bmad-plus 0.4.4 → 0.6.0

package/src/bmad-plus/packs/pack-shield/references/lgpd/anpd-enforcement.md

@@ -0,0 +1,147 @@
+# ANPD Enforcement Reference
+
+## Autoridade Nacional de Proteção de Dados (ANPD)
+
+Brazil's national data protection authority, established by Law 13,853/2019 as part of the federal government, with technical and decisional autonomy.
+
+**Website:** https://www.gov.br/anpd/pt-br  
+**Contact:** anpd@anpd.gov.br
+
+---
+
+## ANPD Organisational Structure
+
+- **Board of Directors (Conselho Diretor):** 5 directors appointed by the President of Brazil; 4-year staggered terms
+- **National Council for Personal Data and Privacy Protection (CNPD):** Advisory body; civil society, government, and expert representatives
+- **Internal Structure:** Departments for enforcement, regulation, international affairs, communications
+
+---
+
+## Enforcement Process
+
+### Phase 1 — Preliminary Investigation (Processo Administrativo Preliminar)
+1. ANPD receives complaint, monitoring signal, or self-initiated referral
+2. Preliminary investigation to determine whether to open formal proceedings
+3. Duration: typically 60 days (extendable)
+4. Controller/processor may be contacted for information
+
+### Phase 2 — Administrative Investigation (Processo Administrativo Sancionador)
+1. Formal notice to accused party
+2. Right of defence: 15 business days to present response
+3. Evidence gathering, hearings if necessary
+4. Reporting officer prepares draft decision
+5. Board votes on decision
+6. Final administrative decision issued
+
+### Phase 3 — Appeal
+1. Decision may be appealed internally to ANPD Board within 10 business days
+2. After ANPD appeal: judicial review available in Federal District courts
+
+### Timelines
+- **Prescription:** 5 years from when ANPD becomes aware (Art. 54)
+- **Complaint response:** ANPD aims to respond to complaints within 30 days (varies in practice)
+
+---
+
+## Penalty Calculation Methodology
+
+### Simple Fine (Art. 52, II)
+**Cap:** Lesser of 2% of Brazilian revenue (prior FY) or R$50,000,000 per violation.
+
+**For groups of companies:** 2% of group's Brazilian revenue.
+
+**Factors considered (Art. 52, §1º):**
+
+| Factor | Impact |
+|--------|--------|
+| Gravity and nature of violation | Higher gravity → higher fine |
+| Data subjects' good faith | Mitigating |
+| Advantage gained from violation | Higher advantage → higher fine |
+| Conditions of controller (size, economic position) | Proportionality |
+| Recidivism | Aggravating |
+| Degree of damage | Higher damage → higher fine |
+| Cooperation with investigation | Mitigating |
+| Good faith and internal controls | Mitigating |
+| Promptness of corrective measures | Mitigating |
+| Proportionality and necessity | Baseline consideration |
+
+### Daily Fine (Art. 52, III)
+Daily accrual to compel compliance; same R$50M cap per violation.
+
+### Multiple Violations
+Each violation may be treated separately. Multiple fines may be stacked.
+
+---
+
+## Enforcement Priorities (ANPD Strategic Agenda)
+
+ANPD has indicated priority focus areas:
+1. **Large-scale data breaches** — incidents affecting many Brazilians
+2. **Sensitive data processing without legal basis** — health, biometric, financial
+3. **Children's data** — processing without verifiable parental consent
+4. **International transfers** — to countries without adequate protection
+5. **Failure to respond to data subject rights** — especially access and deletion
+6. **Lack of DPO appointment** for controllers required to appoint
+
+---
+
+## Notable ANPD Enforcement Actions
+
+### Telemarketing / Call Centre Sector (2023)
+ANPD investigated multiple companies for unlawful processing of personal data for telemarketing without adequate legal basis. Issued warnings and remediation orders.
+
+### Health Sector Data Sharing (2022–2023)
+ANPD investigated sharing of health data (sensitive data) with third parties without express consent. Issued compliance orders.
+
+### Large-Scale Data Breach Investigations
+ANPD has opened investigations following major data leaks affecting millions of Brazilian CPF (taxpayer ID) numbers. Status of fines pending as of 2025.
+
+### Clarification Orders
+ANPD has issued numerous "Comunicados" and "Notas de Esclarecimento" setting expectations for sectors on specific topics (facial recognition, cookies, employee monitoring).
