PT Prefer a light background? Click here.Prefer dark mode? Click here. Talk to Zulti →

LGPD Compliance · EXIN-certified DPO

Personal data handled the way the LGPD requires.

Led by a professional certified as EXIN Data Protection Officer. ROPA kept in PSA (Professional Services Automation). Zulti brings you into compliance; the official DPO remains the client's. The LGPD is Brazil's General Data Protection Law, similar to the GDPR.

Book 15 min → See the areas ↓

PSA · LGPD · Processing activities (ROPA)

Record of processing activities (ROPA) in PSA: processes by area, owner, status and role

model

fixed-scope project

deliverables

ROPA + DPIA + training

method

4phases

EXIN Data Protection Officer international certification · ISO 27001 implied

Compliance done by someone who understands the DPO role from the inside. The person leading the work holds the international EXIN Data Protection Officer certification, a real qualification to build the program in depth.

Why comply

LGPD can't be solved on the day someone asks.

The ANPD (Brazil's data protection authority), a data subject or a B2B client: with any of the three, improvising is expensive. Technical and process compliance before the trigger is what separates a ready company from one playing catch-up.

Commercial trigger

B2B client

A B2B client demanding a DPA and evidence of compliance to renew the contract.

trigger renewal · DPA

risk losing the contract

Data subject trigger

Data subject

A formal request for access, correction or deletion of data, with a 15-day deadline.

trigger formal request

legal deadline 15 days

Regulatory trigger

ANPD

A notice or audit from the regulator. The company has to present evidence of compliance within a set deadline.

trigger notice · audit

risk fine/warning · consent decree

In any of the three, the cost of improvising is high: ANPD fines (up to 2% of revenue, capped at R$ 50M per violation), a lost contract or compensation to the data subject.

The 4 areas of compliance

LGPD-compliant, end to end.

Each area delivers part of compliance with the LGPD, from team training to operational compliance. Together, they bring the company into compliance with the protection of personal data. In practice, not just on paper.

Area 01

Training and Awareness

Training for leadership, process owners, HR, sales and IT before before touching data: everyone understands the LGPD and their own role in the program.

Training for leadership and process owners

General employee awareness

Internal reference material

Area 02

Process Mapping

A survey of current processing activities (HR, marketing, sales, finance) and a complete ROPA (Record of Processing Activities) in PSA, with the data flow for each activity.

Map of current processing activities

ROPA with every processing activity

Data flow per processing activity

Area 03

Action Plan

Gap analysis against the LGPD, prioritized, with a legal basis (Art. 7) for each activity and a DPIA for high-risk activities: what changes and in what order.

Prioritized LGPD gap analysis

Legal basis defined per activity

DPIA for high-risk activities

Area 04

Compliance

Implementation: a public Privacy Policy, DPA (Data Processing Agreement) with third parties, and a process for handling data subject requests. Operational compliance, not just on paper.

Public privacy policy

DPAs with critical vendors

Data subject request process

Reference for a ~6-month project. The windows vary with company size, number of processes, criticality and staff availability. In Mapping in particular, the pace depends on information from process owners.

— Who runs the program afterwards

Zulti delivers a compliant program and a trained team. After final delivery, the client runs the LGPD program: handling data subject requests, notifying the ANPD of incidents, reviewing new processing activities, updating the ROPA and appointing the in-house DPO. The service is technical and process compliance, not taking on the DPO role.

Zulti brings you into compliance · the client operates · the DPO remains the client's

How it's put together

One format: a fixed project.

Scope, timeline and price agreed before kickoff. No monthly fee, no automatic renewal. It ends with final delivery, leaving the company able to run on its own.

single format

Fixed compliance project

scope + timeline + price agreed before kickoff

what's included

Gap analysis against the LGPD (Art. 6 to Art. 12)
ROPA complete in PSA, every processing activity mapped
DPIAs for high-risk activities (AI, sensitive data, scale)
Documented legal basis per activity (LGPD Art. 7)
Updated public privacy policy
DPA (Data Processing Agreement) with critical vendors
Training and awareness for leadership, process owners and all staff
Documented final delivery · no monthly fee, no automatic renewal

LGPD in day-to-day work, not in a workshop. A living ROPA, up-to-date evidence.

