Definitive global law guides offering comparative analysis from top-ranked lawyers
CHAMBERS GLOBAL PRACTICE GUIDES
Data Protection & Privacy 2026
Definitive global law guides offering comparative analysis from top-ranked lawyers
Contributing Editor Christian Schröder Orrick
Global Practice Guides
Data Protection & Privacy Contributing Editor Christian Schröder Orrick, Herrington & Sutcliffe LLP
2026
Chambers Global Practice Guides For more than 20 years, Chambers Global Guides have ranked lawyers and law firms across the world. Chambers now offer clients a new series of Global Practice Guides, which contain practical guidance on doing legal business in key jurisdictions. We use our knowledge of the world’s best lawyers to select leading law firms in each jurisdiction to write the ‘Law & Practice’ sections. In addition, the ‘Trends & Developments’ sections analyse trends and developments in local legal markets. Disclaimer: The information in this guide is provided for general reference only, not as specific legal advice. Views expressed by the authors are not necessarily the views of the law firms in which they practise. For specific legal advice, a lawyer should be consulted. Content Management Director Claire Oxborrow Content Manager Jonathan Mendelowitz Senior Content Reviewers Sally McGonigal, Ethne Withers, Deborah Sinclair, Stephen Dinkeldein, Vivienne Button and Sean Marshall Content Reviewers Lawrence Garrett, Marianne Page, Heather Palomino, Alison Moore, Adrian Ciechacki and Michael Irvine Content Coordination Manager Nancy Tsang Senior Content Coordinators Carla Cagnina and Delicia Tasinda Content Coordinator Joanna Chivers Head of Production Jasper John Production Coordinator Genevieve Sibayan
Published by Chambers and Partners 165 Fleet Street London EC4A 2AE Tel +44 20 7606 8844 Fax +44 20 7831 5662 Web www.chambers.com
Copyright © 2026 Chambers and Partners
Contents
INTRODUCTION Contributed by Christian Schröder, Orrick p.6
ITALY Law and Practice p.198
Contributed by ICT Legal Consulting Trends and Developments p.213 Contributed by ICT Legal Consulting
BRAZIL Law and Practice p.10 Contributed by Lopes Pinto, Nagasse Advogados Trends and Developments p.26 Contributed by Bialer Falsetti Associados
JAMAICA Law and Practice p.221
Contributed by Ramsay & Partners Trends and Developments p.233 Contributed by Ramsay & Partners
CHILE Law and Practice p.30 Contributed by Magliona Abogados
JAPAN Law and Practice p.237 Contributed by Mori Hamada & Matsumoto Trends and Developments p.253 Contributed by Oh-Ebashi LPC & Partners
CHINA Law and Practice p.47
Contributed by Zhong Lun Law Firm Trends and Developments p.63 Contributed by Global Law Office EGYPT Law and Practice p.70 Contributed by Shehata & Partners EU Law and Practice p.86 Contributed by Gerrish Legal Trends and Developments p.103 Contributed by Gerrish Legal
KUWAIT Law and Practice p.259 Contributed by GLA & Company
MACAU SAR, CHINA Law and Practice p.271 Contributed by Lektou – Advogados e Notários Trends and Developments p.281 Contributed by Lektou – Advogados e Notários MALAYSIA Law and Practice p.285 Contributed by Christopher & Lee Ong Trends and Developments p.302 Contributed by Christopher & Lee Ong MEXICO Law and Practice p.309 Contributed by Nader Hayaux & Goebel
FRANCE Law and Practice p.111 Contributed by Nomos
GREECE Law and Practice p.129 Contributed by Psarras, Georgountzou - GKP Law Firm
INDIA Trends and Developments p.149 Contributed by Shivadass & Shivadass
Trends and Developments p.320 Contributed by Baker McKenzie
MOROCCO Law and Practice p.327
INDONESIA Law and Practice p.156
Contributed by DLA Piper Casablanca Trends and Developments p.334 Contributed by DLA Piper Casablanca
Contributed by ALTA Advocates Trends and Developments p.170 Contributed by ABNR Counsellors at Law
NEW ZEALAND Law and Practice p.339 Contributed by Tompkins Wake
ISRAEL Law and Practice p.179 Contributed by Or-Hof Law
3 CHAMBERS.COM
Contents
PAKISTAN Law and Practice p.357 Contributed by S.U.Khan Associates QATAR Law and Practice p.365 Contributed by GLA & Company SAUDI ARABIA Law and Practice p.377 Contributed by GLA & Company
UAE Law and Practice p.528 Contributed by Bizilance Legal Consultants Trends and Developments p.538 Contributed by BSA LAW
USA Law and Practice p.543
Contributed by Chamberlain Hrdlicka Trends and Developments p.560 Contributed by Fieldfisher USA – CALIFORNIA Trends and Developments p.565 Contributed by Buchalter LLP USA – COLORADO Trends and Developments p.570 Contributed by Buchalter LLP USA – FLORIDA Trends and Developments p.575 Contributed by Jones Walker LLP USA – GEORGIA Trends and Developments p.581 Contributed by Jones Walker LLP USA – ILLINOIS Trends and Developments p.588 Contributed by Seyfarth Shaw LLP
SERBIA Law and Practice p.394 Contributed by Mikijelj, Janković & Bogdanović Trends and Developments p.404 Contributed by Mikijelj, Janković & Bogdanović
SINGAPORE Law and Practice p.409
Contributed by Drew & Napier LLC Trends and Developments p.426 Contributed by Drew & Napier LLC SOUTH KOREA Law and Practice p.432 Contributed by Kim & Chang Trends and Developments p.446 Contributed by Lee & Ko
SWEDEN Law and Practice p.453 Contributed by Hellström Advokatbyrå KB Trends and Developments p.469 Contributed by Gernandt & Danielsson
USA – MISSOURI Trends and Developments p.595 Contributed by Sandberg, Phoenix & von Gontard, P.C.
