What It Is

Lei Geral de Proteção de Dados Pessoais (LGPD, Law No. 13.709/2018) is Brazil's comprehensive federal regulation for personal data protection. Enacted in 2018 and fully enforced since 2021, it safeguards privacy rights with extraterritorial scope applying to any processing targeting Brazilian residents. Its risk-based approach emphasizes accountability, minimization, and data subject rights, enforced by the ANPD.

Key Components

• **10 core principlespurpose limitation, necessity, transparency, security, prevention, non-discrimination, accountability.
• 10 legal bases for processing (e.g., consent, legitimate interests, credit protection).
• **Data subject rightsaccess, correction, deletion, portability, objection to automated decisions.
• **Governancemandatory DPO for controllers, DPIAs for high-risk activities, RoPAs. Compliance via graduated sanctions up to 2% Brazilian revenue (R$50M cap).

Why Organizations Use It

LGPD compliance mitigates fines, operational disruptions, and reputational harm while building trust. It enables market access in Brazil's digital economy, leverages anonymization exemptions for innovation, and aligns with GDPR for multinationals. Strategic benefits include efficiency from data mapping and competitive differentiation.

Implementation Overview

**Phased, risk-based methodologygovernance setup, data mapping/RoPAs, policies, technical controls (encryption, access), DSR/incident processes, vendor DPAs with SCCs (mandatory by 2025). Applies to all sizes/industries processing Brazilian data; ANPD audits enforce, no certification but records/DPIAs required.

What It Is

MAS Technology Risk Management (TRM) Guidelines (January 2021) are supervisory guidelines issued by Singapore's Monetary Authority of Singapore (MAS) for financial institutions. They provide a principles-based framework focused on managing technology and cyber risks to ensure confidentiality, integrity, and availability (CIA) of systems and data. The approach emphasizes proportionality based on risk profile, complexity, and criticality.

Key Components

• Covers 15 sections including governance, risk frameworks, secure development, IT operations, resilience, access controls, cryptography, cyber operations, assessments, and audit.
• Synthesizes 12 core principles like board accountability, asset management, third-party oversight, and defence-in-depth.
• No fixed controls; relies on outcomes-based compliance with independent assurance.

Why Organizations Use It

• Mandatory for MAS-supervised FIs to demonstrate robust practices during supervision.
• Mitigates cyber threats, enhances resilience, and builds customer trust.
• Enables digital innovation while avoiding fines and enforcement actions.

Implementation Overview

• Phased: governance setup, asset inventory, risk assessment, control deployment, testing.
• Targets banks, insurers, fintechs in Singapore; scalable by size.
• Requires board-approved strategies, audits; no formal certification.