+
+---
+
+## Cooperation with Other Authorities
+
+### Brazilian Authorities
+- **SENACON (Secretaria Nacional do Consumidor):** Consumer protection — joint enforcement on matters affecting consumers
+- **CADE (Conselho Administrativo de Defesa Econômica):** Competition — data and market power interactions
+- **Banco Central:** Financial data oversight
+- **ANS/ANVISA:** Health sector data
+
+### International Cooperation
+ANPD has signed MoUs with:
+- Portuguese DPA (CNPD — Portugal)
+- Uruguayan authority (URCDP)
+- CNIL (France)
+- UK ICO
+- Ibero-American Data Protection Network (RIPD)
+
+ANPD participates in Global Privacy Assembly (GPA).
+
+---
+
+## Complaint Filing Process
+
+Data subjects may file complaints with ANPD at: https://www.gov.br/anpd/pt-br/assuntos/peticoes
+
+**Required information:**
+- Identity of data subject (CPF required for Brazilian residents)
+- Identity of controller (CNPJ/name)
+- Description of alleged violation
+- Evidence where available
+- Rights already exercised with the controller
+
+**ANPD first refers complaint to controller** (gives opportunity to resolve); escalates to investigation if unresolved.
+
+---
+
+## LGPD vs. Other Brazilian Law Obligations
+
+| Law | Interaction with LGPD |
+|-----|----------------------|
+| Consumer Defence Code (CDC) | LGPD supplements CDC for data; CDC remedies still apply |
+| Marco Civil da Internet (MCI) | MCI governs internet intermediaries; LGPD applies to personal data |
+| LGPD for financial sector | Central Bank regulations + LGPD | 
+| Health Sector | ANVISA/ANS rules + LGPD (stricter for health/sensitive data) |
+| Credit reporting (Cadastro Positivo) | Art. 7, X — specific legal basis for credit protection |

package/src/bmad-plus/packs/pack-shield/references/lgpd/compliance-program.md

@@ -0,0 +1,272 @@
+# LGPD Compliance Programme Reference
+
+## Programme Template & Key Documents
+
+---
+
+## 1. LGPD Compliance Roadmap
+
+### Phase 1 — Foundation (Months 1–3)
+- [ ] Appoint DPO (Encarregado) — publish contact on website
+- [ ] Conduct personal data inventory / data mapping
+- [ ] Identify all processing activities and responsible owners
+- [ ] Create Records of Processing Activities (RoPA)
+- [ ] Conduct initial LGPD gap assessment
+
+### Phase 2 — Remediation (Months 3–6)
+- [ ] Map legal basis to each processing activity (Arts. 7, 11)
+- [ ] Draft/update privacy notices (Art. 9)
+- [ ] Update consent mechanisms — ensure validity (Art. 8)
+- [ ] Implement data subject rights fulfilment procedures
+- [ ] Conduct Data Protection Impact Assessment (RIPD) for high-risk processing
+- [ ] Review and update supplier/processor contracts (Art. 39)
+- [ ] Implement security technical and administrative measures (Art. 46)
+- [ ] Establish international transfer compliance (Arts. 33–36)
+
+### Phase 3 — Operationalisation (Months 6–9)
+- [ ] Train all employees on LGPD obligations
+- [ ] Implement automated data subject request workflow
+- [ ] Establish breach detection and notification procedure (Art. 48)
+- [ ] Implement data retention and disposal schedule
+- [ ] Create internal LGPD governance committee
+- [ ] Conduct privacy by design review of new products/services
+
+### Phase 4 — Ongoing Compliance
+- [ ] Annual LGPD gap reassessment
+- [ ] RIPD for any new high-risk processing
+- [ ] Monitor ANPD guidance and resolution updates
+- [ ] Regular employee training refreshers
+- [ ] Annual DPO report to management
+- [ ] Incident response drills
+
+---
+
+## 2. Records of Processing Activities (RoPA) Template
+
