Data Protection

Barbieri Advogados acts in data protection law through a practice that combines privacy governance, contracts and operations involving data processing, incident management and regulatory work, with simultaneous technical reading of the LGPD (Lei nº 13.709/2018, the Brazilian General Data Protection Law) and the GDPR (Regulation (EU) 2016/679) — underpinned by the firm’s established expertise in European projects conducted from the Stuttgart office. The practice operates at a moment of institutional consolidation in the Brazilian data protection regime: the ANPD Sanctions Regulation (Resolução CD/ANPD nº 4/2023) established the rules governing enforcement and the calibration of administrative sanctions, and the Brazilian Data Protection Authority (ANPD) progressively intensifies its enforcement activity, in dialogue with the emerging case-law of Brazilian courts.

The practice is structured around three main pillars. In governance and compliance, the firm acts on LGPD compliance programmes — data flow mapping, analysis of legal bases, recording of processing operations, data protection impact assessment (DPIA), drafting of internal policies, retention and disposal programmes, team training, and structuring the role of the data protection officer (DPO). The firm also acts in the review of contracts with data controllers and processors, addressing data processing clauses, international transfers and liability allocation between processing agents. In incident management and response, the firm acts on the legal analysis of incidents involving personal data, the definition of emergency measures and communication strategy, notifications to data subjects and to the ANPD, oversight of forensic analyses, and defence in related administrative and judicial proceedings. In regulatory engagement, the firm conducts representation before the ANPD in administrative proceedings, information requests and sanction-related developments, and monitors the regulatory evolution of the Brazilian data protection regime.

The practice works in close coordination with Blockchain and Artificial Intelligence on AI systems, blockchain platforms and related digital environments, with German Office on operations with a European component and on projects subject to dual LGPD and GDPR regimes, and with Employment on the processing of employee data and workplace monitoring.