LGPD privacy policy: Brazil transparency requirements

Who this law applies to

Article 3 applies the LGPD to any processing operation, regardless of the country where the processor is based or where the data is located, when the processing is carried out in Brazil, when it aims to offer or supply goods or services to individuals located in Brazil or to process their data, or when the personal data was collected in Brazil, meaning the data subject was in Brazil at the time of collection. Article 4 excludes processing by individuals for purely private, non-economic purposes, processing exclusively for journalistic, artistic, or certain academic purposes, and processing for public safety, national defence, state security, or criminal investigation, among others. There is no general size threshold, although the national authority, ANPD, has adopted a regulation with simplified obligations for small processing agents, including flexibility on appointing a data protection officer; check whether it applies to you. The LGPD is enforced by ANPD, and consumer-protection bodies may also act where consumer rights are affected.

What your privacy policy must include

Article 9 lists the information to be made available: the specific purpose of the processing; its form and duration, observing commercial and industrial secrets; the identification of the controller; the controller's contact information; information on shared use of data by the controller and its purpose; the responsibilities of the agents that carry out the processing; and the data subject's rights, with express mention of those in Article 18. Article 18 rights include confirmation that processing exists; access; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data; portability, subject to regulation; deletion of data processed with consent; information about the public and private entities with which data has been shared; information about the possibility of refusing consent and its consequences; and revocation of consent. Article 20 gives a right to request review of decisions taken solely on the basis of automated processing that affect the data subject's interests. Article 41 requires the identity and contact information of the encarregado to be disclosed publicly, clearly, and objectively, preferably on the controller's website. A policy should also explain the legal bases relied on, since Article 7 lists several besides consent, and describe international transfers, which Article 33 permits only in listed situations.

How Legal Policy Generator handles it

Selecting Brazil LGPD adds three regional clauses. The first maps the legal bases you choose to the corresponding items of Article 7, repeats your purpose-to-basis mapping, adds the Article 10 limits when legitimate interests are relied on, and states whether sensitive personal data is processed under Article 11. The second publishes the name and email of the encarregado as Article 41 requires or, when you state that the operator is a small processing agent relying on the exemption in Article 11 of the regulation approved by ANPD Resolution CD/ANPD No. 2/2022, states that no encarregado has been appointed and gives the communication channel for data subjects. The third lists the Article 18 rights, the request methods you support, and the option to petition ANPD or consumer-protection bodies. The general collection, uses, sharing, transfers, and retention sections carry the factual detail required by Article 9. Because clauses are versioned, a generated policy keeps the clause versions recorded with it, and regeneration creates a new immutable version instead of rewriting the published one. The list below is read from the clause library each time this page is rendered.

Questionnaire answers that switch it on

The Brazil clauses activate only when the jurisdiction answer includes Brazil LGPD. They require the legal bases actually used, a purpose-to-basis mapping when more than one basis applies, an answer about sensitive personal data, an explicit answer on whether an encarregado has been appointed, the encarregado's name and email when one has, and the privacy request methods you actually support. Placeholder text and reserved example email domains are rejected. Answers about international processing and safeguards feed the transfers section. In the separate Terms generator, selecting Brazil adds a clause preserving mandatory Brazilian consumer rights under the Consumer Defense Code.

Common mistakes

Copying GDPR legal bases verbatim ignores that the LGPD's bases are listed differently in Article 7 and include, for example, credit protection. Omitting the encarregado's identity and contact is a direct gap under Article 41 for controllers that must appoint one. Describing sharing only as with partners does not meet the Article 9 duty to explain shared use and its purpose. Treating consent as the only basis leads to consent requests that cannot be refused without losing the service, which the law disfavours. Stating indefinite retention conflicts with the duty to end processing when its purpose is achieved. Publishing only an English policy to a Brazilian consumer audience can undermine the clarity the law requires. Article 48 also requires the controller to communicate security incidents that may create relevant risk or damage to ANPD and to affected data subjects, so the security section should not imply that incidents are handled silently.

Common questions