Terms of Use and Privacy Policy: What Your Website Cannot Do Without

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Every company that collects personal data online must document how it handles that information, and relying on generic templates copied from other websites is one of the main sources of legal exposure under Brazil’s General Data Protection Law.

Any business with a digital presence, from an online store to a simple contact form, collects personal data. Names, e-mail addresses, phone numbers, IP addresses and browsing history are all protected by Law 13.709/2018, known as the LGPD (Brazil’s General Data Protection Law). The law requires that data subjects be told, in a transparent way, how their data is processed, and that every instance of processing rest on a defined legal basis.

Meeting this requirement means producing specific documents. The privacy policy, the terms of use and the cookie notice are no longer decorative formalities; they are now central pieces of compliance. When poorly drafted, they become evidence against the company itself in an inspection or a lawsuit.

Why generic templates are a real risk

Small and midsize companies often turn to ready-made texts found through search engines or copied from competitors. The practice looks economical, but it usually ends up costing more. A document that describes data processing different from what the company actually does creates a dangerous contradiction between what it promises and what it does.

This mismatch has concrete consequences. If the policy states that data is not shared with third parties, but the company uses marketing tools that pass information to other platforms, the company has made a false statement to the data subject. The ANPD (Brazil’s National Data Protection Authority) may treat this conduct as a violation of the duty of transparency set out in the law.

Copied templates also ignore the particulars of the business. An e-commerce site handles payment and delivery address data; a clinic collects sensitive health data; an educational platform may deal with information about minors. Each scenario calls for its own clauses, distinct legal bases and security measures proportionate to the risk.

Essential clauses of a privacy policy

The privacy policy is the document that tells data subjects how their data is processed. To comply with Article 9 of the LGPD, it must answer, in accessible language, a minimum set of questions about the life cycle of the information.

The first step is to identify the controller, meaning the individual or legal entity that makes the decisions about processing. The document must state the company’s name and provide a working contact channel, usually that of the data protection officer, also known as the DPO.

Next, it is essential to describe which data is collected and for what purpose. The purpose must be specific and legitimate. It is not enough to say that the data is used to “improve the user experience”; the company should say, for example, that the e-mail address will be used to send purchase confirmations and communications about the order.

The legal basis for each instance of processing is another mandatory element. The LGPD lists ten situations that authorize the use of data, including consent, compliance with a legal obligation and legitimate interest. Confusing consent with legitimate interest is a frequent mistake that weakens the entire structure of the document.

The policy must also explain how long data is retained, when it is shared and what rights the data subject has. These rights include access, correction, deletion and portability of the information, all of which can be exercised through the contact channel provided.

The ANPD (Brazil’s National Data Protection Authority) may treat this conduct as a violation of the duty of transparency set out in the law.

The terms of use and the cookie notice

While the privacy policy deals with data protection, the terms of use govern the contractual relationship between the company and the people who visit its website or app. They set out rules of use, responsibilities, limits on use of the content and registration conditions. On sales platforms, they also cover payment, exchanges, returns and deadlines.

The two documents complement each other, but they are not the same thing. Merging them into a single, confusing text hurts clarity and makes it harder to prove that the data subject was informed about the processing of their data in a prominent way, which the law values.

The cookie notice deserves attention of its own. Cookies and similar technologies collect browsing data and, in many cases, require the user’s prior consent. The banner that appears on the first visit should let users accept, reject and configure categories of cookies, without rejection preventing basic browsing.

Blocking content until the user accepts all cookies is a questionable practice, because consent must be freely given. A company that forces acceptance risks having the consent deemed invalid, which undermines the legal basis for the related processing.

Plain language and the duty of transparency

The LGPD requires that information about processing be provided in a clear, adequate and prominent manner. This rule rules out the ornate, cross-reference-heavy text that, in practice, nobody reads. Transparency is not measured by the number of pages, but by how well the data subject actually understands.

Writing clearly means favoring short sentences, avoiding unnecessary technical jargon and organizing the content into sections with straightforward headings. When a legal term is unavoidable, it is best to explain it the first time it appears. A glossary or a summary version at the top of the document helps lay readers.

This concern is not merely cosmetic. In an inspection, the clarity of the document is part of the assessment of whether the duty to inform has been met. Deliberately obscure text may be read as an attempt to hide practices, increasing the company’s liability.

Practical steps to structure your documentation

The starting point is not drafting but mapping. Before writing any clause, the company should identify all the data it collects, where on the website this happens, with which tools and for what purposes. This inventory, called data mapping, is the foundation for everything else.

With the mapping in hand, the company defines the legal basis for each instance of processing and identifies the data it shares with third parties, such as hosting providers, payment gateways and analytics tools. Only then does the document reflect reality rather than a convenient fiction.

The third step is periodic review. Whenever the company adopts a new tool, changes a process or begins offering a new service, the documentation must be reassessed. A policy frozen in time stops matching the facts and exposes the business once again to the same risk as generic templates.

Frequently Asked Questions

My company is small and has few customers. Do I still need a privacy policy?

Yes. The LGPD does not exempt small businesses from the obligation to explain how they handle personal data. A company’s size affects the proportionality of its security measures and may allow some procedures to be relaxed, as guided by the authority, but the duty of transparency remains. Any website that collects a name and e-mail address through a form is already processing data and must document that activity in a way that fits its reality.

Can I use the parent company’s document for the Brazilian website of a foreign company?

Not directly. Documents drafted under foreign laws, such as the European regulation, start from similar concepts but not identical ones to those in Brazilian law. The legal bases, the rights of data subjects and the structure of the oversight authority each have their own particularities. The ideal approach is to adapt the content to the LGPD, translating not only the language but also the legal concepts into the Brazilian legal system, or else risk creating compliance gaps.

How often should I review my website’s privacy policy?

The law sets no fixed deadline, but the review should keep pace with real changes in the business. A review is recommended whenever the company adopts a new data collection tool, changes the purposes for which data is used or begins sharing data with new partners. Even without apparent changes, an annual check is a prudent practice, because it keeps the document aligned with the authority’s most recent guidance and with the evolution of market practices.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.