Is Brazil’s data protection law now in force?

Brazil’s Senate has adopted an amendment to bring the main provisions of the Data Protection Act, LGPD, in force from 27 August 2020.

But there has been uncertainty over whether the law is actually in force due to complex legislative proceedings. A temporary executive order, Executive Order No. 959 (MP 959), issued by the President, had changed the effective date of the LGPD to 3 May 2021. The order comes definitive law only when approved by the Senate.

Professor Danilo Doneda, of IDP Brazil, told PL&B that the Federal Senate issued a note in the evening of 26 August that aims at giving an official interpretation of the situation. According to the Senate, as the MP959 was changed in its content by the Congress, it must now be enacted by the President, who has 15 days to do so. Meanwhile, its original text is still valid.

This is controversial, but Doneda sees no room for dispute. Whenever MP959 will be enacted, the postponement of LGPD will lose its effect and the original date of entry into force – 15 August 2020 – must be respected - even if LGPD isn’t valid today, Doneda explained.

Doneda said that while many experts are not at ease with yesterday’s decision, he thinks that litigation against it would be difficult.

Yesterday the government also issued a Decree creating the Data Protection Authority (in Portuguese)

The LGPD, adopted in 2018, is Brazil’s first comprehensive data protection law, and has been inspired by the GDPR. See an analysis of the law in PL&B International Report June 2019, p.1.