LGPD - Brazilian General Data Protection Law
1.Purpose
This Policy establishes essential guidelines for the processing of personal data by ARCA, in compliance with Law No. 13,709/2018 – the Brazilian General Data Protection Law (LGPD), the applicable regulations of the National Data Protection Authority (ANPD), ARCA's Code of Ethics and Conduct and other applicable rules.
ARCA will adopt data protection measures proportionate to the nature, scale, volume and risks of its operations, prioritizing processing activities that may pose greater risk to the rights of data subjects, especially those involving sensitive personal data, Indigenous peoples, traditional communities, children and adolescents, or community information of a confidential nature.
2.Scope and responsibilities
This Policy applies to the personal data processing activities carried out by ARCA and must be observed by officers, employees, collaborators, consultants, representatives, service providers and third parties that process personal data on behalf of ARCA or in connection with its activities.
The Executive Board will oversee the implementation of this Policy, coordinate its application and maintain an accessible channel for questions, data subject requests and incident reporting. ARCA will appoint a Data Protection Officer when required by applicable law or regulation, or when it considers such an appointment appropriate to its structure and to the risks of its activities.
Any person with access to personal data must use it only for legitimate and authorized professional purposes, preserve its confidentiality and promptly report any suspected loss, unauthorized access, unauthorized disclosure or other incident.
3.Key concepts
For the purposes of this Policy, the definitions of the LGPD apply. Personal data is information relating to an identified or identifiable natural person; sensitive personal data includes, among others, data on racial or ethnic origin, religious belief, political opinion, health, sex life, and genetic or biometric data linked to a natural person; the data subject is the natural person to whom the data refers; processing is any operation carried out with personal data; the controller is the party that makes decisions regarding the processing; and the processor is the party that carries out the processing on behalf of the controller.
ARCA may act as controller or processor, depending on the roles it actually performs in each activity.
4.Principles, purpose and legal bases
All processing of personal data must observe the principles of the LGPD, especially purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, responsibility and accountability.
ARCA must process only data that is adequate and necessary for legitimate and identified purposes. Processing must be supported by an applicable legal basis, such as consent, compliance with a legal or regulatory obligation, performance of a contract or preliminary procedures, the regular exercise of rights, protection of life or physical safety, legitimate interest or another basis provided for by law. The processing of sensitive personal data must specifically comply with the legal bases applicable to that category.
When processing depends on consent, such consent must be free, informed, unambiguous, related to a specific purpose, and capable of being demonstrated and revoked under applicable law.
5.Simplified record of processing operations
ARCA will keep a record of relevant personal data processing operations in a format proportionate to the nature, scale, volume and risk of its activities, in accordance with applicable legal and regulatory requirements.
The record may be kept in a spreadsheet or other simple tool and must, as appropriate, identify the process or activity, the categories of data subjects and data, the purpose, the legal basis, the main data sharing arrangements, the storage location or system, and the essential security measures.
The creation of new processes, forms, systems or databases involving relevant processing of personal data must consider, from the design stage, the necessity and proportionality of collecting and using the information.
6.Sensitive personal data and information on Indigenous peoples and traditional communities
Given the nature of ARCA's activities, enhanced protection must be adopted in the processing of sensitive personal data, especially information revealing racial or ethnic origin, health, biometrics or other legally protected categories.
Data and information relating to Indigenous peoples and traditional communities whose disclosure may create individual or collective risks must also receive protection commensurate with their degree of sensitivity and risk, even if they are not necessarily classified as sensitive personal data under the LGPD. This includes, as applicable, non-public territorial information, the location of sensitive areas, traditional knowledge, cultural practices of a restricted nature, information on internal governance not intended for disclosure, and sensitive audiovisual records.
Protection measures must be defined taking into account the nature of the information, whether it is publicly available or restricted, the purpose of the processing, the potential impacts of its disclosure and, where applicable, community protocols and socio-environmental safeguards. The mere fact that a piece of information relates to a particular Indigenous people or traditional community does not, in itself, mean that it is classified as confidential or restricted-access information.
The collection, access and sharing of such information must be limited to what is necessary for legitimate purposes, with protection measures proportionate to the identified risk.
Consent to the processing of personal data under the LGPD is distinct from Free, Prior and Informed Consent (FPIC) relating to collective decisions on projects, territories or community rights.
7.Children and adolescents
The processing of personal data of children and adolescents must observe their best interests and the specific rules of the LGPD and applicable legislation. Collection must be limited to what is necessary and subject to proportionate access, sharing and security safeguards.
When legally required, specific and prominent consent must be obtained from at least one parent or legal guardian, except in the cases provided for by law.
8.Transparency and data subject rights
ARCA will provide clear and accessible information on relevant personal data processing activities and will maintain a channel for the exercise of the rights provided for in the LGPD.
Data subjects may exercise, as applicable, the rights to confirmation of the existence of processing, access, correction, anonymization, blocking or deletion in the cases provided for by law, portability under the applicable regulations, information on data sharing, withdrawal of consent, objection, and other rights provided for by law.
Requests will be recorded and handled within the legally applicable timeframes and conditions. In community settings, ARCA will seek means of communication suited to the linguistic, cultural and technological conditions of the data subjects.
