Formatting vs. Data Sanitization: Why 'Resetting' Your PC Doesn't Protect Your Company from the LGPD

Introduction to Data Protection under LGPD

The General Data Protection Law (LGPD - Law No. 13.709/2018) imposes strict requirements on organizations to ensure information security. Among the practices used, the proper handling of personal data storage is crucial to comply with legal obligations.

Difference Between Formatting and Data Sanitization

Formatting involves redoing the file system of a disk, usually removing only the index information, but data can still be recovered using specialized techniques. Data sanitization, on the other hand, is a more rigorous process that eliminates or makes the recovery of sensitive information irreversible.

Limitations of Formatting for LGPD Compliance

Simply 'resetting' the device through standard formatting is not sufficient to protect personal data as required by LGPD. Data can be recovered with forensic tools, posing risks of leakage and exposure.

Appropriate Sanitization Techniques

Sanitization includes methods such as multiple overwrites, secure encryption, degaussing, and physical destruction, ensuring that data cannot be reconstructed. According to the guidelines from NIST SP 800-88, these practices are recommended for devices containing personal information.

Legal and Regulatory Implications

Non-compliance with LGPD, especially in data protection and elimination, may result in administrative penalties and reputational damage. The National Data Protection Authority (ANPD) advises taking effective actions to ensure data security during disposal or reuse of devices.

Secure Disposal of Electronic Devices

The disposal of media and hard drives requires methods that guarantee data protection, with sanitization recommended to avoid risks. Specialized services for hard drive sanitization are indicated to meet LGPD regulations.

Final Considerations

Relying solely on device formatting does not meet the legal criteria for personal data protection under LGPD. It is essential to implement sanitization processes to ensure compliance, mitigating the risk of information leakage.