Data Privacy

The law applies because personal data is being processed, not because of the size of the company. A business with few employees that runs a customer base, a payroll and a contact form is already processing data and owes the duties on policy, consent and handling data subject requests. What does change with size and other criteria is whether the company must file with the National Database Registry, which we check case by case.

An inventory of the databases and information flows, the processing policy, the privacy notice, consent wording adapted to each collection point, processing agreements with the vendors that need them, the protocol for handling queries and complaints, and the incident protocol. Everything is delivered in editable form, so the company can maintain it as the operation changes.

It gives you a document, not compliance. The policy has to describe the real purposes of the processing and the channels the company actually operates. A copied policy usually announces purposes that do not exist and leaves out the ones that do, and that gap is the first thing that shows when a data subject complains or the authority asks for an explanation. The policy on its own is also not enough: it has to be pushed down into the forms, contracts and scripts where data is collected.

In a transmission a third party processes the data on the controller's behalf and under its instructions, as happens with a cloud provider or outsourced payroll. In a transfer the recipient receives the data to process on its own account. The distinction determines what obligations each party assumes, what the contract must say and what additional requirements apply when the recipient is abroad.

Not always. The right to deletion has limits: some information must be kept because of a legal or contractual duty, for example accounting records or documents from a terminated employment relationship. What is mandatory is to respond within the statutory deadlines, explain the decision and keep a record. That is why the protocol defines in advance what is deleted, what is retained and on what basis, so the service team does not improvise.

Contain and document, in that order, before communicating anything externally. We need to know what data was affected, how many people it concerns, how it got out and whether access is still open. That determines whether a report to the Superintendence of Industry and Commerce and a communication to data subjects are due, and those texts are then drafted. Improvised drafts written in the first hours are often the worst part of the case, so it is worth calling us before sending them.

It is urgent. A deadline starts running from service of the notice, and whatever is filed shapes the entire discussion that follows, including any later formal charges. The first thing we do is confirm the date of service and the applicable deadline, review what documentation actually exists and settle the company's position before responding. A rushed answer can concede facts that cannot be walked back later.

It depends on the purposes disclosed to the data subject and on the type of data involved. If consent was obtained for something else, using that base to train a model may go beyond the authorised purpose. We review what was authorised, what alternatives exist (anonymisation, fresh consent, narrowing the dataset) and what has to be documented before starting. We run that analysis together with our AI audit and implementation practice.