LGPD Art.38: Art. 38: Data protection impact report (RIPD)

What does Art.38 require?

The ANPD may require the controller to prepare a data protection impact report on its processing operations, including sensitive data, under regulation and respecting commercial and industrial secrets; the report must contain at least a description of the types of data collected, the methodology used for collection and for ensuring information security, and the controller's analysis of the measures, safeguards and risk mitigation mechanisms adopted. The ANPD may also request a report where processing rests on legitimate interest (Art. 10) and from public bodies (Art. 32).