Consulting

Data Privacy

Privacy that works day to day and holds up under audit.

We bring your company into compliance with Brazil’s General Data Protection Law (LGPD) and the GDPR, with a practical focus on governance, processes and controls. And we lay the groundwork for a privacy management system certifiable under ISO/IEC 27701.

LGPD
GDPR
ISO/IEC 27701:2025
ISO/IEC 29100

Request a proposal Chat on WhatsApp(opens in a new tab)

The challenge

Privacy that works day to day and holds up under audit.

Data no one has mapped

Without knowing where personal data lives and where it flows, no legal basis holds up.

Compliance that ages

New systems, suppliers and purposes appear every month. Compliance without a routine goes out of date fast.

Data subjects, incidents and enforcement

Data subject requests, incidents and the ANPD all come with deadlines. The response needs a process, an owner and a record.

How we help

Workstreams

Company compliance

Goal

Bring the company into line with Privacy and Data Protection requirements, reducing regulatory and operational risk and strengthening market trust. We structure governance, processes and controls for compliance with the LGPD and the GDPR, and lay the groundwork to evolve into a privacy management system aligned with ISO/IEC 27701.

What we do

LGPD: compliance and operation

Maturity assessment and risk based prioritization.
Mapping of processes and data flows (inventory and records).
Legal bases, privacy notices and consent management, where applicable.
Policies, procedures and baseline training to sustain the program.
Contracts and management of processors and suppliers (clauses and controls).
International transfer of personal data.
Incident support and a response plan focused on personal data.

GDPR: compliance and evidence

Gap analysis and adjustments for principles, rights and accountability.
Structuring of the required records and documentation.
Assessment of international transfers and the associated controls.
Governance and reporting processes to demonstrate compliance.

ISO/IEC 27701: groundwork for certification

Scope definition and integration with ISO 27001, where already in place.
Mapping of controls, responsibilities (controller and processor) and evidence.
Implementation of processes and records (privacy by design, assessments and auditability).
Preparation for the internal audit and readiness for certification.

Certification readiness

Goal

Prepare the company to obtain ISO/IEC 27701 certification, structuring a Privacy Information Management System (PIMS) with controls in place and auditable evidence, reducing rework and making the external audit more predictable. In the 2025 edition, the PIMS can be certified on its own or integrated with the ISO/IEC 27001 ISMS.

What we do

Readiness and planning

Maturity assessment and gap analysis against the ISO/IEC 27701 requirements.
Definition of the PIMS scope, context, interested parties and boundaries.
Work plan with milestones, responsibilities and risk based prioritization.

Integration with ISO/IEC 27001, where applicable

Alignment of the PIMS with the existing ISMS (governance, risk, documentation and evidence).
Mapping of synergies and shared controls to reduce duplication.

Controls, processes and evidence

Structuring of roles, responsibilities and governance meetings.
Privacy policies, standards and procedures with an evidence trail.
Essential records and documentation (processes, legal bases, third parties, incidents and changes).
Operational testing of controls and adjustments to ensure consistency.

Internal audit and final readiness

Evidence and sampling driven internal audit (or pre-audit).
Corrective action plan and effectiveness checks.
Preparation of the "audit pack" and support in the relationship with the external auditor.

Privacy Risk Management

Goal

Establish and run an ongoing Privacy Risk Management process, reducing exposure to sanctions and incidents and strengthening compliance with the LGPD and the GDPR. We structure criteria, governance and treatment plans for risks tied to personal data across its whole lifecycle: collection, use, sharing, storage and disposal.

What we do

Structure and governance

Definition of scope, roles (DPO, business areas, IT and Legal) and review meetings.
Risk criteria: impact on the data subject, likelihood, criticality, appetite and tolerance.
Metrics and executive reporting (KPIs and KRIs) for decision making.

Risk identification and assessment

Mapping of data processing activities and critical points (internal and third party).
Risk assessment by process, system, project and supplier.
Prioritization by criticality and definition of the remediation backlog.

Treatment and monitoring

Treatment plans with owners, deadlines and evidence.
Management of exceptions, acceptances and changes with traceability.
Periodic reviews and verification that actions are effective.

Impact assessments: DPIA and LIA

Conducting and standardizing the DPIA (RIPD) for the highest risk processing.
LIA, where applicable, to support legitimate interest and the mitigating controls.
Templates, criteria and an evidence trail for audits and accountability.

DPO as a Service

Goal

Keep the Data Privacy program running continuously, with governance, operating routines and consistent evidence, acting as DPO as a Service to reduce risk, meet regulatory requirements and support business areas in handling personal data correctly.

What we do

Operation and governance

Routines, meetings and executive reporting (KPIs, KRIs and program status).
Creation and upkeep of the Personal Data Privacy Committee.
Guidance to business areas on legal bases, minimization, retention and data sharing.
Management of data subject requests (DSAR): workflow, deadlines, records and response.
Support with privacy incidents: triage, evidence, communication and lessons learned.
DPIA, LIA and privacy by design in new projects and changes.
Third party management: due diligence, contractual clauses and operational controls.
Upkeep of documentation and evidence (inventories, policies, records and auditability).
Liaison with the ANPD (Brazil’s National Data Protection Agency) and with data subjects.

Audits

Goal

Assess, independently and based on evidence, the company’s adherence to the requirements of ISO/IEC 27701, verifying the effectiveness of controls and the consistency of privacy documentation and routines. The focus is to identify gaps, reduce risk and prepare the company for external audits, with a clear, traceable action plan.

What we do

Audit planning

Definition of scope, criteria, sampling and schedule.
Review of the context, roles, processes and available evidence.

Fieldwork and control testing

Interviews and validation of controls in operation (processes, records and trails).
Documentation check: policies, procedures, inventories, assessments and contracts.
Verification of routine evidence (third parties, changes, incidents and data subject requests).

Report and prioritization

Report with nonconformities, observations and opportunities for improvement.
Prioritization by risk and criticality, with practical recommendations for correction.

Corrective actions and follow up

Action plan with owners and deadlines.
Effectiveness check (retest) and support for final readiness for the external audit.

References

Standards, laws and frameworks that guide the work and the evidence.

LGPD: Law 13,709/2018, Brazil’s General Data Protection Law, and the ANPD resolutions.
GDPR: Regulation (EU) 2016/679, for processing linked to the European Union.
ISO/IEC 27701:2025: Requirements for a Privacy Information Management System (PIMS). Certifiable on its own or together with ISO/IEC 27001.
ISO/IEC 29100: Privacy framework with the underlying principles.

Related training