USA – NEW YORK Trends and Developments p.602 Contributed by Phillips Nizer LLP
TAIWAN Law and Practice p.475 Contributed by Chen & Lin
USA – TENNESSEE Trends and Developments p.607 Contributed by Baker, Donelson, Bearman, Caldwell & Berkowitz, PC
THAILAND Law and Practice p.491 Contributed by Chandler Mori Hamada Limited Trends and Developments p.503 Contributed by Chandler Mori Hamada Limited
USA – TEXAS Trends and Developments p.614 Contributed by Buchalter LLP
TÜRKIYE Law and Practice p.510 Contributed by YAZICIOGLU Legal
4 CHAMBERS.COM
Contents
USA – UTAH Trends and Developments p.620 Contributed by Kirton McConkie USA – WASHINGTON Trends and Developments p.627 Contributed by Miller Nash LLP
5 CHAMBERS.COM
INTRODUCTION
Contributed by: Christian Schröder, Orrick
Orrick is a global law firm dedicated to serving the technology and innovation, energy and infrastruc - ture, finance, and life sciences and healthtech sec - tors. With more than 1,150 lawyers across more than 26 markets worldwide, Orrick provides forward-look - ing, pragmatic advice on transactions, litigation and compliance matters. As one of the world’s leading tech law firms, cybersecurity and privacy are cen - tral to Orrick’s practice. The firm has 20 cybersecu - rity and privacy-focused partners and more than 60 specialised lawyers, making it one of the strongest
data protection practices in the market, recognised in the Chambers Global, US and Europe Guides. Or - rick helps clients navigate the complex cybersecurity and privacy legal landscape, managing global com - pliance matters, cyber-incidents, litigation and regu - latory investigations. The team maximises data value, addresses global privacy requirements and reduces security risks. Whether clients are managing com - pliance challenges, licensing data or acquiring new companies, Orrick offers forward-thinking solutions to address data challenges.
Contributing Editor
Christian Schröder is a partner in Orrick’s Düsseldorf office and leads the firm’s cyber, privacy and data innovation group in Europe. He specialises in data-focused laws, including cybersecurity, privacy
compliance, incident response, data licensing, AI and regulatory investigations. Christian advises on internal and external data transfers, product launches and privacy requirements for connected cars. He maintains strong relationships with German and EU data protection authorities, effectively defending clients in investigations. Recognised by Chambers as a top practitioner, he is a noted thought leader in privacy law.
Orrick, Herrington & Sutcliffe LLP Heinrich-Heine-Allee 12 40213 Düsseldorf Germany Tel: +49 211 3678 7269 Email: cschroeder@orrick.com Web: www.orrick.com
6 CHAMBERS.COM
INTRODUCTION Contributed by: Christian Schröder, Orrick
Introduction to the Data Protection & Privacy Guide Legal and regulatory framework As we head into 2026, data privacy continues to be an important compliance topic, a fundamental concern for individuals, businesses and governments world - wide, as digital technologies and the increasing reli - ance on data-driven services, such as in the context of AI, have transformed how personal data is collected, processed and shared. This has brought about signifi - cant benefits, including enhanced connectivity, per - sonalised services and economic growth. However, it has also raised critical questions about the protection of personal data and individual privacy rights. In many jurisdictions, data privacy laws are built on the same core principles, such as transparency, account - ability and lawfulness. These principles are designed to ensure that individuals have control over their per - sonal data and that the organisations processing this data do so responsibly. Key elements of data privacy regulation include requirements for data security and data transfers, and the rights of individuals to access, correct and delete their data. Apart from this, a key aspect of this dynamic field of privacy protection is the constantly evolving legal landscape of data protection-related laws. The devel - opments in 2025 brought some consolidation in Europe, acceleration in the United States and Asia, and a steady rise in complex litigation. In the EU for instance, the AI Act and the EU Data Act (DA) moved from text to practice. In the United States, several new state privacy laws and amend - ments took effect on 1 January 2026, including the introduction of privacy requirements in Indiana and Kentucky. The Personal Data Protection Law (PDPL) of Vietnam came into force the same day, following its approval by the National Assembly. India’s privacy law, the Digital Personal Data Protection Act (DPDPA) which finally became effective in late 2025, governs the handling of digital personal data and sets out a comprehensive framework for its collection, process - ing and transfer. In many jurisdictions, existing regulations are being amended more frequently. In the EU, the draft EU
Omnibus regulation aims to simplify rules on data, AI and cybersecurity. Proposed amendments include the introduction of rules clarifying the use of personal data for AI training, a single EU entry point for incident reporting across the EU GDPR, NIS 2, DORA, and an extension of the notification time for data breaches. Meanwhile in the UK, the new Data Use and Access Act (DUAA) amends the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA) and the Privacy and Electronic Communica - tions Regulations (PECR). Similar developments can be observed in other jurisdictions as well, such as the amendments to Malaysia’s Personal Data Protection Act (PDPA) in 2024. Requirements for the use of and access to non- personal data In 2025, it became clear that data-related compliance programs can no longer ignore non-personal data. In order to enable data access and sharing, jurisdictions are increasingly enacting laws to ensure that non-per - sonal data is more accessible and usable, and that data-driven innovation is promoted. The DA establishes new rules in the EU for how users of connected products and related services can uti - lise the data they generate and how data holders can derive economic value from it. In order to address the key challenges in the digital economy, the DA aims to foster a competitive data market and promote data- driven innovation, introducing premature termination rights and the right to request support when switching to similar data processing services. With the DUAA, the UK has also started to manage non-personal data, aiming to unlock the effective use of such data. The DUAA establishes a structure for data-sharing arrangements like Open Banking (ena - bling third-party providers to access customer data at financial entities through application programming interfaces or APIs), which applies to both consumer and business data. This approach is comparable to the EU’s DA and Data Governance Act, although the DUAA does not exactly replicate the corresponding EU regulations.
