LGPD for your business

How security assessment helps with the duty to protect personal data.

What LGPD requires

The law requires technical and administrative measures capable of protecting personal data from unauthorized access and accidental situations of destruction, loss, or alteration (Art. 46).

Where the assessment comes in

A website without HTTPS, without HSTS, with exposed .git or .env files, and with a database open to the internet are vulnerabilities that lead to personal data leaks — exactly what the law mandates to avoid.

How to use the report

Use the findings as evidence of due diligence: fix what is critical, document the correction (a new assessment with a higher score), and keep the report. This demonstrates an active posture in the event of an incident.

When more is needed

If there is sensitive data, a large volume of data subjects, or integration with third-party systems, the path is a complete compliance audit, with data mapping, legal bases, and an incident response plan.