Data Sharing Between Public Entities

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Sharing data between public entities requires strict compliance with the LGPD (Brazil’s General Data Protection Law) and calls for structured due diligence processes to avoid violations and liability.

The Current Landscape of Data Sharing in the Public Sector

We live in an era in which public administration depends more and more on the flow of information among its many agencies and bodies. A look at how public policy works in Brazil shows that health, social assistance, social security, and tax enforcement programs all rely on cross-access to databases maintained by different levels of government. This exchange of information is necessary for administrative efficiency, but it carries substantial risks when it is not conducted within clear legal parameters.

The General Personal Data Protection Law (Law No. 13.709/2018) created a regulatory framework that directly affects how the federal government, the states, and the municipalities share data with one another. Before the LGPD, sharing between public entities often happened informally, through generic agreements or simple administrative requests. Now that the law is fully in force, that practice has had to be completely overhauled. It now requires specific legal bases, defined purposes, and adequate protection mechanisms.

The concept of data due diligence, already well established in the private sector, has gained importance in the public context. It is a systematic process of verification and assessment that seeks to ensure that the sharing of personal data between public entities meets all the legal, technical, and operational requirements of current legislation. When we conduct data due diligence in the public sector, we assess not only legal compliance but also information security, data quality, and the institutional capacity of the parties involved.

This topic is directly related to data protection auditing, a subject covered in a dedicated article.

This topic is directly related to open data and data protection, a subject covered in a dedicated article.

Legal Bases and Requirements for Sharing Between Public Entities

When we examine the regulatory framework governing data sharing between public entities, we find that the LGPD sets out specific rules in Articles 23 through 30. Article 26 is particularly relevant. It provides that the shared use of personal data by the government must serve specific purposes of carrying out public policies and fulfilling the legal mandate of the public agencies and bodies involved. The law is clear in prohibiting sharing with private entities, except in expressly provided cases.

Data due diligence in the public sector is not a mere bureaucratic formality. It is an essential mechanism for ensuring that the sharing of information between public entities respects citizens’ fundamental rights.

In practice, lawful sharing between public entities requires several requirements to be met at the same time. First, there must be a clearly defined public purpose tied to the legal powers of the requesting agency. Second, the processing must be limited to the minimum necessary to achieve that purpose, in keeping with the principle of data minimization. Third, the agency sharing the data must keep a record of its processing operations, as required by Article 37 of the LGPD.

Beyond the LGPD, other regulations also affect this kind of sharing. Decree No. 10.046/2019, which governs data-sharing governance within the federal public administration, established the Citizen Base Registry (Cadastro Base do Cidadão) and the Central Data Governance Committee. The decree created categories of sharing (broad, restricted, and specific) according to the sensitivity of the data involved. When you carry out due diligence, you need to classify the data correctly into each of these categories to determine the appropriate procedure.

The Role of the Data Protection Officer (DPO) in Public Entities

Each public agency that takes part in data-sharing operations must designate a data protection officer (encarregado), as provided in Article 23, item III, of the LGPD. This professional plays a central role in due diligence. The officer is responsible for assessing the compliance of sharing operations, advising public employees on proper practices, and serving as the channel of communication with the ANPD (Brazil’s National Data Protection Authority). Many public entities have still not set up this function properly, which poses a significant risk in data-sharing operations.

Agreements and Technical Cooperation Arrangements

The legal instrument that formalizes sharing between public entities deserves special attention in due diligence. Cooperation agreements (convênios), technical cooperation agreements, and terms of use are the most common vehicles for this purpose. These instruments must contain specific clauses on the purpose of the sharing, the types of data involved, the security measures adopted, retention periods, each party’s responsibilities, and the procedures to follow in the event of a security incident. The absence of any one of these elements can undermine the legal validity of the sharing.

A Due Diligence Methodology for Sharing Public Data

When we structure a due diligence process for data sharing between public entities, we follow methodological steps that ensure a complete assessment of risks and compliance. The first step is mapping the data flows: identifying which personal information will be shared, where it comes from, where it goes, which systems are involved, and who is responsible at each end of the operation. This mapping is essential because it lets you see the full data lifecycle and pinpoint vulnerabilities.

