Technical + legal view
Privacy controls validated by people who actually test systems, not just review documents.
Pillar III · Compliance
LGPD Adequacy for Companies
LGPD adequacy is the structured process by which a company aligns its personal-data processing with Brazil's Lei nº 13.709/2018. It means mapping data, assessing risk (RIPD), implementing technical and organizational measures, appointing the Data Protection Officer (DPO/Encarregado) and keeping continuous compliance with the ANPD.
What is LGPD adequacy?
LGPD adequacy is the set of technical, legal and organizational measures that brings personal-data processing into compliance with the Lei Geral de Proteção de Dados (Lei nº 13.709/2018). It means mapping operations, defining legal bases, closing gaps and running a living privacy program under ANPD oversight.
Berghem treats adequacy as an engineering problem, not a paperwork exercise. Every engagement leaves you with a data inventory, legal bases per operation, a risk-ranked action plan and the evidence an auditor, a client or the ANPD expects to find — built alongside your technology, legal and business teams so decisions match how the company actually operates.
What's included
•Data mapping and RoPA inventory
•Data-protection impact report (RIPD)
•Privacy policy and notices
•Phased action plan and training
•DPO as a Service (Encarregado)
•Incident response and ANPD notification
The plan
What are the steps of an LGPD adequacy plan?
A phased plan that turns a legal obligation into an executable roadmap — each step produces evidence you can show to auditors, clients and the ANPD.
01
Mapping & inventory
We survey every processing operation, build the RoPA, classify sensitive data and map flows, systems, processors and international transfers — the factual base for every decision that follows.
02
Risk report (RIPD)
We assess the risks of the most critical operations and produce the data-protection impact report (RIPD), prioritizing what needs technical and organizational safeguards.
03
Policy & documentation
We build the privacy policy, privacy notices, retention rules, consent management and the records the LGPD and the ANPD expect to see.
04
Phased action plan
We turn gaps into a plan ordered by risk and effort, starting with the highest-exposure points, so remediation is realistic and trackable.
05
Training & culture
We train the teams that handle personal data, because most incidents start with people, not systems — culture is what keeps adequacy alive.
Does my company need a DPO/Encarregado?
The LGPD requires a controller to appoint a Data Protection Officer (Encarregado) as the point of contact with data subjects and the ANPD. Berghem provides DPO as a Service — an outsourced Encarregado who runs the ongoing privacy program, handles requests and monitors compliance without you having to build the role in-house.
How does a pentest prove security under Art. 46 of the LGPD?
Art. 46 of the LGPD requires controllers to adopt security measures to protect personal data. A penetration test produces objective evidence that those measures actually work — finding the flaws an attacker would exploit before a breach turns into an ANPD incident.
How do you respond to incidents and notify the ANPD?
The LGPD requires controllers to communicate incidents that may cause relevant risk or harm to the ANPD and to affected data subjects within a reasonable timeframe. Berghem builds the detection, assessment and notification workflow — and responds with you when an incident actually happens.
How much does it cost and how long does LGPD adequacy take?
There is no single price or timeline — both depend on the size and complexity of your data processing. We scope after the initial diagnosis and present a phased proposal, so you invest by priority instead of paying for a monolithic project up front.
What drives the investment
•Number of processing operations and business units
•Systems, integrations and international transfers
•Volume and sensitivity of the personal data
•Current maturity of controls and documentation
•Whether you need an ongoing outsourced DPO
Why Berghem
Why run LGPD adequacy with Berghem?
We combine a security-engineering view with legal precision, so the program holds up technically and in front of a regulator.
Auditable evidence
Every deliverable is ready for an auditor, an enterprise client or the ANPD.
Integrated with offensive security
Adequacy connects to pentest and application security to prove that controls work.
A sustainable program
Outsourced DPO, monitoring and training keep compliance alive after the project ends.
FAQ
LGPD adequacy — frequently asked questions
What are the steps of LGPD adequacy?
The core steps are data mapping and inventory (RoPA), the risk report (RIPD), the privacy policy and documentation, a phased action plan ordered by risk, and training. Appointing a DPO and running incident response keep the program compliant over time.
How long does LGPD adequacy take?
It depends on the number of processing operations, systems and business units and on how mature your controls already are. Mapping and gap analysis can be delivered in weeks; full remediation and a running privacy program are an ongoing effort scoped after the diagnosis.
Does my company need to appoint a DPO/Encarregado?
The LGPD requires a controller to appoint an Encarregado (DPO) as the contact for data subjects and the ANPD. Berghem offers DPO as a Service, an outsourced Encarregado who runs the program and monitors compliance without you building the role in-house.
How much does LGPD adequacy cost?
There is no fixed price: cost depends on the number of operations, systems, the volume and sensitivity of the data, current maturity and whether you need an ongoing DPO. We scope after the diagnosis and present a phased proposal, so you invest by priority.
What are the ANPD fines for LGPD non-compliance?
Art. 52 of the LGPD sets a ladder of sanctions applied by the ANPD — from warnings and fines to publicizing the infraction and suspending data processing. Adequacy reduces this exposure by proving valid legal bases and proportional security controls.
Get started
Map your LGPD adequacy path
In a 30-minute conversation we assess your current state and design the ideal scope — from data mapping to a running privacy program.