LGPD for Small and Medium-Sized Businesses: A Simplified Guide

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

The LGPD (Brazil’s General Data Protection Law) is not just for large corporations. Small and medium-sized businesses that ignore personal data protection face multimillion-real fines and can lose their customers’ trust.

What the LGPD Is and Why It Matters for SMEs

The General Data Protection Law (Law No. 13.709/2018) took effect to regulate the processing of personal data by any individual or legal entity, regardless of the size of the business. When we look at Brazilian small and medium-sized enterprises (SMEs), we see that many business owners still believe the law applies only to large corporations or tech companies. That mistaken belief puts thousands of businesses at risk, because the ANPD (Brazil’s National Data Protection Authority) has the authority to audit and sanction any organization that processes personal data improperly.

We consider it essential for SME managers to understand that “personal data” is not limited to sophisticated digital information. A customer’s full name in a spreadsheet, a CPF (Brazil’s individual taxpayer number) jotted down in a notebook of customer tabs, a phone number saved in a business WhatsApp account, and even security camera footage are all personal data protected by the LGPD. So nearly every business, from a dental office to a neighborhood bakery, processes data in some form and must comply with the law.

The ANPD issued Resolution CD/ANPD No. 2/2022, which establishes differentiated, simplified treatment for small-scale processing agents. The resolution recognizes that it would be disproportionate to require a micro-business to maintain the same compliance structure as a multinational. Even so, certain minimum obligations must be met, and not knowing the law is no excuse for failing to follow it.

Data Mapping: The First Step Toward Compliance

When we begin an LGPD compliance process at a small or medium-sized business, the first step we recommend is personal data mapping. This exercise consists of identifying which data the company collects, where it is stored, who has access to it, who it is shared with, and how long it is kept. It may sound complicated, but in practice most SMEs keep their data in just a few places: spreadsheets, management software (ERP), company e-mail, messaging apps and, sometimes, a corporate website with a contact form.

To carry out this mapping efficiently, we suggest that the business owner go through each department of the company (even if there are only two or three employees) and record the following: what personal data is collected in that department, the purpose of the collection, the legal basis that justifies the processing, who has internal access to the data, and whether it is shared with third parties (such as accountants, marketing firms or payment platforms). This record is what we call a Record of Processing Activities (ROPA), and the good news is that, for small-scale agents, the ANPD provides simplified templates.

We have noticed that many SMEs are surprised to discover how much data they process without realizing it. A small accounting firm, for example, handles sensitive information about dozens or hundreds of individuals (financial details, ID numbers, addresses). An aesthetics clinic stores health data, which the LGPD classifies as sensitive personal data and which requires even stricter safeguards. Mapping builds this awareness and allows the company to make informed decisions about how to protect the information.

Legal Bases and Consent: Understanding When You May Process Data

One of the points that confuses business owners the most is the question of legal bases. The LGPD provides ten situations in which the processing of personal data is permitted, and consent is only one of them. When we advise SMEs, we find that many owners believe they must obtain consent for absolutely everything, which is not only unnecessary but can also create significant operational problems.

Let us briefly review the legal bases most relevant to the day-to-day operations of small and medium-sized businesses. Performance of a contract is the legal basis that allows the processing of data needed to fulfill a contract with the data subject. For example, an online store needs the customer’s address to deliver the product that was purchased, and it does not need separate consent for that, because the processing is inherent to the contractual relationship. Legal or regulatory obligation allows processing when a law requires certain data to be handled, such as keeping accounting and tax records for the periods set by tax legislation. Legitimate interest allows processing when the company has a legitimate purpose that does not conflict with the data subject’s rights, such as sending messages about products similar to ones a customer has already bought.

LGPD compliance does not have to be an expensive or complex process for small businesses, but it does have to be taken seriously: start with data mapping and move forward gradually and consistently.

