Yes, the Brazilian General Data Protection Law (Law 13,709/2018 — "LGPD") will apply to cloud services to the extent that the cloud services provider performs the following:

(i) Processes personal data (or personal data collected) in Brazil

(ii) Processes personal data for the provision of goods or services, or when the processing activities have as their purpose the processing of data of individuals located in Brazil

For the purposes of the LGPD, personal data is deemed as "any information related to an individual identified or identifiable." Processing is deemed as "any operation carried out with personal data, as those that refer to collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, storing, archiving, elimination, evaluation, control, modification, communication, transfer or extraction."

The LGPD is the first comprehensive data protection law in Brazil and was "inspired" by the European data protection law ("GDPR"). The principles and general obligations are similar to the GDPR, but not identical. Some of the key obligations imposed on companies that process personal data under the LGPD are as follows:

To map all processing activities and maintain a record of processing activities

• To process personal data only according to the legal basis for processing as set forth under the law
• To comply with data subjects' rights
• To notify the authority and data subjects in certain cases of security incidents
• To appoint a data protection officer
• To adopt technical, organizational and security measures
• To take additional steps in the case of international data transfers
• To provide transparency to personal data subjects about the data processing activities, by making available a privacy notice with clear, accurate and easily accessible information
• To comply with the principles set forth in the LGPD

The list above is not exhaustive and may need to be adjusted depending on the case. These obligations may also vary depending on whether the company acts as a data processor or controller.

Additionally, Brazilian National Monetary Council ("CMN") Resolution No. 4,893, effective as of 26 February 2021 ("Resolution 4,893"), and Brazilian Central Bank ("BCB") Resolution No. 85, effective as of 8 April 2021 ("Resolution 85"), provide that financial and payment institutions located in Brazil, when hiring cloud service providers, must implement a policy for cybersecurity and follow the requirements for contracting data processing and storage and cloud computing services.

Please refer to Q&A No. 2 for provisions regarding offshore data processing by cloud services set forth in Resolution 4,893 and Resolution 85.