for companies that do not have the necessary knowledge to comply with the obligations set forth in the Brazilian General Data Protection Law. After all, the duties of a DPO are challenging, since this professional needs to understand not only data processing and security, but also be aware of the legal aspects that involve the issue.

A specialized professional can provide expert and legal advice on data protection. In addition, there is the guarantee of a truly qualified and independent DPO, without any conflict of interest, as established by good market practices.

At Pryor Global, we offer DPO Outsourcing services so that our clients can focus on their core business and be assured of following the law. To learn more on the subject, visit our website and read our articles.

O post Vantagens do DPO as a service apareceu primeiro em Pryor Global.