Notice, VERBIS, data security, breach notification and cross-border transfer: a compliance checklist.
Personal data protection is not only the duty of large companies; it applies to any business keeping a customer list. Breaching Law No. 6698 leads to administrative fines and reputational damage. Here are the core obligations businesses should review.
1. Duty to inform
When collecting data, the data subject must be told who processes the data, for what purpose, to whom it may be transferred and on what legal ground. Website forms, customer records and employee files each need their own privacy notices.
2. Legal ground and explicit consent
Every processing activity must rest on a condition in Article 5 or 6 of the Law. Explicit consent is obtained only when needed; asking for consent where grounds such as performance of a contract or a legal obligation apply is a mistake.
3. VERBIS registration
Data controllers exceeding the headcount or balance sheet thresholds set by the Board, or whose main activity is processing special-category data, must register with the Data Controllers' Registry.
4. Data security measures
Technical and administrative measures such as access authorisation, encryption, backups, logging and employee confidentiality undertakings must be in place. The most common deficiency in Board decisions is failing to prevent unauthorised access.
5. Retention and destruction policy
When the purpose of processing ends, data must be deleted, destroyed or anonymised. Periodic destruction intervals should be fixed in a written policy.
6. Data subject requests
Requests must be answered within 30 days at the latest. The channel (email, registered email, form) must be clearly announced.
7. Breach notification
The Board must be notified within 72 hours of learning of a breach and data subjects as soon as possible.
8. Cross-border transfers
Under the amendment in force since 2024, transfers abroad must rely on an adequacy decision, standard contract, binding corporate rules or an undertaking. A notification period to the Board applies after signing standard contracts.
9. Employee and candidate data
CVs, personnel files and camera recordings are also personal data. Candidates must be informed in recruitment processes.
10. Third-party service providers
Data processing agreements should be made with cloud, accounting or CRM providers, and the provider's security level audited.
Administrative fines
The Board imposes administrative fines, updated annually by the revaluation rate, for breaches of the duty to inform, failure to take security measures, and breaches of breach notification and VERBIS obligations. Follow Board announcements for current amounts.
Compliance starts with an inventory, followed by policies and contracts, then training and regular audits.