In its first year, the recently established Brazilian data-protection authority plans to create “simplified” data-privacy rules for small and micro businesses, which represent a vast majority of Brazilian companies and are less prepared than larger firms to comply with a new data-protection law. With no permanent office, budget approval and sufficient personnel,