LGPD in Practice: How to Map Personal Data and Build a DPIA

Brazil's General Data Protection Law (LGPD) requires organizations to map and protect the personal data they process. One of the central instruments for demonstrating that is the Data Protection Impact Report (RIPD), required by the ANPD in high-risk processing situations.

What personal data mapping actually means

Mapping personal data means identifying what data the organization collects, from whom, for what purpose, where it's stored, for how long, and who it's shared with. This inventory — often called a record of processing activities — is the foundation of any serious privacy program; without it, everything else is built on assumption.

Building the mapping step by step

Start with a survey of processes involving personal data across the whole organization — not just IT, but HR, marketing, sales, and finance. Categorize data by type and sensitivity (identification, financial, health, behavioral). Define the legal basis for each processing activity per LGPD Art. 7. Finally, map the data flow to third parties — sub-processors, vendors, partners — because your organization's responsibility doesn't end where the data leaves your network.

Building a DPIA that holds up under regulatory scrutiny

The DPIA should describe the processing activity, justify its necessity and proportionality relative to its stated purpose, identify concrete risks to data subjects, and detail safeguards that are actually implemented — not just planned. The ANPD has published guidance that serves as a structural reference, but the actual content needs to reflect what the organization really does, not an adapted generic template.

Where this connects to the rest of your security program

Data mapping and DPIAs don't live isolated from NIST CSF, ISO 27001, or your TPRM program — the same vendors that process personal data on your company's behalf need to be assessed through an LGPD lens, not just a technical security one. That's why in Aranis the LGPD control crosswalk is built directly into the same vendor and framework assessment engine, instead of becoming yet another isolated compliance spreadsheet.

Accountability under LGPD isn't having a nice-looking policy — it's being able to show, with evidence, that you know exactly where your organization's personal data lives.