Data Protection and Consumer Relations: CDC and LGPD

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

The convergence of Brazil’s Consumer Protection Code and General Data Protection Law creates a new legal paradigm that calls for extra care from businesses and consumers in digital consumer relations.

Where the CDC and the LGPD Meet in Consumer Relations

Look at Brazil’s legal landscape today and you will see two major statutes increasingly speaking to each other: the Consumer Protection Code (Law No. 8.078/1990) and the General Personal Data Protection Law (Law No. 13.709/2018). They were written at different points in history and for specific purposes, but they share a central goal: protecting the vulnerable party in a legal relationship, whether that party is a consumer or a personal data subject.

The LGPD (Brazil’s General Data Protection Law) brought to Brazilian law a robust set of principles, rights and obligations that directly affect how companies collect, store, process and share their customers’ personal data. In consumer relations, this means that any commercial transaction involving personal data must comply at the same time with consumer protection rules and data protection rules. In practice, many companies have yet to grasp how deeply the two bodies of law are integrated, and they continue to treat them as separate, watertight compartments.

The concept of data due diligence, which comes from corporate governance practice, takes on particular importance here. It is the systematic process of reviewing, assessing and bringing into compliance an organization’s personal data processing practices, with a special focus on operations involving consumer relations. This advance review lets a company identify risks, fix weaknesses and put in place processes that ensure compliance with both the CDC (Brazil’s Consumer Protection Code) and the LGPD. See also our content on Consumer Data Protection.

Shared Legal Bases and Principles

When we examine the foundations of both statutes, we find principles that complement and reinforce each other. The principle of transparency, found in both the CDC (art. 6º, III) and the LGPD (art. 6º, VI), requires suppliers and data controllers to give clear, adequate and conspicuous information about the characteristics of their products and services and about how personal data is processed. In practice, this means that terms of use, privacy policies and adhesion contracts must be written in accessible language, without abusive clauses that authorize data processing incompatible with the stated purpose.

The purpose principle, set out in art. 6º, I, of the LGPD, requires that personal data be processed for legitimate, specific and explicit purposes that have been communicated to the data subject. Applied to consumer relations, this means that collecting a consumer’s data must be strictly tied to providing the service or delivering the product that was purchased. The common practice of collecting excessive data for commercial profiling, selling databases to third parties or targeting advertising without specific consent violates both the LGPD and the CDC’s principle of objective good faith.

The necessity principle (art. 6º, III, LGPD) also deserves attention. Companies must limit data processing to the minimum needed to achieve their purposes. In the consumer context, this translates into a ban on demanding information from consumers that has no direct connection to the transaction at hand. Asking for data such as political orientation, religious belief or health information just to buy a product online violates the LGPD and is also an abusive practice under the CDC.

Consent in Digital Consumer Relations

The data subject’s consent, provided for in art. 7º, I, of the LGPD, takes on special features when it arises within a consumer relationship. It is essential to stress that consent must be free, informed and unambiguous. That rules out generic authorizations buried in lengthy adhesion contracts that the consumer accepts with no real chance to negotiate. The use of so-called “dark patterns” (interfaces designed to push users into consenting to unwanted data processing) can be treated as an abusive commercial practice under the CDC and as a defect in consent under the LGPD.

Data due diligence in consumer relations is not just a legal requirement. It is a competitive advantage that shows respect for the consumer and organizational maturity in governing personal information.

We should also point out that consent is not the only legal basis for processing data in consumer relations. Performance of a contract (art. 7º, V, LGPD), the controller’s legitimate interest (art. 7º, IX) and credit protection (art. 7º, X) are legal bases that often apply. Even so, when processing rests on a legal basis other than consent, the LGPD’s other principles (purpose, necessity, transparency) remain fully in force and must be observed alongside consumer protection guarantees.

Data Due Diligence: Putting It Into Practice

An effective data due diligence program for consumer relations requires a structured approach that covers many dimensions of a company’s operations. We recommend carrying it out in well-defined stages, starting with a complete mapping of personal data flows within the organization. See also our content on Consumer Data.

Data mapping means identifying in detail every point where consumers’ personal data is collected, stored, processed, shared and deleted. The survey should run from the customer’s initial registration through after-sales service, including loyalty programs, direct marketing campaigns, customer support, credit analysis and any sharing with business partners. Each point of contact with personal data must be documented, along with the legal basis used, the specific purpose and the retention period.

