ValidaAuditoria
Note 05 · 24/09/2026
See what is proven and what is assumedEvery well-rehearsed presentation has its perfect minute. The dashboard opens instantly, the report comes out in one click, the backup indicator glows green. Once the room empties, one question is left: does this work when the real user logs in, on a Monday, with their own profile and the data of the development? The Lei Geral de Proteção de Dados (LGPD) (Brazil's General Data Protection Law), Lei 13.709/2018 (Law 13,709/2018), uses the word "demonstration" in a more demanding sense. In art. 6, X, it asks for "demonstration, by the agent, of the adoption of effective measures" and, "including, of the effectiveness of those measures."
As Valida reads it, a platform is verified only when what is claimed about it was exercised in production, with the real profile, and when someone also tried what it should not allow. No rule speaks of "demonstration versus production"; that distinction is Valida's. The rules and official guides, however, ask for the same proof, each in its own vocabulary: a backup truly restored, individual access, an identified operator, data that leaves whole.
In the model apartment, the furniture is custom-made, the lighting was studied and the closet is empty. Nobody lives there, and there is nothing dishonest in that. A system demonstration follows the same recipe: sample data, an administrator who can do everything, a good connection, a rehearsed script. It serves to show the design of the product.
Production is the lived-in building on a rainy Monday: real users, real data, real consequences. There the path is chosen by someone in a hurry, with little training and restricted permissions. Certain failures only show up on that path: the screen that works only for the administrator, the export that cannot handle the real volume, the history that records the action and forgets the author.
Verification does not ask "does it exist?" It asks whether it works, in production, for those who should use it, and whether it stops working for those who should not. The first half is exercised function by function: create the record, close it, reopen it and check that what came back is what went in. The message "saved successfully" proves nothing; the data coming back does.
The second half is tested in reverse. With a read-only profile, try to write; with the user of one development, try to open another's. The information security guide from the Autoridade Nacional de Proteção de Dados (ANPD, Brazil's national data protection authority) for small-scale agents sums up access control in three verbs. Authentication "identifies who is accessing," authorization "determines what the identified user may do" and auditing "records what was done." The principle of least privilege also applies: each user gets the smallest access necessary.
One precaution separates a test from theater: the negative control. You ask what you would see if the function were broken. A test that would pass the same with the function on and off measured nothing, like a smoke detector tested without smoke.
What could not be exercised in production goes in as assumed, with the caveat "not exercised in production" and the list of what was missing, almost always access. It is Valida's vocabulary, not the rules', and is covered in another note: it describes the state of the claim, not the character of whoever made it.
The security principle, in art. 6, VII, speaks of measures "capable of protecting personal data from unauthorized access and from accidental or unlawful situations of destruction, loss, alteration, communication or dissemination." Item X adds the burden of proof: demonstrating that the measures exist and that they are effective. An existing measure is the extinguisher on the wall; an effective measure is the extinguisher that is charged and that someone knows how to use.
Art. 46, §2, requires the measures to be observed "from the design phase of the product or service to its execution," and art. 47 keeps the duty "even after its termination." The law looks at the product in use, not only at the design. But it does not say everything: it does not require testing backups or mention a demonstration environment. How to prove it is found in other rules and guides, some mandatory only for those within their reach.
A backup is a copy of the data kept somewhere else: the spare key, which is worth something only if it opens the door. The restore test is trying the key. You take the copy, rebuild the system in a separate environment and watch whether it comes back whole, and how long it takes. It is rehearsing the emergency exit, instead of checking that the "EXIT" sign is lit.
The Ransomware Prevention and Response Reference Guide from the Secretaria de Governo Digital (the federal Digital Government Secretariat), version 1.3, written for public agencies, puts it bluntly: "A backup that does not restore is just an expense." And on deadlines: "Paper accepts any deadline." Ransomware is the attack that locks the data and demands payment to return it. Against it, the guide calls for a full restore rehearsal every six months and an immutable copy, one that no one can alter or delete, the "last line of defense."
The federal government's backup templates, published in May 2026 under the PPSI 2.0 program, detail the test. The Policy Template states that backup and restore routines "must be tested periodically" (art. 10). The Standard Template requires testing "on equipment distinct from that used in the production environment" (art. 24), confirming, where applicable, the agreed RTO and RPO (art. 25), that is, the maximum time to restore and the maximum amount of data one accepts to lose, and recording "the total time spent on restoration" and the "result obtained" (art. 26). These are templates for federal agencies; they do not bind the private sector.
The ANPD guide adds a counterintuitive detail: copies should not be "synchronized online (in real time)," so that they are not lost along with the original in an attack. A copy that updates live inherits the damage, live. The concern is an old one: NIST SP 800-34, the contingency guide from the United States government's standards institute, from 2010, already recommended testing backup tapes regularly.