+*Per Art. 37 LGPD and ANPD Resolution No. 2/2022*
+
+| Field | Description |
+|-------|-------------|
+| Processing Activity Name | e.g., "Customer Account Management" |
+| Controller | Legal name, CNPJ |
+| DPO Contact | Name, email, phone |
+| Processor(s) | If applicable — name, CNPJ, role |
+| Purpose | Specific, legitimate purpose |
+| Legal Basis | Art. 7 or Art. 11 basis; if LI, balancing test reference |
+| Categories of Data | e.g., identification, financial, health, biometric |
+| Sensitive Data? | Yes/No; if yes, basis under Art. 11 |
+| Children's Data? | Yes/No; consent mechanism |
+| Data Subjects | Categories: customers, employees, suppliers, etc. |
+| Recipients/Sharing | Internal departments; external third parties |
+| International Transfers | Countries; transfer mechanism |
+| Retention Period | Duration; basis for retention or deletion |
+| Security Measures | Technical and administrative measures summary |
+| RIPD Reference | If DPIA/RIPD was conducted — reference number |
+| Last Updated | Date |
+
+---
+
+## 3. Data Subject Request (DSR) Procedure
+
+### Step 1 — Receive
+- Provide accessible request channel (web form, email, in-person)
+- Log every request: date, requestor identity, type of request
+- Send acknowledgement within 1 business day
+
+### Step 2 — Verify Identity
+- Request minimum necessary identity proof (name + CPF + account reference)
+- Do not require excessive documentation — proportionate to risk
+- For requests on behalf of another: require valid power of attorney
+
+### Step 3 — Classify Request
+| Request Type | LGPD Article | Typical Response |
+|-------------|-------------|-----------------|
+| Confirmation of processing | Art. 18, I | Immediate (simplified) |
+| Access to data | Art. 18, II | 15 days (full report) |
+| Correction | Art. 18, III | Without undue delay |
+| Anonymisation/blocking/deletion | Art. 18, IV | Without undue delay |
+| Portability | Art. 18, V | ANPD format (pending) |
+| Deletion of consent-based data | Art. 18, VI | Without undue delay |
+| Information about sharing | Art. 18, VII | Without undue delay |
+| Consent denial consequences | Art. 18, VIII | Without undue delay |
+| Consent revocation | Art. 18, IX | Without undue delay |
+| Automated decision review | Art. 20 | Upon request |
+
+### Step 4 — Assess Exemptions
+Controller may decline if (Art. 18, §3º):
+- Data subject or third party would be harmed
+- National security
+- Financial intelligence or fiscal activities
+- Criminal/civil investigations
+- Economic or financial protection of public entity
+Must inform data subject of exemption applied and right to complain to ANPD.
+
+### Step 5 — Respond
+- Free of charge
+- Clear, accessible language
+- Immediate for simplified responses; 15 days for full access report
+- Log response and retain record
+
+---
+
+## 4. Data Protection Impact Assessment (RIPD) Template
+
+*Relatório de Impacto à Proteção de Dados Pessoais — Art. 38 LGPD*
+
+### Section 1 — Processing Description
+- Name and purpose of processing activity
+- Legal basis (Art. 7 or Art. 11)
+- Categories of personal data and data subjects
+- Volume and frequency of processing
+- Systems and technologies used
+- Third parties involved (processors, sub-processors)
+- International transfers
+
+### Section 2 — Necessity and Proportionality Assessment
+- Is the processing necessary for the stated purpose?
+- Could the purpose be achieved with less data (necessity principle)?
+- Is the retention period proportionate?
+- Could anonymisation or pseudonymisation reduce risk?