7 CHAMBERS.COM
INTRODUCTION Contributed by: Christian Schröder, Orrick
International data transfers One of the most significant challenges in data privacy is the issue of cross-border data transfers. As data transfers are part of everyday business, regulators must address the complexities of ensuring that per - sonal data transferred to other jurisdictions remains adequately protected. This has led to the develop - ment of various mechanisms such as standard con - tractual clauses (SCCs), binding corporate rules (BCRs) and adequacy decisions, which enable the international transfer of personal data in compliance with the respective data protection principles. Many jurisdictions, particularly in the MENA region, have recently adopted this approach and published data transfer regulations that in some instances require specific approval by state authorities. For example, in 2024, Saudi Arabia published four different forms of SCCs and issued new guidelines on the use of BCRs. In the United States, national‑security‑driven controls have been tightened. New federal rules constrain cer - tain transfers of bulk sensitive US personal data to countries of concern, and the Protecting Americans’ Data from Foreign Adversaries Act limits sales by data brokers to designated countries or controlled entities. These regimes sit alongside sectoral rules and state privacy laws, expanding diligence and contractual controls for global vendor chains. China has completed the tri‑path outbound data transfer framework under the Personal Informa - tion Protection Law (PIPL). Following the easing of thresholds and exemptions in 2024, 2025 saw further guidelines and, crucially, the Measures for Certifica - tion of Cross‑Border Personal Information Transfers (effective since January 2026). Companies now have a choice of security assessment, standard contracts, or certification. The UK’s new DUAA establishes a new data protec - tion standard for transfers, mandating the secretary of state to carry out a data protection test in relation to transfers of personal data to a third country or inter - national organisation. In the EU, international data transfers are an endless story. In 2025, the European Commission renewed
the two adequacy decisions for the United Kingdom. An adequacy decision for data transfers to Brazil is expected soon. Due to political developments and increasing tensions with the US, doubts have been raised in Europe about the continued validity of the EU–US Data Privacy Framework (DPF) for the transfer of personal data between the EU and the US. In September 2025, the EU General Court (EGC; Case T-553/23) dismissed an action for annulment of the DPF for the transfer of personal data between the EU and the US, thereby confirming the DPF. An appeal is pending before the European Court of Justice (CJEU). The current situation in the EU is precarious for many companies relying on SCCs, and particularly for small and medium-sized enterprises with international ties, as an annulment of the DPF would necessitate rely - ing on SCCs for data transfers to the US. According to the Schrems II decision of the CJEU and based on the recommendations 01/2020 of the European Data Protection Board (EDPB), the use of SCCs necessi - tates an assessment of the data protection level of the respective third country (a transfer impact assessment or TIA). According to the EDPB, such TIAs require a six-step review process, including a detailed examina - tion of the legal enforcement system and surveillance laws of the recipient country. This necessitates the help of local experts and leads to increasing costs for companies, which for SMEs leads to enormous challenges. Enforcement In the EU, regulators continued to focus on adtech, dark patterns, the processing of sensitive data in advertising, and the processing of children’s data. One particular focus of European data protection authori - ties has always been international data transfers. Examples are the EUR530 million fine imposed by the Irish Data Protection Commissioner against a social media platform provider for unlawful data transfers to China, and the European Data Protection Supervisor’s decision to refuse a request by the European Invest - ment Bank to transfer data to a number of non-EU/ EEA countries, including Brazil, Turkey, India and Fiji.
8 CHAMBERS.COM
INTRODUCTION Contributed by: Christian Schröder, Orrick
Sectoral developments The bar is rising fast in specific sectors such as health and advertising as many regulators are increasingly focusing on these critical issues. For instance, new state health privacy laws in the US focus on purpose limitation and expectation management, demanding data minimisation and vendor oversight. With the EU Health Data Space Regulation, the EU is setting new rules for the primary and secondary use of health data and the international transfer of such data to other jurisdictions. Enforcement remains strict, particularly regarding online marketing practices and the use of cookies. In the US, further action on deceptive design and misuse of sen - sitive data is expected. In France, at the end of 2025, the supervisory authority, the National Commission for Information Technology and Civil Liberties ( Commis- sion Nationale de l'Informatique et des Libertés or CNIL) imposed significant fines for alleged cookie violations under the French Data Protection Act, whereby a pub - lisher was fined EUR750,000, and a financial services provider received a penalty of EUR1.5 million. It is also notable that the DUAA is introducing chang - es to existing cookie regulations. Similarly, the EDPB guidelines on cookies continue to shape EU cookie laws under the ePrivacy Directive. While some juris - dictions do not have specific regulations on cookies, it is important to note that other data protection laws may still apply and set cookie requirements, particu - larly when cookies are related to personal data. Conclusion The landscape of data privacy law is complex and constantly evolving, reflecting the rapid pace of tech - nological changes and the growing importance of data in the digital economy. The year 2026 will bring sev - eral challenges and, considering recent international developments discussed above, organisations would be well advised to start prioritising their compliance aims. They can do this by observing new incident response and reporting rules, still treating international data transfers as an evergreen risk; operationalising AI governance and expanding privacy programs to cover AI; focusing on the use and access to non-personal data (under the EU Data Act); implementing fair-terms reviews for B2B data contracts and cloud switching; and anticipating litigation and sectoral enforcement.
