What It Is

Lei Geral de Proteção de Dados Pessoais (LGPD), Law No. 13.709/2018, is Brazil's comprehensive federal regulation for personal data processing. It protects data subjects' rights with extraterritorial scope, applying to any processing targeting Brazilian residents. Adopting a risk-based approach, it mandates 10 principles like purpose limitation, necessity, and accountability.

Key Components

• 10 core principles (e.g., transparency, security, non-discrimination)
• 10 legal bases for processing (consent, legitimate interests, etc.)
• Data subject rights (access, deletion, portability)
• ANPD enforcement with graduated sanctions
• DPIAs for high-risk activities; no formal certification but records and DPO required

Why Organizations Use It

LGPD compliance avoids fines up to 2% Brazilian revenue (R$50M cap), operational halts, and reputational harm. It builds trust, enables market access in Brazil's digital economy, reduces breach risks, and supports AI innovation via anonymization exemptions.

Implementation Overview

Phased risk-based methodology: governance/DPO appointment, data mapping/RoPAs, policies, technical controls, DSR/incident processes, vendor SCCs. Applies to all sizes/industries processing Brazilian data; ANPD audits enforce, no certification but ongoing monitoring essential.

What It Is

TISAX (Trusted Information Security Assessment Exchange) is an industry-specific assessment framework and exchange platform for information security in the automotive supply chain. Developed by the ENX Association based on the VDA ISA catalog (version 5.0.4+), it verifies protection of sensitive data like IP, prototypes, and personal information against cyber threats. It uses a risk-based approach with three maturity levels: Basic, Significant, Very High.

Key Components

• 70+ controls across 7 groups: Policy, Organization, Personnel, Physical Security, Access, Cryptography, Operations.
• Built on ISO 27001 with automotive extensions like prototype protection.
• Assessment levels (AL1 self-assess, AL2 remote, AL3 on-site) and modular objectives (e.g., prototype parts/vehicles).
• 3-year labels shared via ENX portal.

Why Organizations Use It

• Contractual mandates from OEMs (e.g., BMW, VW) prevent revenue loss.
• Reduces duplicate audits (70-90% efficiency), enhances market access, mitigates €4.5M breach costs.
• Builds trust, enables IP protection in €2.5T supply chain.

Implementation Overview

Phased (6-18 months): gap analysis, control remediation, tabletop exercises, accredited audits (e.g., DQS, TÜV). Targets automotive suppliers/OEMs globally; scalable for SMEs to enterprises.