+
+### Section 3 — Risk Identification
+| Risk | Likelihood | Impact | Risk Level |
+|------|-----------|--------|-----------|
+| Unauthorised access | High/Med/Low | High/Med/Low | High/Med/Low |
+| Data loss or deletion | ... | ... | ... |
+| Unlawful disclosure | ... | ... | ... |
+| Discriminatory use | ... | ... | ... |
+| Inaccurate data | ... | ... | ... |
+
+### Section 4 — Mitigation Measures
+For each identified risk:
+- Technical measure to be implemented
+- Administrative/process measure
+- Residual risk after mitigation
+- Responsible party and implementation date
+
+### Section 5 — DPO Opinion
+- DPO name and review date
+- DPO recommendation: Proceed / Proceed with conditions / Do not proceed
+- Conditions/recommendations if applicable
+
+### Section 6 — Management Approval
+- Controller representative signature and date
+- Decision: Proceed / Modify / Cancel processing
+
+---
+
+## 5. Breach Notification Template
+
+### Preliminary ANPD Notification (within 3 working days)
+*ANPD Resolution CD/ANPD No. 15/2024*
+
+**Portal:** https://www.gov.br/anpd/pt-br/assuntos/incidentes-de-seguranca
+
+Fields required:
+- Controller identification (name, CNPJ, DPO contact)
+- Date incident detected; date notification submitted
+- Description of incident (what happened)
+- Approximate categories of data affected
+- Approximate number of data subjects affected
+- Immediate containment measures taken
+- Preliminary risk assessment
+
+### Full ANPD Report (within 20 working days)
+Additional fields:
+- Root cause analysis
+- Full scope of data affected (categories, volume)
+- Full list of systems/regions affected
+- All corrective and preventive measures implemented
+- Communication to data subjects (if required)
+- Updated risk assessment
+
+### Data Subject Notification (when required)
+Notify when: likely to cause significant harm to data subjects (Art. 48, §1º)
+
+Content:
+- Nature of the incident
+- What data was affected
+- Risks to the data subject
+- Measures taken by controller
+- Contact for questions (DPO)
+- How to exercise rights
+
+---
+
+## 6. DPO (Encarregado) Job Description
+
+### Mandatory Functions (Art. 41, §2º)
+1. Accept complaints and communications from data subjects
+2. Receive communications from ANPD and take necessary action
+3. Guide employees and contractors on LGPD obligations
+4. Perform other duties defined by controller or ANPD
+
+### Recommended Additional Functions
+- Maintain and update RoPA
+- Coordinate DPIAs (RIPDs)
+- Monitor ANPD regulatory updates
+- Conduct or oversee LGPD training
+- Review new products/services for privacy compliance
+- Manage data subject rights requests
+- Coordinate breach response
+- Liaise with legal counsel on LGPD matters
+- Produce annual DPO report for management
+
+### DPO Publication Requirement (Art. 41, §1º)
+Controller must publish DPO identity and contact details — typically on:
+- Company website (privacy policy page)
+- Privacy notice / cookie notice
+- Any form collecting personal data
+
+### DPO Exemptions (ANPD Resolution No. 2/2022)
+Micro and small enterprises (ME/EPP) with low-risk processing activities may be exempt from mandatory DPO appointment, but must still designate a contact point for data subjects.
+
+---
+
+## 7. LGPD Gap Assessment Checklist
+
+### Governance
+- [ ] DPO appointed and published (Art. 41)
+- [ ] LGPD policy approved by senior management
+- [ ] Privacy governance committee or equivalent
+- [ ] Annual LGPD review scheduled
+
+### Data Inventory
+- [ ] Personal data inventory complete
+- [ ] RoPA maintained and up to date (Art. 37)
+- [ ] Sensitive data identified and documented
+- [ ] Children's data identified and documented
+
+### Legal Basis
+- [ ] Legal basis documented for every processing activity
+- [ ] Sensitive data uses Art. 11 basis only
+- [ ] Legitimate interest balancing tests completed (Art. 10)
+- [ ] Consent records maintained (Art. 8)
+
+### Data Subject Rights
+- [ ] DSR intake mechanism in place (Art. 18)
+- [ ] Response within 15 days (access) / without undue delay (other rights)
+- [ ] Automated decisions review process (Art. 20)
+- [ ] Consent revocation mechanism (Art. 18, IX)
+
+### Vendors / Processors
+- [ ] Processor agreements include LGPD terms (Art. 39)
+- [ ] Sub-processor oversight documented
+- [ ] International transfers compliance (Arts. 33–36)
+
+### Security
+- [ ] Technical security measures implemented (Art. 46)
+- [ ] Administrative security measures implemented (Art. 46)
+- [ ] Privacy by design embedded in product development (Art. 49)
+- [ ] Breach detection and response procedure (Art. 48)
+- [ ] ANPD 3-day notification process documented
+
+### Transparency
+- [ ] Privacy notices published for all processing activities (Art. 9)
+- [ ] Cookie notice/consent tool (where applicable)
+- [ ] Children's consent mechanism (Art. 14)
+
+### High-Risk Processing
+- [ ] RIPD (DPIA) process established (Art. 38)
+- [ ] RIPDs completed for high-risk processing activities
+- [ ] Large-scale profiling assessed

package/src/bmad-plus/packs/pack-shield/references/lgpd/lgpd-articles.md

@@ -0,0 +1,271 @@
+# LGPD Article-by-Article Reference
+
+## Law No. 13,709/2018 — Lei Geral de Proteção de Dados Pessoais (LGPD)
+*As amended by Law No. 13,853/2019 and subsequent ANPD resolutions*
+
+---
+
+## Chapter I — General Provisions (Arts. 1–10)
+
+### Art. 1 — Purpose
+Establishes rules for processing personal data in Brazil to protect fundamental rights of freedom, privacy, and free development of personality.
