Start with the company's reality
Registrations, contracts, support, sales, human resources and suppliers may process personal data. The first step is understanding how information enters, moves through and remains in operations.
Blugreen helps organize context and protection records so subsequent decisions have an identifiable basis.
Four questions to guide the work
Which data enters and why
Describe information categories, processes, purposes and sharing arrangements that need understanding.
Who accesses and who manages
Link systems, roles, suppliers and owners. Identify where permissions or controls still need confirmation.
How information is protected
Gather technical and administrative measures: access, storage, recovery, maintenance and incident response.
Which evidence supports the measure
Link the control to available records, observations and review outcomes.
Information and evidence making existing controls and priority gaps visible.
Security must be visible in operations
LGPD Article 46 addresses technical and administrative measures to protect personal data. ANPD guidance also links security to access management, environment protection and organizational practices.
In assessment, this becomes verifiable questions: which controls exist, where they apply and what evidence demonstrates their operation in the included environment.
Explore the assessment dimensionsHow the company participates
Organize the context
Gather priority systems and processes, identify owners and record existing knowledge.
Complete collection
Respond to requests and gather documents or evidence. Drafts allow work to resume without a simultaneous meeting.
Review and track
Check responses, prioritize actions and record review outcomes and necessary new checks.
A common situation and a possible path
A company receives résumés by email, web form and messaging app. Files end up in different places, with unclear owners and retention periods.
Work can map entry points, access and destinations, gather existing rules and prioritize measures requiring definition or verification.
Value comes from connecting the process to concrete decisions: who owns it, what needs changing, its priority and how results will be checked.
Choose where to start
If the company lacks an environment overview, start with the assessment. For specific needs, such as application testing or process evidence, agree on scope with the team.
Discuss an LGPD assessment