Risk Assessment and Corrective Measures

After mapping, the next step is a risk assessment: a systematic analysis of the vulnerabilities found at each stage of the data life cycle. The assessment should weigh legal risks (administrative penalties from the ANPD (Brazil’s National Data Protection Authority), individual and class lawsuits, reputational harm) as well as operational risks (security incidents, leaks, unauthorized access). The Personal Data Protection Impact Report (RIPD), provided for in art. 38 of the LGPD, is a valuable tool at this stage, especially when processing involves consumers’ sensitive data or large volumes of personal information.

The corrective measures identified in the risk assessment should be prioritized by the severity and likelihood of the risk. In our experience, the most urgent fixes usually involve bringing privacy policies up to standard (they are often generic and inadequate), revising contracts with data processors (technology vendors, marketing firms, payment processors) and putting in place effective mechanisms for data subjects to exercise the rights set out in art. 18 of the LGPD.

Third-Party Contracts and the Processing Chain

One aspect often neglected in data due diligence is the review of the processing chain that involves third parties. In modern consumer relations, a consumer’s personal data passes through multiple players: e-commerce platforms, payment gateways, logistics companies, CRM tools, digital marketing platforms and more. Each link in the chain is a point of risk that must be assessed and regulated by contract.

We believe that contracts between data controllers and processors should contain specific clauses on the authorized purposes of processing, the required security measures, the procedures for reporting incidents, the conditions for subcontracting and the obligation to delete data when the contractual relationship ends. The absence of these provisions can amount to negligence by the controller and increase its liability in the event of an incident, both before the ANPD and before the injured consumer.

Civil Liability and Penalties

The question of civil liability for harm caused by the unlawful processing of personal data in consumer relations has its own characteristics, which call for careful analysis. The CDC establishes the strict liability of the supplier for defects in products or services (arts. 12 and 14). The LGPD, for its part, provides a liability regime under which a controller or processor that causes property, moral, individual or collective damage through the processing of personal data must make it right (art. 42). Learn more about Data Protection and Edge Computing Services.

Taken together, these rules suggest that, in consumer relations, liability for personal data violations tends to be treated as strict liability, so the consumer does not have to prove fault. This reading is reinforced by the recognition that data subjects are vulnerable (much like consumers) and by the application of the principle of the reversal of the burden of proof, already well established in consumer law.

On the administrative side, the ANPD (National Data Protection Authority) can impose penalties ranging from warnings to fines of up to 2% of a legal entity’s revenue, capped at R$ 50 million per violation. In addition, consumer protection bodies (the PROCONs, Brazil’s consumer protection agencies; the Public Prosecutor’s Office; and the Public Defender’s Office) retain authority to act in cases involving personal data violations in a consumer context, which significantly widens the scope of oversight and accountability.

Security Incidents and the Duty to Notify

Security incidents involving consumers’ personal data call for a coordinated response that meets the obligations of both the LGPD and the CDC. Art. 48 of the LGPD requires the controller to notify the ANPD and the data subject of any security incident that may cause relevant risk or harm. In the consumer context, this obligation adds to the duty to inform under the CDC, which requires suppliers to immediately report any risks identified after a product or service has been placed on the market.

We recommend that companies keep a documented incident response plan and test it periodically. It should cover technical containment procedures, impact assessment, notification of the competent authorities and notification of the affected consumers. Courts and administrative authorities take into account the speed and transparency of incident management when they evaluate the conduct of the processing agent.

Trends and Recommendations for Compliance

The regulatory landscape for data protection in consumer relations is constantly evolving. Progressive regulation by the ANPD, court decisions that are gradually settling how the law is read, and consumers’ growing awareness of their digital rights all point toward stricter oversight and accountability.

A few practical recommendations for companies operating in the consumer market: put data governance programs in place with periodic review; appoint a data protection officer (DPO) with autonomy and adequate resources; invest in ongoing training for teams that handle consumers’ personal data; keep up-to-date records of processing operations; conduct impact assessments before launching new products or services that involve significant data processing; and set up efficient channels for responding to data subjects’ rights.

It is equally important for consumers to know their rights and how to exercise them. The right of access to data (art. 18, II, LGPD), the right of correction (art. 18, III), the right of deletion (art. 18, VI) and the right of portability (art. 18, V) are powerful tools. Used knowingly, they help build a fairer and more transparent consumer environment.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.