+
+### Art. 2 — Foundations
+LGPD is based on: respect for privacy; informational self-determination; freedom of expression, information, communication, and opinion; inviolability of honour and image; economic and technological development and innovation; free enterprise; consumer protection; human rights, free development of personality, dignity, and exercise of citizenship.
+
+### Art. 3 — Scope
+Applies to processing in Brazil; offers/provision to individuals in Brazil; data collected in Brazil. Extraterritorial application to controllers and processors outside Brazil.
+
+### Art. 4 — Exemptions
+Does not apply to: personal/household use; journalistic/artistic/academic (with Art. 7 basis); national security, defence, public safety, criminal investigation by public entities; data from outside Brazil with no communication to Brazilian agents.
+
+### Art. 5 — Definitions
+Key terms:
+- **Personal data:** Information related to identified or identifiable natural person
+- **Sensitive personal data:** Racial/ethnic origin, religious belief, political opinion, union membership, religion, health or sex life data, genetic/biometric data
+- **Anonymised data:** Data not identifiable by reasonable means (not personal data)
+- **Data subject (titular):** Natural person to whom data relates
+- **Controller (controlador):** Natural or legal person who determines purposes/means of processing
+- **Processor (operador):** Natural or legal person who processes on behalf of controller
+- **DPO / Encarregado:** Person designated by controller to be contact point with data subjects and ANPD
+- **Processing:** Any operation on personal data (collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation, modification, communication, transfer, diffusion, extraction)
+- **Consent (consentimento):** Free, informed, unambiguous expression of agreement for specific purpose
+- **Blocking (bloqueio):** Temporary suspension of any processing pending review
+- **Anonymisation:** Technical processes making data unable to identify person
+- **Pseudonymisation:** Processing removing identifiability with use of additional information
+- **International data transfer:** Transfer to foreign country or international organisation
+
+### Art. 6 — Principles (10)
+Purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, accountability.
+
+### Art. 7 — Legal Bases (regular personal data — 10)
+I. Consent; II. Legal obligation; III. Public policy by public entity; IV. Research; V. Contract; VI. Exercise of rights in proceedings; VII. Vital interests; VIII. Health protection; IX. Legitimate interest; X. Credit protection.
+
+### Art. 8 — Consent Requirements
+Must be in written or equivalent digital form; burden of proof on controller; may be revoked free of charge at any time; cannot be generic; bundled consents for unrelated processing invalid; cannot condition service on consent unless necessary.
+
+### Art. 9 — Transparency
+Data subjects have right to easy/free access to information about: purposes, duration, identity of controller, DPO contact, shared data and recipients, data subjects' rights.
+
+### Art. 10 — Legitimate Interest (LI)
+LI can only justify processing if: does not prevail over fundamental rights of data subject; limited to legitimate, specific purposes; data subject has a reasonable expectation. Controller must conduct LI assessment (balancing test). Sensitive data cannot use LI.
+
+---
+
+## Chapter II — Processing of Sensitive Data & Children's Data (Arts. 11–14)
+
+### Art. 11 — Sensitive Data Processing
+Only permitted when:
+- Express and specific consent from data subject
+- Legal obligation
+- Shared by controller to comply with public policy
+- Studies by research bodies (anonymised)
+- Exercise of rights in proceedings
+- Protection of life/physical safety
+- Health care professionals/services
+- Prevention of fraud/safety of data subject
+- Protection of credit (LI prohibited for sensitive data)
+
+### Art. 12 — Anonymised Data
+Anonymised data is not personal data. Risk of re-identification must be considered in context.
+
+### Art. 13 — Research
+Processing for research permitted; anonymisation preferred; security measures must be adopted; results must be published in anonymised form.
+
+### Art. 14 — Children's and Adolescents' Data
+Processing requires: specific and highlighted consent from parent/guardian; data collected only as necessary; no sharing with third parties without consent; best interests of children prioritised. Controllers must verify parental consent in reasonable manner.
+
+---
+
+## Chapter III — Data Subject Rights (Arts. 17–22)
+
+### Art. 17 — Right of Ownership
+Every natural person has ownership of their personal data and guaranteed fundamental rights.
