The LGPD, or General Data Protection Law, was born from the GDPR, legislation in force in Europe since 2016. The purpose of this legislation is to protect and guarantee privacy for the personal data of individuals.
In Brazil, the LGPD came into effect on September 18, 2020, and is demanding that various areas within companies modify their processes, especially those that deal directly with sensitive documents and data.
Including HR, which needs to handle many personal documents of its employees and third parties. Professionals in this sector need to pay attention to certain attitudes, as the new legislation will also impact trends and priorities for the coming years.
The body that oversees the LGPD is the National Data Protection Authority, which is currently still being formed. Due to this, penalties are suspended until August 2021. However, enforcement guarantees fines and administrative sanctions for companies that fail to comply with the requirements after this deadline.
To comply with the legislation, it is important to start adapting right away. So check out in this post 7 fundamental attitudes to adapt your HR to the LGPD!
7 practical tips to comply with the LGPD
1. Understand everyone’s responsibilities
The General Data Protection Law names data processing agents, which are nothing more than those involved in the data processing process. They will be held responsible if the company is not complying with the legislation.
In the HR sector, we can define the processing agents as follows:
- Controller: the company;
- Processor: the employee who will handle the data.
It is worth remembering that, in cases of punishment by the regulatory body, the processor is responsible for processing the data according to the process defined by the controller. Therefore, the controller bears the greatest responsibility for following the requirements of the LGPD, and the processor has the duty to follow the steps as informed by the controller.
2. Define information clearly in contracts
The legislation guarantees data subjects the right to transparency, consent, and free access to their data. Therefore, even in contractual documents, it will be necessary to meet certain information requirements:
- Purpose: it must be made clear for what purpose the collected data will be used. For example: archiving, data analysis, delivery of equipment, in case of urgent medical care, or situations necessary to safeguard the employee’s health.
- Adequacy: once the purpose is defined, it is paramount that data processing complies with what was informed.
- Necessity: this involves collecting only the data that is truly necessary. Weigh what is genuinely required for the best performance of your work.
- Consent: one of the most addressed topics in the LGPD; without the consent of the data subject, it is forbidden to collect and process their personal data.
3. Practice the clean desk policy
With the LGPD in effect, it is advised to clean up and organize desks. If the HR professional – as a processing operator – leaves any paper containing someone’s personal data on the desk and leaves the room, even if briefly, they must put the paper away!
This is because, if during the time the operator is absent, another person accesses the information on the desk, they could even take photos or use them in bad faith. This is defined as a data leak, punishable by the LGPD.
And this even applies to received resumes, or if the operator has post-its with personal information of someone in a visible location. Extreme attention to these details is required.
Therefore, to prevent a third party from accessing documents and misusing them, it is recommended that the professional organize everything inside folders, and whenever leaving the room, store them inside a locked cabinet or use a system compliant with the LGPD.
4. Limit access to the company network
If the company works with folders on the intranet, it can no longer make documents accessible to all employees. Ways must be found to limit access only to data processing agents.
Considering both the risks of losing paper documents and the security failures that can occur in internal company networks, digital cloud tools are great allies.
Solutions of this type do not require physical space for managing corporate documents, and reduce the risk of document loss. In addition, it is possible to define limited and encrypted access to documents.
5. Share tips and training
It is impossible to change processes overnight, so this change needs to be encouraged and reinforced. To do this, share tips and strategies with your team.
A good tool for sharing information universally with employees, avoiding communication bottlenecks, are visual management dashboards, known as digital bulletin boards. These consist of deploying Corporate TVs in strategic locations with high employee circulation, such as the reception or dining area.
Be careful not to share any personal information. The purpose of this solution, when talking about the LGPD, is to disseminate tips for process optimization and reinforcement of the legislation.
6. Organize old data
Perform periodic internal audits and identify which data must be kept by law and which can be discarded. Do this by filtering out unnecessary personal information of former employees.
Remember that information proving taxes, salaries, contracts, and terminations must be kept for a certain period. This ensures you will not have future problems.
7. Pay attention to shared data
If it is necessary to share employees’ personal data with a third-party company, such as when hiring life insurance and benefits, for example, two things must be taken into account:
- This information must be present in the contract when defining the purpose of data collection.
- Map which companies this data was shared with, in addition to identifying what data, when, and why the sharing was done.
Now you know some attitudes that are fundamental to adapting the HR sector to the LGPD. If you have questions about any of these steps, seek support from a legal professional.
To continue receiving our content on communication, subscribe to our newsletter!
