CRIPTOGRAFIA E LEI GERAL DE PROTEÇÃO DE DADOS PESSOAIS: A IMPORTÂNCIA DA PROTEÇÃO DE DADOS NA COMPUTAÇÃO EM NUVEM NO BRASIL

Abstract

The popularization of cloud computing in Brazil presents significant challenges for personal data protection, especially after the General Data Protection Law (LGPD) came into effect. Encryption has emerged as the primary technical measure for reducing the risk of data leaks and unauthorized access in cloud environments. This study's overall objective was to understand how encryption can ensure data protection and maintain legal compliance in cloud environments. The methodology used was qualitative, exploratory, and descriptive research, based on a literature and document review, analyzing scientific articles, legislation (LGPD), ANPD guidelines, and international technical standards, such as those from NIST. Research has found that the effectiveness of encryption for LGPD compliance involves more than simply applying algorithms. Effective protection requires an approach based on the data lifecycle, protecting it in transit, securely, in use (through confidential computing), and upon deletion (via crypto-shredding). It is concluded that the legal compliance of the Controller (client) depends directly on its ability to maintain data control through key management (KMS), using models such as BYOK (Bring Your Own Key) to maintain control, even in infrastructure operated by third parties.