Earlier in 2025, the EGC made a significant ruling, awarding damages for the transfer of an IP address to the United States prior to the approval of the DPF and in the absence of an adequacy decision. The court held that the website operator was liable for data transfers made through a third-party API embedded in the web - site, even though the transfer was not conducted by the website operator. Such decisions may have future implications for companies operating in both low-risk and high-risk contexts, as they could face mass tort litigation for using third-party services that transfer non- sensitive and device-related data to third countries. In other jurisdictions, state privacy enforcement has also matured. In the US, the Attorneys General and the California Privacy Protection Agency pressed actions on data brokers, misconfigured consent tools, and sensitive health data in digital advertising. The development of new data localisation requirements is another important area to monitor. Privacy litigation Recent decisions illustrate that data privacy litiga - tion is on the rise, with individuals and organisations increasingly seeking redress for privacy violations. In many jurisdictions, data privacy laws provide a basis for claims for immaterial damages, although the deter - mination of such damages remains a contentious issue. Recent court decisions in the EU have clarified some aspects of compensation, emphasising that it should correspond to actual harm rather than serve as a puni - tive measure. However, courts tend to interpret relevant statutes broadly to ensure the efficient and continued protection of user privacy rights, which could poten - tially lead to more waves of mass claim litigation. The introduction of collective redress mechanisms, such as the Representative Actions Directive in the EU, has fuelled this trend and expanded legal protection for consumers, enabling them to file collective actions for data protection violations. This current develop - ment increases liability risks for companies, particu - larly with cross-border implications, and highlights the importance of robust compliance programmes.
9 CHAMBERS.COM
BRAZIL
Colombia
Ecuador
Brazil
Peru
Brasilia
Bolivia
Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello Lopes Pinto, Nagasse Advogados
Rio de Janeiro São Paulo
Paraguay
Chile
Argentina
Contents 1. Legal and Regulatory Framework p.12 1.1 Overview of Data and Privacy-Related Laws p.12 1.2 Rights and Obligations p.12 1.3 Special Categories of Personal Data p.13
1.4 Processing of Personal Data for Research and Development Purposes p.14 1.5 Processing of Personal Data in the Context of Artificial Intelligence p.14 1.6 Data Breach Requirement p.15 1.7 Regulators p.15 1.8 Enforcement Proceedings and Fines p.16 1.9 Enforcement Trends p.17 2. Privacy Litigation p.17 2.1 Privacy Litigation Overview p.17 2.2 Recent Case Law p.18 2.3 Collective Redress Mechanisms p.18 3. Requirements for the Protection and Processing of Non-Personal Data p.19 3.1 Objectives and Scope of Data Regulation p.19 3.2 Interaction of Data Regulation and Data Protection p.19 3.3 Rights and Obligations Under Applicable Data Regulation p.20 3.4 Regulators and Enforcement p.21
4. Sectoral Topics p.21 4.1 Use of Cookies p.21 4.2 Personalised Advertising and Other Online Marketing Practices p.21
4.3 Employment Privacy Law p.22 4.4 Data Protection in M&A p.22 5. International Considerations p.23 5.1 Restrictions on International Data Transfers p.23 5.2 Government Notifications and Approvals p.24 5.3 Data Localisation Requirements p.24 5.4 Blocking Statutes p.25 5.5 Recent Developments p.25
10 CHAMBERS.COM
BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
Lopes Pinto, Nagasse Advogados is based in São Paulo. The firm provides expertise across many ar - eas, including corporate and business law, tax and planning, data protection (LGPD, GDPR, and PIPL), contracts, regulation, digital assets, blockchain, transportation, logistics, labour, infrastructure, agri - business, banking and finance, bioscience, civil law, corporate governance, compliance, tech law, and
legal risks. The team of highly skilled professionals possesses in-depth experience of national and mul - tinational companies and law firms, and the modus operandi of organisations and businesses. Lopes Pinto, Nagasse Advogados prides itself on being a highly ethical firm, focused on achieving results and providing excellent service to its clients.
Authors
Japyassú Resende Lima is a partner at Lopes Pinto, Nagasse Advogados. He specialises in regulation, data protection (LGPD and GDPR), transportation, digital assets, blockchain, infrastructure,
Fabiana Lopes Pinto Santello is a founding partner at Lopes Pinto, Nagasse Advogados. She has completed both a Doctorate and a Master’s in Tax Law. She co-ordinates and lectures on corporate tax law at
logistics, bioscience, agribusiness, compliance, corporate governance, and corporate law. He has a DLM (Université Bordeaux), LLM (Fordham University) and a Master’s degree in Digital Business (UK) and Regulatory Law (USP/ Université de Montreal). He also has a Doctorate in Law (Université de Sorbonne) and completed postgraduate studies in business law (ESADE), economic law (Duke University) and data privacy law (LSE). He is a member of the Order of Attorneys of Brazil and the International Bar Association.
Fundação Armando Álvares Penteado (FAAP) and is also a director of communications at IASP. She is a published author in the field of tax and business law. She also speaks at national and international conferences and events on tax and other legal matters.