An explicit Brazilian rule on the subject comes from real estate registry, where the property record, the register of each property, lives (the subject of another note). Provimento 213 (a regulatory order), of February 20, 2026, from the Corregedoria Nacional de Justiça (the National Internal Affairs Office of the Judiciary), sets minimum technology standards for registry offices. Art. 4, §9, determines: "Backup routines shall be subjected to formal and documented restore tests." The annexes give the calendar by the class of the registry office, defined by semiannual revenue; Class 1 goes up to R$ 100,000.00 per semester. The full extraction simulation is a rehearsal of taking the entire archive out of the system, that is, the electronic books and records of the registry office.
| Registry office class | Documented restore test | Simulation of full extraction of the archive |
|---|---|---|
| Class 1 | At least annually | At least every 36 months |
| Class 2 | At least annually | At least every 30 months |
| Class 3 | At least every six months | At least every 24 months |
| All | Records kept for at least 5 years | Immediately, if there is a relevant change of vendor |
Provimento 74/2018, revoked by 213, asked, in the backup passage read by Valida, for a copy "at intervals no longer than 24 hours," on media and in the cloud; a restore test does not appear in that passage. In the passage read, the 2018 question was "is there a copy?"; the 2026 one is "prove that it comes back."
The limit must be made clear: Provimento 213 binds registry offices, not private platforms. As Valida reads it, it is a reference yardstick, not an obligation.
Two acronyms turn "we have a backup" into a number. RPO, recovery point objective, is how much work one accepts to lose, measured in time: "at most the last four hours of entries." RTO, recovery time objective, is how long the system has to take to come back: "the store reopens in two hours."
An illustrative situation, with invented numbers, unrelated to any real platform or client. A system promises a "daily backup," and the dashboard shows green. The contract allows, at most, 4 hours of loss and 8 hours to come back; these are assumptions of the example, not a requirement of any rule.
| Item | Value | How we get there |
|---|---|---|
| Possible loss with one copy per day | Up to 24 h | Interval between two copies (assumption) |
| Loss accepted in the contract (RPO) | 4 h | Assumption of the example |
| Excess over the RPO | 20 h | 24 − 4 |
| Time measured in the restore test | 11 h | Hypothetical result, real copy in a separate environment |
| Time accepted to come back (RTO) | 8 h | Assumption of the example |
| Excess over the RTO | 3 h (37.5%) | 11 − 8 = 3; 3 ÷ 8 |
| Classification in the opinion | Verified, noncompliant | Test done; without access, it would be "assumed" |
The backup exists and the dashboard is green. Even so, the promise fails at both ends: 20 hours beyond the accepted loss, 3 hours beyond the agreed return. Paper accepted both deadlines.
Now the negative control. Done in the demonstration, with a small database and sample data, the same test would come out green in the compliant scenario and in the noncompliant one. It would pass either way; therefore, it would measure nothing. Only the real copy, with the real volume, tells one scenario from the other.
If five people use the same login, the history records the account, not the person. Nobody did anything; "the admin" did it all. Provimento 213, art. 5, requires "individualized" authentication from registry offices, including from vendors, for "individual accountability." Paragraph 2 adopts, "as a rule," multifactor authentication for critical access and prohibits, "under any circumstances," "shared, generic" credentials. Multifactor authentication, or MFA, is the password plus a second proof, such as a code on the phone: the safe that asks for a key and a secret.
Outside registry offices, the ANPD guide recommends not allowing accounts or passwords to be shared among employees. Decreto 8.771/2016 (Decree 8,771/2016), which regulates the Marco Civil da Internet (Brazil's Internet Civil Framework), lists for providers, in art. 13, "exclusive access privileges for certain users" and "dual authentication systems." In production, every door that opens without a duty to is a finding.
The audit trail, or log, is the record of who did what and when: the condominium doorman's logbook, in digital form. The test is to change a record and look for the matching line. Provimento 213, art. 10, says what it must contain at registry offices: "identification of users, date, hour, minute and second of the operations, nature of the action performed and result obtained," with protection "against alteration, unauthorized deletion and accidental loss." A doorman's logbook that anyone can scribble over proves nothing.
The Marco Civil da Internet, Lei 12.965/2014 (Law 12,965/2014), art. 15, requires an application provider (one that offers functionality accessible over the internet) that operates "in an organized manner, professionally and for economic purposes" to keep access records for six months. The rule belongs to that provider; it does not, by itself, reach every internal company system.
The log also decides when the deadline for an incident starts. Resolução CD/ANPD 15/2024 (Resolution CD/ANPD 15/2024) gives the controller "three business days" to notify the ANPD (art. 6), counted "from the controller's knowledge that the incident affected personal data," and requires keeping the incident record, even for an incident not reported, for "at least five years" (art. 10). They are business days, not the 72 hours that sometimes circulate. Without a trail, a leak from a Tuesday may be discovered months later, with the rule's clock stopped and the damage moving.
