Law 21.719 ·106days left
Disrupsoft
Law No. 21.719 · Full effect December 1, 2026

We prepare your team. Then we review the systems where the data actually lives.

Certified training, designated owners, and baseline documentation, with the SENCE subsidy. Then, the part almost nobody does: verifying in your applications and databases that what's declared on paper actually holds up.

Take the technical diagnosticSee the full roadmap
— weeks left to get ready
Until December 1, 2026
How we do it

One roadmap, four stages

Preparing your people and fixing your systems are different jobs, with different timelines and funding. We run them end to end, in the order that actually holds up.

Stage 01

Organizational readiness

Ten guided hours plus certified e-learning. Leaves designated owners, defined procedures, and the supporting documentation kit.

25 days · SENCE subsidy
Stage 02

Technical assessment

We compare what the organization declared against what the databases actually contain. Risk-prioritized gap report.

3 weeks · fixed price
Stage 03

System fixes

The development work that closes the gaps found: access, audit trails, export and deletion, test environments.

Scoped in stages
Stage 04

Continuity

Whatever gets built from here on is born compliant, and data subject requests get answered without improvising.

Ongoing support

Stages 2 through 4 are software engineering work, and that's where we're different: we're a development company, not a consultancy that outsources the technical part. We run stage 1 together with an OTEC, which is what unlocks the tax subsidy.

Why stage 2 exists

Documentation describes intent. Systems show the facts.

Stage 1 leaves the organization orderly and formally backed. It's necessary and it's not enough: the processing activities record gets filled with what each department declares, not with what the databases actually store. Almost the entire market stops right there.

Stage 01 · what stays in place

What organizational readiness leaves behind

  • Data processing policy and procedure
  • Declared processing activities matrix
  • Data subject rights procedure
  • Incident procedure and access criteria
  • Trained team with designated owners
Stage 02 · only the systems can answer

What no document answers

  • What personal data does each system store, and in which table?
  • Is there a record of who accessed it?
  • Can the system export or delete a person's data?
  • Are there production copies in development and QA environments?
  • Which external vendors receive data, and from where?

A processing activities record verified against the systems is what separates being prepared from just looking prepared.

Technical diagnostic · 12 questions · free

How much of your compliance actually lives in your systems

Twelve questions about the state of your applications and databases. Instant results by area, no contact details required.

Question 1 of 12Inventory
Inventory
—
Your answers aren't sent anywhere.
Stage 01

Organizational readiness

Ten hours of guided intervention plus a certified e-learning course running in parallel. Every session produces a document: if a session doesn't leave a deliverable, it's not in the program.

  • 2 h · in personExecutive kick-offWhat changes, what a data subject can request, and who answers for each area. Closes with the designation of the implementation team.
  • 4 h · in personData governanceWorking session: processing activities by area, purpose, legal basis, retention periods, and vendors that receive data.
  • 2 h · onlineSecurity and informationAccess and confidentiality criteria. What counts as an incident, how it's detected, and the escalation timeline.
  • 2 h · onlineOperations and complianceHow a data subject's request is received and answered, what evidence gets kept, and how a corporate client's questionnaire gets answered.
  • AsyncCertified e-learningFor the entire headcount, with assessment, completion tracking, and an individual certificate.

Evidence kit

  • Training
    Trained staff and individual certificates.
  • Governance
    Policy, procedure, and activities matrix.
  • Rights
    Data subject request procedure.
  • Security
    Incident procedure and access criteria.
  • Continuity
    Implementation plan and final report.
  • Principals
    Backup for answering your clients' requirements.
SENCE subsidy: the training program can qualify for the tax subsidy. The technical assessment and system fixes are engineering services and are quoted as a project.
Stages 02 through 04

The work on your systems

We're a software development company. We do this part with our own team, on the technology your company already has.

Stage 02

Technical assessment

Three weeks to compare what's declared against what the databases actually contain.

  • Inventory of systems and personal data
  • Review of access, encryption, and audit trails
  • Third parties that receive data, and where they're hosted
  • Risk-prioritized report with estimated effort
Stage 03

System fixes

The development work that closes the gaps found, in scoped stages.

  • Encryption of sensitive fields
  • Audit logging and role-based access control
  • Export and deletion of a data subject's data
  • Anonymization of development and QA environments
  • Automated retention and deletion
Stage 04

Continuity

So that whatever gets built from here on is born compliant, without redoing it later.

  • Architecture and data model review
  • Minimization and retention criteria
  • Requirements review before development
  • Working with your internal team or your vendor

Independent of the technology

The review criteria is the same in every case; what changes is the implementation. We also work on systems whose original vendor is no longer available.

.NETPHPJavaNode.jsPythonAngular / ReactFlutterSQL ServerOraclePostgreSQLMySQLERPAS/400 · DB2Legacy systems
Frequently asked questions

What people ask us before getting started

Can we hire just the training, or just the technical part?
Yes, the stages are independent. That said, the training alone leaves a declared but unverified activities matrix, and the technical assessment without prior readiness runs into an organization that doesn't know what to do with the findings. They work better in sequence.
Can the training be paid for with the SENCE subsidy?
The organizational readiness program can qualify for the SENCE tax subsidy. The technical assessment and system fixes are software engineering services and are quoted as a project, not as training. Worth being clear about this upfront to budget correctly.
Our lawyer is already handling this. Where do you fit in?
These are different layers, and all three are needed. The lawyer defines what needs to be met and validates the documents. We prepare the organization to operate it, and we review and modify the systems where the data lives. We don't provide legal advice or replace that review.
Does the law apply to small businesses?
Law 21.719 doesn't include a size-based exemption. The obligations apply to whoever processes personal data, regardless of headcount. What does change with size is the effort: fewer systems means a shorter assessment.
Our software vendor says they've got it covered.
It's worth asking them for something concrete: the system's personal data inventory, with tables and fields. If they have it, that's an excellent sign and saves a good chunk of the work. In practice it almost never exists, and that answer already tells you where things stand.
Do you only work with Microsoft technologies?
No. The technical review applies to any stack, including old systems whose original vendor is no longer available. We're a Microsoft Partner, and we also work on .NET, PHP, Java, Node, Python, mobile apps, and ERP from different vendors.
Does this leave us compliant with the law?
No, and be wary of anyone who promises that. The program installs a demonstrable operational baseline, and the assessment delivers the diagnosis and the correction plan. Compliance results from executing that plan and from the legal validation that runs on a separate track. There's also no compliance certification issued by the Agency.
Can we be ready before December 1?
It depends on how many systems there are and how well documented they are. What's achievable in any scenario is getting your team ready and having a plan with prioritized gaps — which is the position from which you respond to a request without improvising. December 1 doesn't close the topic either: that's when enforcement begins.
Let's talk

A 30-minute meeting

We review where your company stands, what systems are behind it, and what sequence makes sense between preparing your team and the technical work. If nothing needs to happen yet, we'll tell you.

This site provides general information about Law No. 21.719, a training program, and software engineering services. It does not constitute legal advice and does not replace a lawyer's review. The diagnostic is a guidance tool based on the respondent's answers and does not represent a compliance assessment. The training program runs together with a registered technical training body (OTEC).