+
+### Art. 18 — Rights List
+Data subjects may request from controller at any time:
+- **I** — Confirmation of processing
+- **II** — Access to data
+- **III** — Correction (inaccurate/incomplete/outdated)
+- **IV** — Anonymisation, blocking, or deletion of unnecessary/excessive/non-compliant data
+- **V** — Portability to another provider (ANPD to define format)
+- **VI** — Deletion of consent-based data (unless Art. 16 retention exception applies)
+- **VII** — Information about public/private entities with whom data was shared
+- **VIII** — Information about possibility of not providing consent and consequences
+- **IX** — Revocation of consent (Art. 8)
+
+Controller must respond: immediately (simplified); within 15 days (full access report); without undue delay (corrections/deletions).
+
+### Art. 19 — Response Format
+Simplified response or through a complete declaration within 15 days from data subject's request. Must be free of charge.
+
+### Art. 20 — Automated Decisions
+Data subject may request review of decisions made solely by automated processing (profiling, credit assessment, etc.). Controller must provide clear and adequate information about criteria and procedures. Human review must be available on request.
+
+### Art. 21 — Protected Data
+Data subject data used to exercise rights cannot be used against the data subject.
+
+### Art. 22 — Defence of Interests
+Rights may be exercised via consumer protection entities, agencies, ANPD, or judicially.
+
+---
+
+## Chapter IV — Processing by Public Entities (Arts. 23–32)
+
+### Art. 23
+Public entities may process personal data for public interest; must inform purpose and necessity; cannot transfer to private entities except for specific Art. 26 reasons.
+
+### Art. 26
+Sharing with private sector only where: indispensable for service delivery; for regulatory purpose; or research (anonymised).
+
+### Art. 27
+International transfers by public entities for international cooperation: follow applicable treaties and ANPD guidance.
+
+---
+
+## Chapter V — International Transfer (Arts. 33–36)
+
+### Art. 33 — Transfer Mechanisms
+Personal data may only transfer internationally to:
+- Countries/org with adequate protection (ANPD adequacy decision)
+- Agreements/standard contractual clauses (Art. 35)
+- Binding corporate rules (BCRs) — Art. 35, I
+- Specific consent for the transfer — Art. 33, VIII
+- ANPD authorisation — Art. 33, IX
+
+### Art. 34 — Adequacy Assessment
+ANPD evaluates: rule of law; protection of human rights; independence of supervisory body; effective remedies; reciprocity; international conventions ratified by Brazil.
+
+### Art. 35 — Contractual Clauses and BCRs
+Specific or standard contractual clauses must provide adequate protection level. BCRs authorised by ANPD. ANPD may publish standard contractual clauses (not yet done as of 2025).
+
+### Art. 36 — Complementary Transfers
+Even where Art. 33 applies, ANPD may impose additional requirements for sensitive data or large-scale transfers.
+
+---
+
+## Chapter VI — Controllers and Processors (Arts. 37–45)
+
+### Art. 37 — Record of Processing Activities (RoPA)
+Controllers and processors must maintain RoPA. ANPD may require disclosure. ANPD Resolution No. 2/2022 made RoPA mandatory for agents that: process data at large scale; are public authorities; or process sensitive data.
+
+### Art. 38 — DPIA / RIPD (Relatório de Impacto à Proteção de Dados)
+ANPD may require DPIA for high-risk processing. Content defined by ANPD. Must be considered by the controller before processing begins.
+
+### Art. 39 — Processor Instructions
+Processors must act per controller instructions. Processors may only act independently if legally required.
+
+### Art. 40 — Standards
+ANPD may establish operational standards for controllers and processors.
+
+### Art. 41 — DPO (Encarregado)
+Controllers must appoint a DPO. DPO must:
+- Receive complaints and communications from data subjects
+- Communicate with data subjects and ANPD
+- Guide internal employees and contractors
+- Perform other tasks as defined by controller or ANPD
+
+Controller must publish DPO identity and contact. ANPD may exempt certain controllers (ANPD Resolution No. 2/2022 exempts small/micro companies with limited scope).
+
+### Art. 42 — Liability
+Controllers or processors causing damage by LGPD violation are liable to repair (individual or collective). Joint/several liability where multiple parties involved.
+
+### Art. 43 — Exemptions
+Exempt if: did not carry out processing; processing not at fault; damage caused exclusively by data subject or third party.
