LGPD Art.50: Art. 50: Rules of good practice and privacy governance programme

Controllers and processors may, individually or through associations, formulate rules of good practice and governance covering organisation, operating regime, procedures (including complaints and petitions from data subjects), security rules, technical standards, specific obligations of those involved, education, internal supervision and risk mitigation, taking account of the nature, scope, purpose, likelihood and severity of risks and benefits; such rules must be published and periodically updated and may be recognised by the ANPD. In applying the security and prevention principles the controller may implement a privacy governance programme that at least demonstrates its commitment to internal processes and policies ensuring broad compliance, applies to all personal data under its control however collected, is adapted to its structure, scale, volume and data sensitivity, sets policies and safeguards based on systematic assessment of privacy impacts and risks, aims at a relationship of trust with data subjects through transparency and participation, is integrated into its general governance with internal and external supervision, includes incident response and remediation plans, and is constantly updated through continuous monitoring and periodic assessment; and demonstrate its effectiveness when appropriate, especially at the ANPD's request. A demonstrated programme is a 20 percent mitigating factor in fines under Resolution CD/ANPD 4/2023.