The LGPD distinguishes two roles. The controller makes "the decisions regarding the processing of personal data" (art. 5, VI); the operator "carries out the processing of personal data on behalf of the controller" (art. 5, VII, of the consolidated text). It is the restaurant owner, who decides the menu, and the company that manages the stockroom following the owner's instructions. Art. 39 requires the operator to follow those instructions and the controller to verify "compliance with its own instructions." Verify: the verb is in the law.
The ANPD guide on processing agents notes, in a footnote citing the European EDPB, that the concepts are functional, defined by concrete actions, not by the label in the contract. A software vendor is not automatically an operator; whoever processes data on behalf of another is one, whatever they call themselves.
Contracting out does not transfer responsibility entirely. Under art. 42, whoever causes damage in violation of the law "is obliged to repair it," and the operator is "jointly liable" if it breaches the law or the controller's lawful instructions. Art. 52, II, provides for a fine "of up to 2%" of revenue in Brazil, "limited, in total, to R$ 50,000,000.00 per violation." It is a ceiling, not a price list.
The law does not ask, in those words, for a list of operators in the privacy policy. It asks that the data subject, the person the data refers to, know of the "responsibilities of the agents who will carry out the processing" (art. 9, VI) and with which entities the controller has shared data (art. 18, VII). An operator that nobody can name is a transparency failure, not a footer detail.
Many presentations include the line "we export whenever you want." Reversibility is leaving the vendor with the data whole and usable, like moving house without the moving company holding your furniture. Provimento 213 named the opposite: structural dependence on third parties (art. 2, XVIII), when the registry office does not control the hosting, "the custody of cryptographic keys" or "the full, autonomous and documented extraction of the archive in an interoperable format," one that another system can read. A key that only the vendor holds fits that definition; one that only a single person holds is a similar risk, of a different kind.
Under art. 15, the dependence is mitigated only with a clause of "full reversibility," "documentary proof that a full archive extraction test was carried out" and no migration conditioned on the "discretionary consent of the vendor." Paragraph 2 closes the door on wordplay: "the material content of the relationship prevails over the nomenclature adopted by the parties." For those who are not registry offices, it is a yardstick. A promise of export is worth something only after a complete export, checked and done without asking for permission.
The copy never restored, the key that only one person holds, the operator that the privacy policy does not mention. None of them tends to appear in the demonstration. All of them appear on the day they are missing.
| Question | In the demonstration | In production, what is exercised | Basis |
|---|---|---|---|
| Does the backup exist? | Dashboard shows "backup completed" | Restore in a separate environment and measure the time | Provimento 213, art. 4; Backup Standard Template, arts. 24 to 26 |
| Does each person have their own access? | One administrator does everything | Log in with each profile and try what is not theirs | Provimento 213, art. 5; ANPD guide |
| Can we tell who changed something? | The history screen appears | Change a record and find the line with user, date and time | Provimento 213, art. 10; Decree 8,771, art. 13 |
| Can we leave with the data? | "We export whenever you want" | Extract the entire archive, in an open format, without asking permission | Provimento 213, art. 15 |
| Who else processes the data? | Does not appear | Operators identified and disclosed to the data subject | LGPD, arts. 9 and 39 |
| What if something leaks? | Does not appear | Know who reports within three business days and keep a record | Resolution CD/ANPD 15/2024, arts. 6 and 10 |
And a verified platform does not replace a checked property record or a measurement made in the field.
Not necessarily. The dashboard shows that the copy was made, not that it comes back. The official rules and guides examined call for a restore test with measured time and a recorded result: Provimento CNJ 213/2026, art. 4, §9, for registry offices, and the federal government's Backup Standard Template, arts. 24 to 26, for public agencies.
Under the LGPD, controller and operator are liable for damage caused in violation of the law, and the operator is jointly liable when it breaches the law or the controller's lawful instructions (art. 42, §1, I). The judge may reverse the burden of proof in favor of the data subject. Hiring a vendor does not transfer responsibility entirely.
Resolution CD/ANPD 15/2024 sets three business days, counted from knowledge that the incident affected personal data, for an incident that may entail relevant risk or harm to the data subjects (art. 6). They are business days, not calendar hours. The incident record must be kept for at least five years (art. 10).
Because the demonstration runs with sample data and an administrator profile, and the question that matters is what happens in production, with the real profile. What was not exercised there goes into the opinion as assumed. The distinction is Valida's reading; the LGPD asks, in its own terms, for demonstration of the measure's effectiveness (art. 6, X).
It depends on the contract and on a test. The registry office rule considers the dependence mitigated only when there is a full reversibility clause and a tested, documented full extraction (Provimento 213, art. 15). For a private platform, that is good reference practice, not a legal obligation demonstrated in the rules examined.
Before contracting, the useful question is not whether the platform worked in the presentation. It is what it does once the person who presented it has gone home. The demonstration shows the design. The product is verified.
