Brazil: Less than 40% of companies demonstrate compliance with the LGPD

With only six months to go before the General Data Protection Act (LGPD) come into force, the concern of companies to take internal actions to comply with the guidelines of the new law only tends to increase. However, according to a report from the “LGPD Diagnostics” tool, developed by the Brazilian Association of Software Companies (ABES) in partnership with EY, only 38% of the companies show that they are in accordance with the requirements made by the new privacy law in the Processes, People and Technology domains. The diagnosis has been carried out, so far, by more than 400 organizations in the sectors of agribusiness, technology, finance, industry and others.

O LGPD Diagnosis, officially launched in March 2020, was in an experimental phase since October of last year. Its objective is to educate and assist companies of all sizes, especially those that do not have many resources for large projects, to check their level of suitability for LGPD and comparing them with the national average, or the average of its industry, business size and state. After answering, anonymously and online, a questionnaire with 61 questions, divided into 10 sessions, covering the processing of personal data, rights of holders, international transfer of data, duties of the controller and operator, legal aspects and incidents, among others, companies have access to its compliance index and a customized guide with recommendations of what should be done for the index to increase and, consequently, there is a reduction in risk and exposure.

“The action of EY and ABES is an educational initiative to support the journey of compliance and respect for the personal data of Brazilian citizens. We believe first in the power of education, in the transformation and acculturation of people and companies in dealing with privacy, even before the national authority establishes itself and assumes its role, ”says Marcos Sêmola, cybersecurity partner at EY.

According to the executive, the companies that responded to the form are already ahead of the majority of the market, and now seek to sensitize business leaders with the action plan generated by the system. The intention, according to Sêmola and the president of ABES, Rodolfo Fücher, is to expand participation and, therefore, the Brazilian business representation in the system to transform it into the National Index of Compliance and Respect for Data Protection, which will be made available through and a portal, in real time.

"THE LGPD diagnostic tool it is also very useful for startups, which may have found it more difficult to structure sectors aimed at implementing new regulations, assessing the level of compliance of their projects under the new law, thus increasing the level of data security and increasing their attractiveness for possible investors or fundraising ”, adds Fücher.

It is important to emphasize that in order to have access to the self-diagnosis system and, consequently, to the customized action plan report, it is not necessary to send any personal or company identification information, such as name, CPF / CNPJ, e-mail or address. The service is offered to the Brazilian business community free of charge and anonymously, requiring only qualification data such as company size, sector of operation and state in which it operates. After completing the questionnaire, a PDF report is available for download with information regarding the level of suitability and with suggestions for improvement - it is not possible to access this document later.

Agribusiness is the sector with less compliance with the law

Among the sectors evaluated, agribusiness is the one that is least in accordance with the points required by the Law. According to the form, the sector reaches only 13% in the compliance index. Despite this, when it comes to the treatment of data considered sensitive, agribusiness was the only one to reach the rate of 100%. The goods and consumption sector, in turn, was the one that had the highest compliance rate when reaching 52%. The technology area comes soon after, with 39%. Retail, however, stood out in the data processing index, reaching 82% - higher than the national average of 75.8%.

The free tool developed by ABES and EY can be accessed on this link.

About EY
EY is a global leader in Audit, Tax, Corporate Transaction and Consulting services. Present in more than 150 countries, it aims to build a better business world. Our insights and services help to build confidence in capital markets and economies around the world. In Brazil, we form a team of five thousand professionals and have offices in 12 cities. With the wavespace ™ collaborative innovation center, Cybersecurity Center and Analytics Hub, EY is ready to support companies in the digital transformation and disruptive movements of Industry 4.0.

About ABES 
ABES, Brazilian Association of Software Companies, represents approximately 2 thousand companies, which total about 85% of the turnover of the software and services segment in Brazil, distributed in 23 Brazilian states and the Federal District, responsible for the generation of more than 205 thousand direct jobs and annual turnover of R$ 61 billion in 2018.

Since its foundation in September 1986, the entity has sought to be relevant to its associates and a national and international reference in the technology sector, always aligned with its mission to connect, guide, protect and develop the Brazilian technology sector. It offers its members various benefits and services, such as certificates, legal advisors and events. It has several thematic committees to discuss issues in evidence and define guidelines for action.

It is a reference as a source of data for the sector and focuses its actions in the legal, tax, regulatory, compliance and innovation promotion areas, among others. ABES promotes entrepreneurship, aims to improve the business environment and competitiveness and collaborates in the construction of a more digital and less unequal Brazil.