Lopes Pinto, Nagasse Advogados Rua Helena, 235, 4th floor Vila Olímpia São Paulo Brazil 04552-050
Tel: +55 11 2665 9200 Fax: +55 11 98311 0108 Email: contato@lopespinto.com.br Web: www.lopespinto.com.br/
11 CHAMBERS.COM
BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws In Brazil there are two sources of personal data pro - tection and privacy laws: (i) primary, or original, and (ii) secondary, or derived. Primary or original sources are concentrated in the Brazilian Federal Constitution and the General Data Protection Law (LGPD), since Brazil has adopted the centralist principle in which the protection of person - al data is governed by federal rules rather than local rules. This means that any provision on the protec - tion of personal data has its normative and conceptual origin in the Federal Constitution and the legal frame - work for the subject, ie, the LGPD. Within the scope of the Federal Constitution, even before the general concept of personal data and its protection was recognised, the safeguarding of people’s intimacy was already provided for in Article 5, X, considered the most essential sphere of per - sonal autonomy. With Constitutional Amendment No 115/22, the specific protection of personal data was entered into the list of fundamental rights, becoming part of the constitutional core to be protected. In terms of secondary or derived sources, reference should be made to the Consumer Protection Code (Law 8.078/90), which established rules for the use of personal data (it did not expressly refer to “process - ing”) in consumer relations. Subsequently, the Access to Information Law (Law 12.527/11) was enacted. Although it did not specifically refer to personal data, it introduced rules on how citizens could exercise the right to information, provided for in the Federal Constitution (Article 5, XXXIII), reinforcing the mecha - nisms designed to protect the inviolability of intimacy. With the Civil Rights Framework for the Internet (Law 12.965/14), the protection of privacy was further con - solidated, since the circulation of personal data and information online was afforded its own regulation. The big revolution came in 2018, with the introduction of the General Data Protection Law (Law 13.709/18). Materially inspired by the European Union’s General Data Protection Regulation, this Law gave personal
data the status of a “fundamental right protected in practice”, with modern and efficient mechanisms aimed at ensuring that the processing of this data should only occur within strict and well-defined guide - lines. From then on, and particularly following the enact - ment of Law 13.853/19, which established the Nation - al Data Protection Authority (ANPD) and the National Council for the Protection of Personal Data and Priva - cy, the LGPD gained an “enforceable” arm of personal data protection, similar to the international concept of “enforcement”. As a result, the ANPD, a federal agency whose main legal mandate is to regulate the processing of personal data in Brazil, began to issue key regulations on matters ranging from the role of the Data Protection Officer (DPO, referred to in the LGPD as the “Data Officer”) to the international transfer of personal data. This entire normative group, however, only has terri - torial scope in Brazil. The LGPD provides (Article 3, I) that its concepts and rules are applicable in so far as “the processing operation is carried out in the national territory”. In other words, there is strict territoriality. An important aspect of these rules is their relation - ship to legal issues regarding cybersecurity and AI. For example, the LGPD establishes that it is the obli - gation of the processing agent – especially the con - troller – to adopt cybersecurity measures (encryption, access control, cross-verification, 2FA, and others) to protect personal data. In the field of AI, the interaction with personal data protection standards is even more significant. Suffice to mention that the mechanisms employed by AI and its developments (machine learning, active virtualisa - tion, and others) rely on large databases to identify patterns, establish correlations, and generate results, which in general involves processing personal data, including sensitive data. 1.2 Rights and Obligations In Brazil, the processing of personal data can only be carried out under certain principles (LGPD, Article 6): • adequacy;
12 CHAMBERS.COM
BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
• good faith; • purpose; • free access; • non-discrimination; • necessity; • accountability;
• information on shared use of data; • intimacy; • freedom; • portability; • privacy; • revocation of consent; and • ownership.
• prevention; • data quality; • accountability; • security; and • transparency.
In the context of the processing of personal data, meeting the principles and respecting the rights is not sufficient. Each processing agent – controller and operator – must observe the “organic requirements” for this processing. The main “organic requirement” is the centralised and unitised control of personal data processing operations, provided for in Article 37 of the LGPD. This requires that the agent should institute, maintain, and manage a system capable of providing, in real time, up-to-date information on the circular - ity of personal data in the organisation, including the categories of data, the purpose of the processing, and the protection measures in place. In this sense, the processing agent should consider adopting strict and transparent internal policies, pro - tocols for the regular processing of data, specific pro - cedures and, at a more objective level, control tools, such as the assessment of the impact of the process - ing on the privacy of individuals and the assessment of legitimate interest (LIA). 1.3 Special Categories of Personal Data Sensitive data, which the LGPD defines as that refer - ring to racial or ethnic origin, religious conviction, political opinion, union membership or religious, phil - osophical or political organisation, health, sex life, genetics or biometrics (Article 5, II), receive special protection under the law. In this sense, this data may (or should only) be pro - cessed under the following bases: • consent; • compliance with a legal or regulatory obligation by the controller; • execution of public policies; • regular exercise of rights in judicial, administrative or arbitration proceedings;
Based on these principles, there are the so-called “essential requirements” for any processing of per - sonal data. The first is that the processing must be carried out under the rules of the LGPD, which involves investigating where the data was collected, where it is processed, and for what purposes (the “triad”). The other requirements are (Articles 7 and 11 of the LGPD): • consent of the data subject; • compliance with a legal or regulatory obligation by the controller; • execution of a contract or preliminary procedures in a contract to which the data subject is a party, at their request; • execution of public policies; • regular exercise of rights in judicial, administrative or arbitration proceedings; • legitimate interest of the controller or third party; • protection of the life or physical safety of the data subject or a third party; • credit protection; • conducting studies by a research body; and • protection of health by health professionals. The LGPD also establishes the main rights of the data subject (Articles 17 and 18): • access to personal data; • anonymisation, blocking or deletion of unneces - sary, excessive or non-compliant data; • confirmation of processing treatment; • data correction; • deletion of personal data processed with consent; • information about non-consent;