+
+### Art. 44 — Irregular Processing
+Processing irregular if: does not comply with law or security regulations; does not achieve stated purpose; does not meet transparency/security/data quality obligations.
+
+### Art. 45 — Consumer Code
+Processing subject to LGPD does not exclude application of Consumer Protection Code where applicable.
+
+---
+
+## Chapter VII — Security, Good Practices, and Governance (Arts. 46–51)
+
+### Art. 46 — Security Measures
+Technical and administrative security measures proportional to risk must be adopted by controllers and processors. ANPD may define minimum standards.
+
+### Art. 47 — Internal Practices
+Agents must adopt policies, procedures, and governance mechanisms to: demonstrate effective compliance; implement data subject rights; assess effectiveness of measures; mitigate risks.
+
+### Art. 48 — Incident Notification
+Security incidents that may cause relevant risk or harm to data subjects must be notified to ANPD and data subjects:
+- **Preliminary notification:** 3 working days from awareness (ANPD Resolution CD/ANPD No. 15/2024)
+- **Full report:** Within 20 working days
+- Must include: nature of data; number of affected subjects; technical measures taken/planned; risks of incident; reasons for delay (if any)
+
+### Art. 49 — System Design
+Systems must be designed with security measures from conception (privacy by design) and default settings protective of privacy.
+
+### Art. 50 — Good Practices
+Controllers and processors may develop good practice programmes; ANPD may accredit entities to manage complaints and promote standards.
+
+### Art. 51 — National Strategy
+National data protection strategy for government entities.
+
+---
+
+## Chapter VIII — ANPD (Arts. 55-A to 55-L)
+
+### Art. 55-A
+ANPD is a federal government body with technical autonomy, own budget, and decision-making authority. Part of the Presidency.
+
+### Art. 55-J — ANPD Competencies
+- Issue regulations and guidance
+- Conduct inspections and audits
+- Apply administrative sanctions
+- Promote knowledge of LGPD
+- Cooperate with data protection authorities internationally
+- Require DPIAs
+- Define standards for international transfer mechanisms
+
+---
+
+## Chapter IX — Administrative Sanctions (Arts. 52–54)
+
+### Art. 52 — Sanctions
+ANPD may apply (after investigation and opportunity to respond):
+| Sanction | Details |
+|----------|---------|
+| Warning | With deadline to adopt corrective measures |
+| Simple fine | Up to 2% of revenue in Brazil (previous FY); group cap R$50M per violation |
+| Daily fine | To compel compliance; same cap |
+| Publicisation | Public disclosure of violation after completion of investigation |
+| Blocking | Temporary blocking of personal data involved |
+| Deletion | Erasure of personal data related to violation |
+| Suspension | Partial suspension of processing up to 6 months (renewable once) |
+| Prohibition | Total prohibition of personal data processing activities |
+
+### Art. 52, §1º — Aggravating/Mitigating Factors
+Gravity; intent; recurrence; good faith; cooperation; financial advantage; vulnerability of data subjects; internal controls; timely adoption of corrective measures; proportionality.
+
+### Art. 53 — Financial Sanctions Methodology
+ANPD to define criteria for calculating fines, including: nature of violation; controller size; number of data subjects; economic advantage.
+
+### Art. 54 — Statute of Limitations
+Administrative violations time-bar after 5 years. Count from date ANPD becomes aware of violation.
+
+---
+
+## Key ANPD Resolutions (as of 2025)
+
+| Resolution | Subject |
+|-----------|---------|
+| CD/ANPD No. 1/2021 | Internal regulation of ANPD |
+| CD/ANPD No. 2/2022 | RoPA requirements; DPO exemptions for small entities |
+| CD/ANPD No. 4/2023 | Simplified LGPD applicability for micro/small enterprises |
+| CD/ANPD No. 15/2024 | Security incident notification — 3 working day preliminary requirement |
+| Normative Instruction No. 1/2021 | DPO reporting requirements |
+
+---
+
+## LGPD Timeline
+| Date | Event |
+|------|-------|
+| 14 Aug 2018 | Law 13,709/2018 signed |
+| 9 Jul 2019 | Law 13,853/2019 — created ANPD, amended provisions |
+| 18 Sep 2020 | LGPD entered into force (except sanctions) |
+| 1 Aug 2021 | Administrative sanctions entered into force |
+| 2022 | ANPD Resolution No. 2 — RoPA/DPO rules |
+| 2024 | ANPD Resolution No. 15 — 3-day breach notification |