The second step is analyzing the applicable legal basis. You check whether the intended sharing falls under one of the grounds provided in the LGPD, especially Article 7 (for ordinary personal data) and Article 11 (for sensitive personal data). For public entities, the legal bases most often applicable are carrying out public policies (Article 7, item III), complying with a legal or regulatory obligation (Article 7, item II), and protecting health (Article 7, item VIII). Each legal basis carries specific requirements that must be fully met.

The third step is the personal data protection impact assessment, known by the acronym RIPD (Relatório de Impacto à Proteção de Dados, or Data Protection Impact Report). Although the ANPD has not yet definitively regulated whether the RIPD is mandatory for every sharing operation between public entities, preparing one is considered good practice whenever sensitive data is processed, processing occurs on a large scale, or the sharing involves data of vulnerable populations, such as beneficiaries of social programs or people insured by the INSS (Brazil’s National Social Security Institute).

Information Security Assessment

A critical component of due diligence is assessing the information security measures adopted by the entities involved in the sharing. You check whether there are formal security policies, appropriate access controls, encryption in transit and at rest, audit logs, incident response procedures, and continuity plans. In practice, one recurring challenge is the disparity in information security maturity among different public agencies. An entity with robust controls can have its data compromised by sharing it with another that lacks the same level of protection.

Governance and Ongoing Monitoring

Due diligence does not end once the sharing is formalized. You put continuous monitoring mechanisms in place to verify that the conditions originally assessed remain valid over time. This includes periodic audits, review of the access granted, updates to the legal instruments when necessary, and tracking of any legislative or regulatory changes that could affect the sharing. The ANPD has been issuing guidance and guides that should be incorporated into this ongoing monitoring.

Risks and Liability for Improper Sharing

When you analyze the risks of sharing data between public entities without proper due diligence, you find consequences on multiple levels. At the administrative level, the LGPD provides for sanctions ranging from warnings to public disclosure of the violation, including blocking and deletion of the personal data involved. Although imposing monetary fines on the direct public administration has its particularities, the ANPD has already shown a willingness to hold public entities accountable for irregularities in data processing.

In court, irregular data sharing can give rise to civil liability of the State, with an obligation to compensate the affected data subjects. Article 42 of the LGPD provides that a controller or processor who causes property, moral, individual, or collective damage while carrying out data processing activities is obligated to repair it. Class actions brought by the Public Prosecutor’s Office (Ministério Público) and by civil society organizations have become increasingly frequent in this area.

There is also reputational risk. Although less tangible, it can significantly undermine citizens’ trust in digital public services. When a security incident caused by improper sharing becomes public, the damage to institutional credibility can be lasting. There are cases in which leaks of data on beneficiaries of social programs exposed sensitive information, such as health conditions and socioeconomic status, causing embarrassment and discrimination.

For the public employee involved, irregular data sharing can amount to a disciplinary offense and, in more serious cases, a crime. The Access to Information Law (Law No. 12.527/2011) already provided for sanctions for improper access to or disclosure of confidential information, and the LGPD reinforced this framework of individual liability.

Best Practices and Compliance Recommendations

Based on experience analyzing data-sharing operations between public entities, a set of best practices has emerged that contribute significantly to compliance. The first recommendation is to create a centralized inventory of all data-sharing arrangements in which the agency participates, whether as a provider or a recipient. The inventory should be kept up to date and should include the legal basis used, the data involved, the time periods, and the people responsible.

We also recommend standardizing the legal instruments used to formalize sharing. Template agreements and technical cooperation agreements that already reflect the LGPD’s requirements make legal review easier and reduce the risk of significant omissions. These templates should be reviewed periodically to incorporate new ANPD guidance and any legislative changes.

Training the employees who operate the systems and have access to the shared data is another fundamental pillar. Many security incidents result from human error, such as sending data through insecure channels, granting excessive access, or lacking procedures for secure disposal. Regular training programs, combined with an organizational culture of data protection, are investments that pay off significantly in reduced risk.

Finally, it is worth stressing the importance of establishing efficient communication channels among the data protection officers of the different entities involved in the sharing. This communication makes it easier to manage incidents, update procedures, and resolve operational questions. As public services become increasingly digital, cooperation among the professionals responsible for data protection matters more and more in ensuring that the sharing of information between public entities serves its purpose without compromising citizens’ rights.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.