The work covers information flows, legal bases for processing and governance measures. Policies, privacy notices and procedures for responding to individuals should reflect organizational practices. Impact assessments and risk analysis support the review of processing activities that require particular attention, helping translate identified concerns into decisions and documented responsibilities.
In relationships with suppliers, partners and group companies, the analysis addresses processing responsibilities and the conditions for sharing data and transferring it internationally. In acquisitions and investments, due diligence considers privacy risks and the safeguards needed when information is accessed during negotiations and business integration.
Following a security incident, legal work is coordinated with technical teams to assess obligations, preserve records and prepare relevant communications. The scope also includes responses to regulatory inquiries, proceedings before Brazil’s data protection authority, ANPD, and litigation concerning personal data processing. Advice considers the available evidence and the consequences of each proposed response.
Scope of Work
- LGPD compliance assessments and privacy governance.
- Data processing agreements and international transfers.
- Individual rights and data protection impact assessments.
- Privacy due diligence in corporate transactions.
- Personal data incidents, regulatory inquiries and litigation.
In Practice
How does privacy affect an acquisition or investment?
The review considers the company’s practices, data flows, contracts and identified risks. It also examines access to information during negotiations and integration arrangements so that transaction documents address the relevant responsibilities.
For an Initial Discussion
Describe the data processing or situation prompting the enquiry, the parties and the systems involved. For incidents or notices, state when you became aware of the matter and what steps have already been taken.
Contact the firm.