LGPD in Practice: What Data Your Company Can Collect and How Long to Keep It

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Companies that collect data from customers, employees, or suppliers must identify a legal basis under Brazil’s General Data Protection Law (LGPD) for each operation. Without that foundation, the processing is unlawful from the start, and no later measure can cure the defect. The choice between consent and legitimate interest, together with clear limits on purpose and deadlines for disposal, determines whether an organization operates within the law or quietly builds up risk.

What the Law Requires Before Any Data Is Processed

Law 13.709/2018 builds data protection around a simple idea: no personal data may be processed without a valid legal justification. That justification is called a legal basis. Article 7 of the law lists ten grounds for ordinary data, while Article 11 sets stricter rules for sensitive data, such as health information, biometrics, and religious belief.

The most common mistake companies make is getting the order backward. They first collect the data, build spreadsheets, and integrate systems, and only then ask whether any of it was permitted. The correct logic is the opposite. Before any collection, the organization identifies the purpose, chooses the legal basis that fits that purpose, and only then begins processing.

Each operation needs its own justification. The same customer record may support the performance of a contract, compliance with a legal tax obligation, and a marketing campaign, and each of those uses calls for a different basis. Treating everything as a single block is a recipe for enforcement action.

Consent and Legitimate Interest: The Distinction That Causes the Most Confusion

Of the ten legal bases, two account for most of the practical debate: consent and legitimate interest. They are not interchangeable, and choosing the wrong one compromises the entire operation.

Consent is a free, informed, and unambiguous statement by which a person agrees to the processing of their data for a specific purpose. “Free” means without coercion and without any penalty if the person refuses. “Informed” means the person knows exactly what will be done. “Unambiguous” means there is no doubt about the agreement, which rules out pre-checked boxes and silence treated as acceptance.

Consent has one feature that many companies underestimate: it can be withdrawn at any time, as easily as it was given. When that happens, any processing based on that authorization must stop. Building an entire business process on revocable consent weakens the operation itself.

Legitimate interest, by contrast, allows processing when the company or a third party has a concrete and lawful interest, as long as that interest does not override the data subject’s rights and freedoms. It is a more stable basis because it does not depend on individual authorization, but it requires a documented balancing exercise.

That exercise takes the form of what is known as a legitimate interest assessment report, a document that records the intended purpose, the real necessity of the processing, and the balance between the company’s interest and the data subject’s reasonable expectations. Without this record, a company may claim to be acting on legitimate interest but cannot prove it to the authority.

Law 13.709/2018 builds data protection around a simple idea: no personal data may be processed without a valid legal justification.

How to Decide Between One Basis and the Other

The practical question is straightforward: would the person expect this processing? If a customer provides an address to receive a product they bought, they expect the company to use that information to deliver it. Here, performance of the contract is enough. Neither consent nor legitimate interest is needed, because there is a separate basis for contractual relationships.

When the company wants to use that same address to send offers for different products, the picture changes. Prospecting for new business is usually grounded in legitimate interest, but with safeguards: the data subject must be able to object easily, and the communication must relate to the expectation created by the original relationship.

Processing sensitive data, or using information for purposes the person would hardly anticipate, tends to require specific and prominent consent. In those cases, individual authorization stops being red tape and becomes the only legally safe basis.

One warning sign deserves attention. When a company hesitates between consent and legitimate interest, the real problem is often the lack of a clear purpose. Once the purpose is defined precisely, the legal basis almost always reveals itself. An unclear basis usually points to an unclear purpose.

Purpose and Retention: The Limits Most Companies Ignore

Choosing the right legal basis does not end a company’s obligations. The law imposes two principles that act as retaining walls: specific purpose and a time limit on processing.

Under the purpose principle, data may be used only for the purpose disclosed at the time of collection. Data obtained for billing cannot freely migrate into a marketing campaign, and information from a hiring process cannot feed later evaluations without new justification. In practice, every departure from the original purpose is a new processing activity that requires a new legal basis.

The time limit is the most neglected point. The law requires data to be deleted when its purpose has been fulfilled or when the data subject requests it, except where a legal retention period requires the data to be kept. That means holding data indefinitely, out of convenience or habit, violates the law.

Accumulating data without a purpose is a liability, not an asset. Bloated databases increase exposure in the event of an incident, raise the cost of responding to data subject requests, and turn any leak into a much bigger problem. Keeping everything forever is the opposite of security.

Setting Disposal Deadlines in Practice

Setting retention periods requires weighing two factors: the purpose of the data and the legal obligations to keep it. Tax and employment records have their own retention periods set by other laws, and for as long as those periods run, the legal basis for processing is compliance with a legal obligation, no longer the contract or consent.

A workable method starts by mapping all the organization’s data flows. For each category of information, the company records where the data came from, what it is for, its legal basis, who has access to it, and how long it needs to exist. This inventory is the backbone of any defensible retention policy.

With the map in hand, each category gets a deadline. Contact details of inactive customers may be kept for a period tied to the limitation period for any collection claims. Résumés of candidates who were not hired usually justify only short retention, unless the candidate has expressly consented to inclusion in a talent pool. Accounting records follow the applicable tax deadlines.

Once the deadline passes, disposal must be real and secure. Anonymizing or permanently deleting the data, including backups and copies on peripheral systems, is what counts as genuine compliance. Marking a record as inactive while leaving the data accessible does not satisfy the law. Logical deletion without physical deletion is retention in disguise.

Companies that structure this cycle (collection with a defined legal basis, use limited to the purpose, and disposal on schedule) sharply reduce their risk of sanctions and gain operational efficiency, because they stop managing data that should no longer exist.

Frequently Asked Questions

Is it mandatory to ask for consent for all data processing?

No. Consent is only one of the ten legal bases provided for ordinary data. Many operations rely on other grounds, such as performance of a contract, compliance with a legal obligation, or legitimate interest. Using consent where it is not the right basis creates vulnerability, because the person can withdraw it and halt processing that actually had its own, more stable foundation.

Does legitimate interest require no documentation?

Quite the opposite. Although it does not depend on individual authorization, legitimate interest requires an assessment report recording the purpose, the necessity of the processing, and the balance between the company’s interest and the data subject’s rights. Without that document, an organization may still invoke the basis but has no way to prove it to the authority, which in practice amounts to not having it.

How long can a company keep personal data?

Only for as long as needed for the purpose that justified the collection, or for the legal retention period, where one exists. Once the purpose has ended and any mandatory periods have expired, the data must be permanently deleted or anonymized, including backups. Holding information indefinitely, with no current purpose, violates the time-limit principle and increases the risk in the event of a security incident.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.