13 CHAMBERS.COM
BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
• guarantee of fraud prevention and the security of the data subject; • protection of the life or physical safety of the data subject or a third party; • conducting studies by a research body; and • protection of health by health professionals. Personal data related to children and adolescents may also be processed, but the legislation requires that this be done under an unclear criterion of the “best inter - est”. This means that processing this type of personal data must consider the special protection given to the intimacy and privacy of children and adolescents, without creating an insurmountable restriction. The legislation also imposes two conditions: the process - ing must comply with the principles and rules of the LGPD and, in the case of children, the consent of a parent or legal guardian is required. 1.4 Processing of Personal Data for Research and Development Purposes In the context of the processing of personal data for research and development, especially of health and life protection products and services, the subject is more complex and must be evaluated from two angles: that of the processing carried out by the government and that of the processing resulting from applications and mechanisms provided by private companies. The LGPD provides (Article 13) that it must occur with - in the public entity – which, in other words, means that hiring third parties for processing and sharing the data is not allowed – and under strict security and reliability protocols, including anonymisation or pseudonymisa - tion. Even in these cases, the processing must respect the principles and requirements of the LGPD, especially if it involves handling of sensitive data or data of high relevance to individuals. The same level of care applies to the processing resulting from applications and mechanisms provided by private companies (MedTechs, HealthTechs, etc). Even stricter criteria may also apply. For example, in the case of R&D, the processing of personal data must be based on a “strictly legitimate purpose”, ie, one
that, in origin, has a legitimacy that cannot be ques - tioned. In addition, the processing must be based on irreversible anonymisation, in which the data cannot be linked to a specific person and which, therefore placing it outside the rules of the LGPD. In terms of commercial use of this data, Brazil follows the European system: it is prohibited to process the data for commercial purposes or to achieve economic advantage, except for the provision of health services. 1.5 Processing of Personal Data in the Context of Artificial Intelligence In the context of personal data processing and AI, two premises are strictly essential: “human in the loop” (“human on the top”) and strict compliance with data protection legislation. These principles give rise to some requirements. The first is that the use of personal data in AI systems, models, or resources must always consider risk- based regulation, which prohibits AI being used for behavioural manipulation or sensitive categorisation (eg, the use of biometric data). The second is the strict and rigorous assessment of high-risk AI, considered to be systems that can significantly impact fundamen - tal rights, public safety or the health of the population, in line with the criteria of the European AI Act. The third requirement is that AI should always be subject to active human supervision, especially in the case of automated decisions. In Brazil, the regulation of AI is still under discussion. The most recent document in this regard is Bill 2,338, approved by the Senate and currently under consid - eration in the Chamber of Deputies. According to the Bill, some high-risk categories should require much stricter restrictions, such as employee recruitment and selection, justice and law enforcement, and facial rec - ognition and biometrics. The Bill also considers some modalities of AI as excessive risk (Article 14), and as a result prohibits models whose objective is, for example, behavioural manipulation, real-time biometric identification, and emotion recognition.
14 CHAMBERS.COM
BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
1.6 Data Breach Requirement The expression “data breach” is part of a larger cat - egory of events harmful to personal data called “secu - rity incident.” Resolution CD/ANPD 15/24 defines a security incident as “any confirmed adverse event, related to the violation of the properties of confidenti - ality, integrity, availability, and authenticity of personal data security” (Article 3, XII). In general, a security incident can encompass differ - ent types of attacks on personal data, including the violation itself, improper disclosure, and data leakage, ranging in severity from the most minor to the most serious. The Brazilian regulator has established a set of meas - ures necessary to deal with a security incident, man - age its effects and prevent its repetition over time, as outlined below. • Communication to the regulator: the control - ler must formally notify the ANDP of the incident within three days of the occurrence. • Communication to the data subject: the control - ler must formally communicate the incident to the data subject within three days of becoming aware that the incident has affected the data subject’s data. • Information: the controller must include, in the communication, a description of the nature and category of personal data affected. • Recordkeeping: the controller must maintain a detailed record of the incident for five years. • Management: the DPO takes over the management of the incident. • Compliance: the controller and DPO establish how and to what extent regulatory compliance was impacted by the incident. A security incident may require an inspection action by the regulator, with or without the application of penalties. However, there is always the possibility that an incident that compromises a large amount of data or exceeds the controller’s limits will be investi - gated by the ANPD or even by the Public Prosecutor’s Office. In addition, an incident may also lead to claims for indemnification (reparation) against the controller,
