BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
with respect to the personal data under their control, that is, data that they themself handle. Second, the responsibility of the processing agent must be evi - denced, not assumed. In this regard, one of the most important discussions is whether this liability is objec - tive or subjective, that is, whether it depends on a conscious or assumed attitude of the agent (recent court decisions indicate that this liability is objective). Third, the harmful event must be assessed against the exclusions provided for in the LGPD (Article 43), which can relieve the processing agent of the responsibil - ity for the event and, consequently, the obligation to provide compensation or reparation. 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation In Brazil, the regulation of the internet of things (IoT) has advanced significantly, but there are still no spe - cific provisions on the protection and processing of non-personal data in this field. However, some non-specific laws deal with this sub - ject. • Industrial Property Law (Law 9.279/96): deals with the protection and processing of non-personal data in the context of business secrets and confidential technical elements. • Civil Rights Framework for the Internet (Law 12,965/14): establishes principles, guarantees, rights and duties for the use of the internet, includ - ing keeping records of connection and access to applications in general. • Sectoral regulations: agencies such as the tel - ecommunications regulator (Anatel) and the Central Bank (Open Finance) have guidelines on the shar - ing of non-personal data in financial services. In general terms, companies also use some non-per - sonal data protection mechanisms within the scope of their respective businesses: • non-personal data processing agreements;
However, one issue worries companies and regula - tors: the so-called “gray area”, or “inflection zone”. This arises when certain activities involve the coex - istence of the processing of personal data with the processing of non-personal data. In such cases, due to the existence of “associated personal data”, the LGPD applies, at least in a dominant or preponderant character. Brazil does not yet have its own Data Act, such as the EU Data Act, which determines who can access and make use of data generated by connected prod - ucts (the “provenance data”). The ANPD has intensi - fied studies on anonymisation and may, in the coming months, regulate the use and sharing of IoT technical data. Something that can help a lot in this regard is that Brazil and the European Union have now mutually recognised (in the case of the EU this happened very recently, in 2026) that their respective personal data protection systems offer an adequate level of protec - tion for this data. This is a significant development, which may even facilitate the procedures for the inter - national transfer of personal data between the two blocs. 3.2 Interaction of Data Regulation and Data Protection The interaction between data protection and data protection adopts, in general terms, the integrative principle. This means that the two subsystems (legis - lative and regulatory) are harmoniously co-ordinated to offer individuals a set of safeguards that work with each other. In this way, while the legislation (especial - ly the LGPD) places the processing of personal data within specific guidelines (requirement for legal bases, observance of principles, greater care with sensitive data, etc), regulation operates at a higher level, seek - ing to order and discipline the behaviour of processing agents and ensure compliance with the legislation, including sanctions. If the LGPD establishes that the processing of per - sonal data is only possible within the established legal hypotheses (the so-called “legal bases” in Articles 7 and 11) and that non-compliance may generate penal - ties and an obligation to repair damages, the regula -
• cloud and IoT contracts; and • non-personal data protocols.
19 CHAMBERS.COM
Powered by FlippingBook