Book a call →

Frequently asked questions

When it's time to face the LGPD, every CEO asks the same things.

What the ANPD expects, what gets solved in months, and what becomes ongoing operations.

Is there a monthly fee after the project? How does renewal work?+

No monthly fee, no automatic renewal. The fixed LGPD Compliance project ends with the deliverable: a complete ROPA in PSA, DPIAs done, legal bases defined, the policy published, DPAs with vendors and training delivered. You leave with the program running and the contract closed. If you later need a one-off review (a new processing activity, a new ANPD regulation, a DPIA for a new system), it's best hired as a one-off project through Outsourcing, with its own scope and price, not an artificial renewal of the compliance contract.

What's the difference between LGPD Compliance and Zulti's Security & Compliance?+

Different trigger and scope. LGPD Compliance starts from personal data: ROPA, legal basis, policy, DPIA, data subject requests, training. The typical trigger is the ANPD, a data subject, an LGPD clause in a contract or an incident. Security & Compliance starts from broad governance: ISO 27001 + LGPD, controls, evidence, audit readiness. The trigger is a Tier-1 client, due diligence or an auditor with a deadline. Whoever needs both gets both, with scopes designed so you never pay for the same evidence twice.

The ROPA is hosted in PSA. If I end the contract, do I lose everything? Can I export it?+

You export everything. PSA is Zulti's own platform (operations + governance), run by us during the compliance project. The content (ROPA, DPIAs, documented legal bases, policies, DPAs, training material) is yours: by contract, when the project ends you get a full export in an open format (PDFs of the documents + a structured ZIP with JSON metadata for the ROPA), ready to load into any other GRC tool, a spreadsheet or a corporate drive. After final delivery, the client decides whether to keep working from the exported material or hire another platform. No lock-in.

What's the difference between Zulti's compliance work and hiring an outsourced DPO?+

Different services. Zulti's compliance work is a fixed project that makes the company compliant (ROPA, legal basis, policy, DPA, training) and ends at final delivery. An outsourced DPO is an ongoing service: an outside firm takes on the DPO role before the ANPD, handles data subjects and responds to the authority. They can complement each other: Zulti brings you into compliance and you appoint the DPO (in-house, hired or shared). Zulti is not an outsourced DPO; that market has its own providers (law firms, privacy BPOs).

What if there's a personal data incident after the project? Does Zulti help?+

After final delivery, the client runs the program, so the incident follows the process documented in the project: triage, impact assessment, notifying the ANPD within 72h (Art. 48), notifying data subjects when applicable, and recording it. If you want one-off support from Zulti for a specific incident (technical root-cause diagnosis, recovery), you can hire it as a project through Outsourcing, with its own scope. It isn't automatically covered by the compliance contract.

Who it's NOT for

Real compliance isn't a website checklist.

Commercial honesty has kept us going for almost a decade. In some scenarios, another model is a better fit. We list them openly to save you evaluation time.

You're in a regulated industry where a sector regulator is the main authority: BACEN (financial institutions), SUSEP (insurers), ANS (health plans), ANATEL (telecoms). The ANPD coordinates, but the sector regulator enforces day to day with its own rules. The program needs to be led by dedicated sector compliance.

You want an opinion just to rubber-stamp a decision already made, a commissioned "LGPD validation" to cover an internal choice. Zulti gives an honest reading: if the recommendation goes against what you've already decided, it stands anyway. If what you're after is a rubber stamp, it creates friction.

Your company doesn't yet have a defined internal sponsor for the LGPD program: who answers for privacy on the board, who approves legal bases, who signs off on communications to data subjects or the ANPD. Zulti builds programs that need an owner to run; if nobody inside is available to sponsor it, the program stands but doesn't move.