A Privacy Policy That Protects You: What It Must Include to Avoid Penalties

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

A privacy policy satisfies Brazil’s General Data Protection Law (LGPD) only when it explains, in clear language, what data the company collects, why it uses that data, who receives it, how long the company keeps it, and how individuals can exercise their rights. Generic documents, copied from foreign templates or written in impenetrable legalese, expose a business to penalties from the data protection authority and to damages claims. This guide walks through the essential elements that turn a privacy policy into a working compliance tool rather than a decorative formality in the footer of a website.

What the law actually requires of a privacy policy

Brazilian data protection law imposes duties of transparency and disclosure on the party that processes personal data (the “processing agent”). The privacy policy is the document that fulfills this obligation toward the data subject, meaning the individual the data relates to. It must be easy to access, written unambiguously, and available before any data is collected.

It is not enough to state that the company “respects privacy.” The text must say who the controller is, the purpose of each processing activity, the legal basis relied on, any data sharing, the retention period, and the channels for submitting requests. Leaving out any of these points weakens the business’s defense in an inspection or an individual complaint.

Clarity is a legal requirement, not a matter of style. A policy no one can understand amounts, in practice, to no disclosure at all, and it may be treated as a breach of the duty of transparency. Writing for ordinary people, not for lawyers, is the first step toward compliance.

Purposes and legal bases: the core of the document

Every processing of personal data must have a specific, explicit purpose that is disclosed to the data subject. The policy needs to list those purposes without ambiguity: customer registration, invoicing, sending communications, fraud prevention, compliance with legal obligations. Vague purposes, such as “improving your experience,” do not meet the legal standard.

Each purpose must be matched to a legal basis that authorizes the processing. Consent is only one of them, and often it is not the best fit. Performance of a contract, compliance with a legal obligation, the regular exercise of rights, and legitimate interest are equally valid grounds, each with its own requirements and different consequences for the data subject.

Naming the correct legal basis helps you avoid a common error: asking for consent for processing that already rests on another ground. When consent is unnecessary, requesting it creates the false impression that the data subject can refuse, which breeds legal uncertainty and needless liability for the company.

Good practice is to organize this information in readable blocks, linking each category of data to its purpose and legal basis. Besides complying with the law, this structure makes it easier to account to the oversight authority, which may require proof that each operation is lawful.

Brazilian data protection law imposes duties of transparency and disclosure on the party that processes personal data.

Data sharing, retention periods, and information security

The policy must reveal who receives the data. That includes contracted processors, such as cloud services, payment gateways, and messaging tools, as well as any transfers to business partners or public authorities. Failing to disclose significant sharing is a serious transparency failure.

When data is transferred internationally, the document must say so and describe the safeguards in place. Data subjects have the right to know that their information may be processed outside Brazil, under rules that do not always match Brazilian protections.

The retention period is another element that is often overlooked. Data may not be kept indefinitely: it should be stored only as long as needed to fulfill the purpose or a legal obligation. The policy states how long each category of data will be kept and what happens afterward, whether deletion or anonymization.

Contact channels for data subjects and how to draft the policy in practice

The law gives data subjects a set of rights: confirmation that processing exists, access, correction, anonymization, portability, deletion, and information about data sharing. The policy must list these rights and, above all, identify the specific channel through which they can be exercised.

This channel is usually a dedicated e-mail address or a form. You should also identify the person responsible for communication among the company, data subjects, and the authority, a role the law assigns to the encarregado (known internationally as the data protection officer, or DPO). The contact must actually work, with response times that comply with the rules.

Three precautions make a real difference when drafting. First, avoid imported templates: policies translated from foreign standards often cite legal bases and rights that do not match Brazilian law. Second, date the document and keep a record of its versions, so you can prove when each rule took effect. Third, make sure the policy is consistent with what the company actually does.

A policy that does not match operational reality is worse than no policy at all, because it documents the violation itself. Before publishing, the business should map its data flows and confirm that every statement in the text is backed by actual practice. Periodic review keeps pace with changes in systems, partners, and the law itself.

Companies that treat the document as a living project, not a static piece of text, reduce risk and earn the public’s trust. Genuine transparency stops being a compliance cost and becomes a competitive advantage with customers who are increasingly attentive to what happens to their personal information.

Frequently Asked Questions

Does every company with a website need a privacy policy?

Yes, whenever personal data is collected, which is the case on nearly every website, whether through a contact form, a registration page, a shopping cart, or audience measurement tools. Once you collect a name, an e-mail address, or browsing identifiers, you have a duty to inform the data subject. The size of the business does not remove the obligation, although the volume and sensitivity of the data affect how detailed the document needs to be.

Is it mandatory to ask for consent for everything in the policy?

No. Consent is only one of the legal bases the law provides, and often it is not the most appropriate. Processing that is necessary to perform a contract, comply with a legal obligation, or regularly exercise rights does not require consent. Requesting it unnecessarily creates confusion and liability, because it suggests to the data subject a right to refuse that, in that case, does not exist. Choosing the correct legal basis for each purpose is a central step in preparing the document.

How often should the policy be reviewed?

There is no fixed deadline, but you should review the policy whenever a significant change occurs: a new system, a new partner that receives data, a new processing purpose, or a change in the law. If nothing changes, an annual review is a prudent practice to confirm that the text still reflects how the company operates. Each version should be dated and archived so you can show which rule was in force at a given time, which is valuable information in an inspection or a lawsuit.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.