When consent is necessary, it must be freely given, informed, unambiguous and tied to a specific purpose. We recommend that SMEs rely on consent as a legal basis only when none of the other bases applies. That is because the data subject can withdraw consent at any time, which can create operational difficulties if the company depends solely on it to justify processing that is essential to the business.

Practical Security Measures for SMEs

When we talk about information security for small and medium-sized businesses, we are not talking about multimillion-dollar investments in IT infrastructure. There are simple, low-cost measures that significantly raise the level of protection for the personal data a company handles. We have grouped the main recommendations we give to insured persons into practical categories.

Access Control and Passwords

One of the most common vulnerabilities we see in SMEs is shared passwords and unrestricted access to systems. We recommend that each team member have individual credentials, that passwords be at least twelve characters long (combining letters, numbers and special characters), and that two-factor authentication be turned on for every service that offers it, especially company e-mail, management systems and bank accounts. In addition, access to personal data should follow the principle of least privilege: each employee should access only the data strictly necessary to do their job.

Backups and Updates

Keeping regular backups in a secure location (preferably encrypted) is an essential measure that protects the company from both cyberattacks and hardware failures. Equally important is keeping all software up to date, including operating systems, browsers and apps. Many attacks exploit vulnerabilities that have already been fixed in updates that simply were never installed.

Team Training

We consider employee training the most important security measure and, at the same time, the most neglected one. There is no point investing in technology if an employee clicks on a phishing link and compromises the entire system. Regular awareness sessions on online scams, good e-mail practices and procedures for safely disposing of paper documents make a substantial difference in an organization’s level of security.

Data Subjects’ Rights and How to Honor Them

The LGPD grants data subjects a series of rights that businesses must be prepared to honor. Among those most relevant to everyday SME operations are the right of access (the data subject may request a copy of the data the company holds about them), the right to correction (requesting that incomplete or outdated data be updated), the right to deletion (requesting the removal of data processed on the basis of consent), and the right to portability (requesting that the data be transferred to another provider).

To handle these rights in an organized way, we recommend that the company set up a dedicated channel for LGPD-related requests. It can be a dedicated e-mail address or even a form on the company’s website. What matters is that someone is responsible for receiving, reviewing and answering these requests within the legal deadline. Resolution CD/ANPD No. 2/2022 exempts small-scale agents from the obligation to appoint a Data Protection Officer (DPO), but the company must still provide a channel through which data subjects can reach it.

In practice, we have observed that data subject requests are relatively rare in SMEs, but when they do occur, the company needs to be ready to respond properly. The deadline to confirm whether data is being processed is 15 days from the date of the data subject’s request. For providing a complete statement, the deadline is up to 15 days, likewise counted from the date of the request. Keeping your data mapping up to date makes it far easier to handle these requests.

Penalties and Enforcement: What Happens If the Company Does Not Comply

The penalties under the LGPD range from warnings to fines of up to 2% of the legal entity’s revenue, capped at R$ 50 million per violation. For an SME, even a fraction of that amount can be financially devastating. Besides fines, the ANPD may order the blocking or deletion of improperly processed personal data, the partial suspension of the database, and even a partial or total ban on activities related to data processing.

Looking at the enforcement landscape, we see that the ANPD has taken an approach that was educational at first but is becoming progressively stricter. The first administrative penalties have already been imposed, and enforcement is expected to intensify in the coming years. In addition to the ANPD’s actions, there has been a significant rise in lawsuits filed by data subjects, often seeking compensation for moral damages (non-economic harm) caused by data leaks or misuse of personal data.

Beyond the punitive side, we want to stress that LGPD compliance is a real competitive advantage for SMEs. Companies that show care for their customers’ data build stronger relationships of trust, and more and more business contracts (especially with larger companies) require proof of compliance with data protection law as a condition of doing business. This process, known as data due diligence, has become common practice in the Brazilian market and can make the difference between winning and losing an important contract.

This topic is directly related to GDPR vs. LGPD, a subject we cover in a dedicated article.

This topic is directly related to LGPD in practice, a subject we cover in a dedicated article.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.