requiring it to compensate data subjects for losses and damages (LGPD, Article 42). 1.7 Regulators In Brazil, the regulatory authority for personal data and its protection has been well established since Law 13,853/19, which created the ANPD. This authority is competent to, among other respon - sibilities (LGPD, Article 55-J): • co-ordinate with public regulatory authorities to exercise their powers in specific sectors of eco - nomic and governmental activities subject to regulation; • enter into an agreement with processing agents to eliminate irregularities, legal uncertainty or litigation in the context of administrative proceedings; • deliberate, in the administrative sphere, on a con - clusive basis, on the interpretation of this Law; • provide for the forms of publicity of personal data processing operations; • issue regulations and procedures on personal data protection and privacy, as well as on personal data protection impact reports for cases in which the processing represents a high risk to the guarantee of the general principles of personal data protec - tion provided for in this Law; • draft guidelines for the National Policy for the Pro - tection of Personal Data and Privacy; • supervise and apply sanctions in the case of non- compliant data processing, through an administra - tive process that ensures the adversarial process, full defence and the right to appeal; • implement simplified mechanisms, including by electronic means, for the registration of complaints about the violation of this Law; and • promote co-operation with personal data protec - tion authorities in other countries, of an interna - tional or transnational nature. The ANPD’s role, although predominantly guiding (at this stage of Brazilian legislation), has a strongly instructive, supervisory and sanctioning character. This is possibly why its investigative process, espe - cially regarding direct violations of personal data pro - tection legislation, is especially detailed. Under the
15 CHAMBERS.COM
BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
1.8 Enforcement Proceedings and Fines Investigative actions within the scope of the ANPD begin with the General Coordination of Inspection (CGF), and from there unfold within a very specific procedure. A complaint, a news item or an event of public knowl - edge can start an investigation. At this stage, the ANPD is presented with a “cold fact”, raw material for analysis. The next stage is the preparatory proce - dure, which, even though it is not mandatory, allows the ANPD to collect preliminary elements to support a potential PAS. The next step is the collection of evidence by the Regulator’s technical team, which searches different sources for the material necessary to “instruct” the investigation process. Subsequently, the party being investigated, who may be a personal data processing agent, is notified and has ten busi - ness days to respond. According to the LGPD, different penalties can be applied to cases of violation of legal rules on personal data. The sanctions list (LGPD, Article 52) includes: • warning; • fines of up to 2% of the revenue of the private legal entity, group or conglomerate, limited, in total, to BRL50 million per infraction; • daily fines, subject to a total limit (see previous bullet); • publication of the infraction; • blocking of the personal data to which the infrac - tion refers until it is regularised; • deletion of the personal data to which the infringe - ment refers; • partial suspension of the operation of the database to which the infraction refers; • suspension of the exercise of the personal data processing activity to which the infringement refers; and • partial or total prohibition of the exercise of activi - ties related to data processing. As for the criteria for setting penalties, the legislation provides that the seriousness and nature of the infrac - tion, the size of the offending agent, the advantage obtained or intended, recidivism, the co-operation of the agent, the mitigation measures adopted by
General Coordination of Inspection (CGF), the focus of this process is to evaluate, analyse and determine the level of compliance with the General Data Protection Law by processing agents, and may have a preventive or repressive nature. The sequence is: • the investigation can start with reports from data subjects, notifications of security incidents, impact reports or sample inspections; • the ANPD notifies the processing agent to pre - sent information, evidence, and proof, which may include document collection and even local audits; • the ANPD verifies the consistency of the respons - es, and some measures, especially prevention, can be adopted at this stage; • opening of an Administrative Sanctioning Proceed - ing (PAS), if the irregularities continue or are suf - ficiently serious; • establishment of the PAS and notification of the investigated party; • production of evidence and analysis of facts by the technical area of the ANPD; • the processing agent can present their defence; • decision on the application of sanctions, with the possibility of appeal; and • deadline for the investigated party to appeal. The issue of binding status still generates debate, but in general it is understood that the ANPD’s decisions are binding, albeit in a stricter sense. This means that they bind personal data processing agents (control - lers and operators) and are definitive in the admin - istrative sphere, after the applicable appeals. How - ever, the “atypical” binding, the one referred to other spheres of power or to agents who did not partici - pate in the administrative process, remains debatable. This is the case, for example, for ANPD investigations shared with the Administrative Council for Economic Defense (CADE), whose use could inform the internal proceedings of this Council on anti-competitive prac - tices. Although such co-ordination exists, the binding effect, due to the lack of essential legal prerequisites, is not yet fully mandatory in these cases.
16 CHAMBERS.COM
BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
them and their economic situation may be taken into account. 1.9 Enforcement Trends There have been many developments in recent months in terms of privacy, security in the process - ing of personal data and inspection, especially in the expansion of certain basic concepts. Some notable events include the following. • The advancement of operations with crypto-assets has required that extra care be taken with personal data, especially those submitted to blockchain- based trading. These operations often involve personal data of the traders that crosses borders, which implies international sharing and indistinct storage. • The pressure on the processing of sensitive per - sonal data has significantly increased. The LGPD’s protection of this data does not seem to be suffi - cient to stop practices such as “biotyping”, passive biometrics, and the transfer of databases without the knowledge (and even without agreement) of the data subjects. • The judiciary has explicitly recognised, following a decision of the Superior Court of Justice (STJ), that there is presumed moral damage (without the need for explicit proof) if a processing agent shares personal data without the knowledge or agreement of the data subject. • The international transfer of personal data has gained more attention from the ANPD, following the publication of Resolution 19, which imposes stricter conditions on this transfer. For organisations, there are many lessons: • policies are insufficient; it is necessary to demon - strate the complete mapping of data flows (dynam - ic), so that the data subject knows how and for what purpose their data is processes; • embed privacy considerations from the outset when developing new AI products, services, and algorithms; • implement quick and effective incident response plans; • liability for personal data is joint and several;
• adopt rigorous anonymisation and pseudonymisa - tion techniques when dealing with sensitive data and train AI models to minimise risk. Privacy is now treated as a competitive differentiator and a driver of customer loyalty (privacy-led market - ing), beyond just a compliance requirement.
