Operational privacy under Law 21.719: from consent to devices
Most organizations believe they comply with data protection. They have policies, consent forms and documented controls. But the moment a file with personal data is downloaded and ends up on a laptop, that data falls outside the reach of any policy or control. Law 21.719 does not let that gap slide: it requires you to show what happens to the data at all times, not only when it is collected.
In practice, data lives across systems and flows, but above all on devices.
The compliance blind spot: when data leaves the system
One of the biggest risks today is not how data is collected, but how it spreads. In modern work environments, personal data is constantly replicated outside central systems (Excel downloads, local copies, shared files), creating Shadow Data: pockets of personal information beyond IT's visibility and control.
The problem is not only technical; it is legal. It breaks a fundamental principle of consent: that data is used exclusively for the authorized purposes. Once information is replicated outside controlled environments, that consent stops being verifiable in practice.
A simple example makes it clear: an analyst downloads a customer database from the CRM to work offline, and the file stays on their personal laptop. IT cannot see it and Legal does not know about it, but as far as the law is concerned that data is still the organization's responsibility.
Compliance, then, cannot rest on policies alone. Privacy has to be an active technical capability built into the systems.
We call this operational privacy: the ability to control, enforce and demonstrate compliance in practice, not just on paper.
Digital identity: where traceability starts
Law 21.719 makes it clear: you cannot protect what you cannot attribute. But there is a key distinction here. Personal data is one thing; the identity of whoever accesses or processes it is another. Compliance requires not only protecting the data, but being able to show who interacts with it.
That means controls such as strong authentication (MFA, digital certificates), access logs and, above all, correlating user, device and action. This is not just access control: it is operational traceability.
And this is where many organizations fall short. In an audit it is not enough to say controls exist; you have to show who accessed the data, from which device, when and under what conditions. Without that visibility, identity is incomplete, and so is compliance.
Consent management: from a "Checkbox" to a living system
It used to be enough to have a simple confirmation box on a web form to collect personal data. The new legislation demands a radical shift: that record is no longer enough, because consent stops being a one-off event and becomes a living system that has to be maintained over time.
Law 21.719 requires consent to be freely given, specific, informed and unambiguous, but the deepest change is not in those characteristics. It is in how long they have to hold. Consent now has to be demonstrable across the entire lifecycle of the data, which forces organizations to keep not just the user's “yes” but its full context: when it happened, under what conditions, which version of the text was accepted and which identity was involved.
The problem shows up when that consent changes. In theory, revocation is simple: the user withdraws their authorization and the system stops processing their data. In practice, that change rarely propagates all the way. Exports, local files and integrations keep circulating unchecked. That is where compliance stops being demonstrable, because the law requires not only capturing consent correctly, but showing that its status is respected across the whole operation.
Managing consent today means treating it as a signal that travels with the data throughout its lifecycle: applications, integrations, services and devices
The critical jump: when data leaves the system and reaches the device
Data does not live only in central systems. It gets downloaded, copied and synced, and ends up stored on laptops, smartphones and tablets that operate outside IT's direct control. Those machines are the most vulnerable point in the infrastructure: if they are not managed and protected, compliance stops being enforceable in practice.
The rules require technical and organizational measures applied by design, before any data processing starts. That means every machine has to run under controlled conditions: secure configurations, access restrictions, active encryption and policies that limit data use to what is strictly necessary. Not as an exception, but as default behavior.
This principle comes under strain fast in real environments.
Remote work and BYOD models (Bring Your Own Device: using personal devices for work) expand the perimeter dramatically. Data stops living on controlled networks and starts circulating on machines the organization does not fully control. A lost device, an insecure network or an unchecked file download is not an exception: it is an everyday scenario where consent and policies stop applying in practice.
That is why organizations add controls that run directly on the device: tracking, encryption, wiping and remote incident response. Solutions like Prey let you extend control all the way to where the data actually lives. Because if you cannot see what happens on devices, you cannot show that compliance is being enforced.
IT's new role in compliance
IT no longer just runs infrastructure: today it is what makes compliance enforceable in practice. It is the point where policies turn into real controls over data, access and devices. When a machine goes missing, a file is downloaded without oversight or there is unauthorized access, Legal is not the first to respond. IT is.
The challenge is that this responsibility grows in an unfavorable context: small teams, distributed fleets and constant pressure to prove compliance without adding friction to the operation. So IT's role evolves from reactive to preventive: anticipating incidents, setting controls by default and producing continuous evidence. Automating tasks, centralizing device management and keeping auditable logs stops being a nice to have and becomes the foundation of sustainable compliance.
Operational privacy as the new compliance standard
Law 21.719 does not just redefine privacy: it redefines how compliance is built. The model based on policies and declarative controls is no longer enough. What is required today is operational privacy: the real ability to connect identity, consent and devices in a system that lets you control, enforce and demonstrate what happens to the data at all times.
The question is no longer whether you have data protection policies. It is whether you can show, at any moment, what is actually happening to your data.
