Brazil's data protection authority, the Autoridade Nacional de Proteção de Dados, published a template for small- and medium-sized businesses to track records of personal data processing activities. The "simplified model" requires information on eight fields that are "considered essential," including categories of data subjects, details on how the data is shared, security measures and data retention.