2. Privacy Litigation 2.1 Privacy Litigation Overview
Arguably, the number of litigations and disputes involving privacy and personal data is growing year by year. These conflicts are no longer about finan - cial issues, but relate to the improper, unauthorised, rights-violating or even illegal use of personal data for commercial purposes, and in some cases, illicit activities. With the consolidation of the LGPD and the structur - ing of the ANPD, the trend towards greater judicialisa - tion is being observed at different levels, including in the main Brazilian courts. Litigation has originated from these main sources: • security incidents; • misuse of personal data; • inadequate processing, without purpose and with - out legal basis; • invasive biometrics; • sharing for financial purposes; • violation of minimum rights by some mass con - sumer companies; • improper commercial profiling; and • use of personal data to contract unsolicited ser - vices. These disputes range from personal data subjects and consumers to civil society entities and the Pub - lic Prosecutor’s Office. There are already signs that groups of data subjects, impacted by the misuse of their data, are organising to file complaints with the regulator, establishing a regulatory basis for relevant lawsuits. Employees, with the support of their unions, are taking action against practices such as the use of biometric data by companies to monitor working
17 CHAMBERS.COM
BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
hours in remote work and the so-called “broad base”, a non-formal platform that gathers personal data of various types, including sensitive data, to establish behavioural patterns and guide hiring decisions based on employee profiles. Litigation related to personal data and privacy has also strongly influenced the courts, which now recog - nise convictions based on presumed moral damage, or even moral damage for the repeated practice of violations of personal data legislation. Although with some caution, jurisprudence already considers that, under certain circumstances, moral damage arises from the mere absence or ineffectiveness of internal mechanisms of organisations, which results in secu - rity incidents. Incidents which were previously con - sidered “external fortuitous” (attributable to causes beyond the control) are beginning to be seen as an “internal failure”, a defect in practices and policies, under the responsibility of the personal data controller. Assessing the effects of a data breach, for example, is still done cautiously, and on a case-by-case basis. Factors include if the violated data is sensitive, if the impacted person is a child or elderly, if the event had public repercussions, or if it was nothing more than a mere inconvenience. 2.2 Recent Case Law More recently, some courts, especially the one in São Paulo, have decided that “hacker” attacks on systems cannot always be considered an “external fortuitous” (cause beyond the control of the organisation). If the company does not demonstrate, with evidence, that it adopts and practices adequate security measures, the case is one of “internal fortuitousness”, in line with the principle of accountability (LGPD, Article 6, X). Another important basis for decisions is to consider that the data controller is only exempt from being liable for a personal data breach if it proves one of the so-called “exclusions”, as provided for in Article 43 of the LGPD. At the end of 2025, the Superior Court of Justice rec - ognised the existence of presumed moral damage in a case of sharing personal data related to the monthly income, address, and personal telephone numbers
of consumers to third parties, regardless of proof of actual harm, on the grounds that this type of conduct violates the legitimate expectations, privacy, and per - sonality rights of the data subject. 2.3 Collective Redress Mechanisms A topic under discussion in Brazil is whether there is a basis for collective or diffuse (indistinct) compensation for damages resulting from violations of personal data protection legislation. In general terms, collective redress in Brazil is a reg - ulated and mature matter in the courts, serving to safeguard rights that are not strictly individual and to provide financial compensation (if applicable), based on the Federal Constitution and developments under the Consumer Protection Code and the Public Civil Action Law (Law 7.347/85). What has been put to the test is whether, in the con - text of personal data as a fundamental right, in which the privacy and intimacy of individuals are at stake, collective or diffuse remedies are the most appropri - ate. The General Data Protection Law does not refer to “diffuse damage”, but to “collective damage” (Article 42). The distinction matters. In cases of “diffuse dam - age”, the impact falls on an indistinct set of individu - als, not necessarily belonging to a specific or deter - mined collective. In the case of “collective damage”, a group or class of individuals is impacted, directly or indirectly, and thereby acquires the right to seek repa - ration. Therefore, if a security incident impacts not only certain individuals, but a collective of them, the legal framework for comprehensive reparation (“col - lective”) applies. This reparation covers both the pat - rimonial (material) and the moral (immaterial) aspects, and the controller or operator is fully responsible. Collective damage can be claimed by the Public Prosecutor’s Office, the Public Defender’s Office, the Union, states, municipalities or legally constituted associations. However, the reparability of the damage requires the fulfilment of certain conditions. First, the damage must have resulted from the activity of the processing agent
18 CHAMBERS.COM
Page i Page 1 Page 2 Page 3 Page 4 Page 5 Page 6 Page 7 Page 8 Page 9 Page 10 Page 11 Page 12 Page 13 Page 14 Page 15 Page 16 Page 17 Page 18 Page 19 Page 20 Page 21 Page 22 Page 23 Page 24 Page 25 Page 26 Page 27 Page 28 Page 29 Page 30 Page 31 Page 32 Page 33 Page 34 Page 35 Page 36 Page 37 Page 38 Page 39 Page 40 Page 41 Page 42 Page 43 Page 44 Page 45 Page 46 Page 47 Page 48 Page 49 Page 50 Page 51 Page 52 Page 53 Page 54 Page 55 Page 56 Page 57 Page 58 Page 59 Page 60 Page 61 Page 62 Page 63 Page 64 Page 65 Page 66 Page 67 Page 68 Page 69 Page 70 Page 71 Page 72 Page 73 Page 74 Page 75 Page 76 Page 77 Page 78 Page 79 Page 80 Page 81 Page 82 Page 83 Page 84 Page 85 Page 86 Page 87 Page 88 Page 89 Page 90 Page 91 Page 92 Page 93 Page 94 Page 95 Page 96 Page 97 Page 98 Page 99 Page 100 Page 101 Page 102 Page 103 Page 104 Page 105 Page 106 Page 107 Page 108 Page 109 Page 110 Page 111 Page 112 Page 113 Page 114 Page 115 Page 116 Page 117 Page 118 Page 119 Page 120 Page 121 Page 122 Page 123 Page 124 Page 125 Page 126 Page 127 Page 128 Page 129 Page 130 Page 131 Page 132 Page 133 Page 134 Page 135 Page 136 Page 137 Page 138 Page 139 Page 140 Page 141 Page 142 Page 143 Page 144 Page 145 Page 146 Page 147 Page 148 Page 149 Page 150 Page 151 Page 152 Page 153 Page 154 Page 155 Page 156 Page 157 Page 158 Page 159 Page 160 Page 161 Page 162 Page 163 Page 164 Page 165 Page 166 Page 167 Page 168 Page 169 Page 170 Page 171 Page 172 Page 173 Page 174 Page 175 Page 176 Page 177 Page 178 Page 179 Page 180 Page 181 Page 182 Page 183 Page 184 Page 185 Page 186 Page 187 Page 188 Page 189 Page 190 Page 191 Page 192 Page 193 Page 194 Page 195 Page 196 Page 197 Page 198 Page 199Powered by FlippingBook