9.Security, confidentiality and access control
ARCA will adopt essential technical and administrative measures, proportionate to the risks of the processing, to protect personal data against unauthorized access and against accidental or unlawful destruction, loss, alteration, communication, disclosure or improper processing.
Access to personal data must be based on functional need. Access to sensitive personal data and higher-risk community information must be restricted to those who actually need such information to perform their duties.
Access credentials are personal and non-transferable. Whenever a suitable corporate solution is available, relevant personal data must not be kept unnecessarily in personal accounts, personal devices, messaging apps or unauthorized repositories.
ARCA will adopt reasonable practices for storage, backup, system updates, device protection and secure disposal, in accordance with its structure and the risk of the information processed.
10.Photographs, videos, audio recordings and field records
Photographs, videos, audio recordings and other records that make it possible to identify individuals must be treated as personal data and used only for legitimate purposes, on an appropriate legal basis and in a manner consistent with the information provided to data subjects.
Records made during consultations, meetings, field activities or interactions with communities must observe, in addition to the LGPD, the applicable community protocols and socio-environmental safeguards. Participants may be informed about the making and purposes of such records collectively and in a manner appropriate to the context of the activity, without prejudice to additional measures when required by the nature of the processing or by applicable law.
The existence of a legal basis for making a given record does not, in itself, authorize its public disclosure, commercial use or use for a different purpose, all of which must be subject to a specific assessment of the purpose, the applicable legal basis and the rights of data subjects.
11.Data sharing and third parties
The sharing of personal data with consultants, suppliers, certification bodies, auditors, buyers, financial institutions, insurers, partners or other organizations must be limited to what is necessary for a legitimate purpose and supported by an appropriate legal basis.
Contracts with third parties that carry out relevant processing of personal data on behalf of ARCA must include, where relevant and proportionate to the risk, obligations regarding confidentiality, security, purpose limitation, incident reporting and the handling of data at the end of the relationship.
ARCA may carry out privacy and data protection assessments of suppliers that carry out relevant processing on its behalf, especially where there is systematic access to ARCA's databases, a high volume of data, sensitive personal data or higher-risk community information.
12.International transfers
When personal data is transferred abroad, including through cloud services, platforms, certification bodies, auditors, consultants or international partners, ARCA will comply with the requirements of the LGPD and the applicable ANPD regulations.
The assessment will be proportionate to the relevance and risk of the transfer, and ARCA must adopt, where necessary, the applicable legal mechanism and safeguards.
13.Retention and disposal
ARCA will retain personal data for the period necessary to fulfill the purposes of the processing, legal or regulatory obligations, legitimate contractual commitments, certification or audit requirements, or the regular exercise of rights.
ARCA will adopt reasonable retention and disposal criteria for the relevant categories of data and documents, prioritizing those involving sensitive data or higher-risk information. Once retention is no longer necessary, the data must be deleted, anonymized or retained only in the cases authorized by law.
14.Security incidents
Anyone who identifies or suspects the loss, improper access, misdirected sending, leakage, exposure, unauthorized alteration or other compromise of personal data must immediately report it through the internal channel defined by ARCA, without waiting for definitive confirmation of the incident.
ARCA will assess the incident, take reasonable containment and mitigation measures, preserve the information necessary for the investigation and notify the ANPD and data subjects when required by applicable law and regulations.
Relevant incidents and the measures taken must be recorded in a manner consistent with legal obligations and with the need for accountability.
15.Data Protection Impact Report
ARCA will prepare a Data Protection Impact Report (RIPD) when required by applicable law or regulation, when so determined by the ANPD, or when, following an internal assessment, the nature and risks of the processing warrant its preparation.
16.Training and awareness
ARCA will provide guidance and training on data protection in proportion to the roles and risks involved. Training may be integrated with other compliance initiatives and must cover, where relevant, specific precautions related to field activities, community data, audiovisual records and incident reporting.
ARCA will keep reasonable evidence of the training and awareness activities carried out.
17.Monitoring and review
The Executive Board will carry out periodic and proportionate assessments of the implementation of this Policy, prioritizing relevant risks, incidents, data subject requests, access to sensitive information and critical third parties.
This Policy will be reviewed periodically or whenever legal, regulatory, technological, operational or risk-related changes warrant an update. The review does not require a formal audit, unless ARCA considers it necessary or it is required by applicable rules.
18.Progressive, risk-based implementation
The operational measures set out in this Policy will be implemented and maintained progressively, proportionately and on a risk basis, taking into account the nature, volume and sensitivity of the data processed, the risks to data subjects, ARCA's structure and the applicable legal and regulatory requirements.
Progressive implementation does not exempt ARCA from complying with directly applicable legal obligations, nor does it authorize the continuation of practices incompatible with the LGPD. Prioritization must focus on higher-risk processing, especially sensitive personal data and information relating to Indigenous peoples and traditional communities.
19.Final provisions
This Policy supplements ARCA's Code of Ethics and Conduct and must be interpreted together with the other applicable internal policies, contracts and procedures.
In the event of a conflict between this Policy and a mandatory legal or regulatory provision, the higher-ranking rule shall prevail.
ARCA reaffirms its commitment to the protection of personal data as a component of its governance, integrity, respect for human rights and responsible relationships with employees, Indigenous peoples, traditional communities, partners and other stakeholders.