To comply with the General Data Protection Law (LGPD), one of the recommended practices is to adapt the contracts signed by the company, as the contracting process is the opportune moment for the parties to establish their duties and responsibilities regarding the protection of personal data.
Therefore, for a contract to be efficient in this sense, it is important that companies pay attention to five main points:
verify the subject of the contract, in order to know whether the activity will involve the processing of personal data; classify the parties as to the processing agents (controller, operator, sub-operator or co-controllers);
avoid the vague reproduction of legal provisions not related to the specificities of each contractual instrument;
not include technical and administrative clauses for the security of specific personal data that are difficult to change, considering that technology evolves rapidly and that predictions in this regard become
obsolete; and
apply data protection clauses when there is in fact any data processing activity, also allowing the parties, by mutual agreement, to regulate the matter during the execution of the contract.
