Privacy Notices: How to Draft Effective Privacy Notices

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Poorly drafted privacy notices expose companies to sanctions from the ANPD (Brazil’s National Data Protection Authority) and erode the trust of data subjects, making transparency both a competitive advantage and a legal one.

The Role of the Privacy Notice in LGPD Compliance

When it comes to personal data protection in Brazil, the privacy notice sits at the center of any organization’s compliance strategy. Among its core principles, the Brazilian General Personal Data Protection Law (Law 13.709/2018, known as the LGPD) establishes transparency: data subjects are entitled to clear, precise and easily accessible information about how their data is processed and about the parties who process it. The privacy notice is the primary tool through which that transparency becomes real in practice.

An effective privacy notice is not one that shields the company from sanctions. It is one that genuinely informs the data subject, building a relationship of trust grounded in transparency.

First, a distinction: a privacy notice is not the same thing as an internal privacy policy. The internal policy guides employees and service providers on internal data-processing procedures. The privacy notice is aimed at an outside audience, the data subjects whose data the organization collects and processes. We should not confuse documents that have different purposes and different readers, because doing so undermines the effectiveness of both.

In data due diligence work, we find that many organizations still treat the privacy notice as a mere formality. They copy generic templates from the internet without adapting them to how their operations actually work. This creates significant risk. A notice that does not accurately reflect real processing practices may violate the principle of good faith and the duty of transparency under the LGPD. It also gives data subjects a false impression of how their data is actually used.

The ANPD has stressed in its guidance documents that privacy notices should be written in plain, accessible language, avoiding excessive legal jargon. This reflects a global trend: regulators in many jurisdictions recognize that overly technical documents fail to inform, because data subjects simply do not understand them.

Essential Elements of an Effective Privacy Notice

A privacy notice that meets both the legal requirements and data subjects’ expectations must include certain mandatory and recommended elements. Together, they make up a complete, functional document. We look at each one below in enough depth to guide the drafting process in practice.

Identifying the Controller and the Data Protection Officer

The notice must clearly identify who the controller of the personal data is, including its corporate name, CNPJ (Brazil’s corporate taxpayer registry number) and contact details. In addition, under Article 41 of the LGPD, the identity and contact information of the officer in charge of personal data processing (the DPO, or encarregado) must be publicly disclosed, preferably on the controller’s website. We recommend placing this information at the very beginning of the notice, so data subjects know right away whom to contact with questions or requests.

Data Collected and Purposes of Processing

The notice must specifically describe which categories of personal data are collected (registration data, browsing data, financial data, sensitive data, and so on) and what each category is used for. Avoid vague phrases such as “to improve our services” or “for commercial purposes” without further detail. The purpose principle, set out in Article 6, item I, of the LGPD, requires that processing be carried out for legitimate, specific and explicit purposes that have been communicated to the data subject. A notice that fails this requirement weakens the organization’s entire compliance foundation.

Legal Bases Relied Upon

For each processing purpose, the notice should state the corresponding legal basis from among those listed in Articles 7 and 11 of the LGPD. This link between purpose and legal basis is something we often find missing or poorly done in the notices we review during due diligence. When the legal basis is consent, for example, the notice must say so clearly and explain how the data subject can withdraw consent at any time.

Sharing Data with Third Parties

The notice should identify the categories of recipients with whom personal data may be shared: service providers, business partners, public authorities, and others. You do not need to list every company individually, but the notice must be specific enough for the data subject to understand the context and scope of the sharing. When data is transferred internationally, that fact deserves special emphasis, along with the destination countries and the safeguards in place.

Retention Period and Data Subject Rights

The notice should state how long each category of data will be stored, or the criteria used to determine that period. It should also list the rights the LGPD gives data subjects (access, correction, deletion, portability, and others) and explain in practical terms how to exercise them, ideally through a dedicated contact channel.

Common Drafting Mistakes and How to Avoid Them

In data due diligence work with organizations of all sizes and sectors, we see the same drafting failures in privacy notices again and again. Knowing these mistakes lets you avoid them up front, saving time and reducing regulatory risk.

Overly Legalistic Language

The first mistake, and perhaps the most common, is writing the notice as if it were a contract or a court filing. Long paragraphs packed with technical terms, statutory cross-references and elaborate phrasing alienate the average reader and run contrary to the ANPD’s guidance on plain language. We recommend short sentences, active voice and accessible vocabulary. When a technical term is unavoidable, add a brief explanation in parentheses.

Generic, Catch-All Clauses

Phrases like “we may collect any data necessary to provide our services” or “your data may be used for various purposes” are examples of drafting that fails the specificity requirement. Each purpose should be described individually, even if that makes the document longer. In this case, length is a result of transparency, not a flaw.

Failure to Update

Another common mistake is publishing the notice and never reviewing it again. Data-processing operations change constantly: new services launch, new partners are hired, new technologies are rolled out. We recommend reviewing the privacy notice at least every six months, and whenever there is a significant change in processing practices. Each version should show the date of the last update in a visible place.

Lack of Accessibility and Prominence

A privacy notice buried in a website footer, reachable only after multiple clicks, or shown in tiny type inside lengthy terms of use, does not do its job of informing. It should be displayed prominently, reachable in no more than two clicks from any page of the site, and presented in a format that makes it easy to read (with a table of contents, navigation anchors and responsive design).

Best Practices for Drafting in a Due Diligence Context

In data due diligence specifically, reviewing the privacy notice is often one of the first steps in assessing how mature an organization’s data protection program is. A well-drafted notice signals to the market that the organization takes its legal obligations, and its respect for data subjects, seriously. Here are the practices we consider essential in this setting.

Data Mapping First

Before drafting or revising any privacy notice, we carry out a complete mapping of processing activities (data mapping, or a ROPA, in GDPR terminology). Without detailed knowledge of what data is collected, through which channels, for what purposes and on which legal bases, it is impossible to write a notice that reflects how the organization really operates. Data mapping is the foundation of the notice.

The Layered Approach

We use a layered presentation, recommended by data protection authorities in many jurisdictions. In the first layer, we offer a concise summary of the most relevant information (who we are, what we collect, what we use it for, how to exercise your rights). In the second layer, we provide the full notice with every detail. This approach balances accessibility and completeness, serving both the reader who wants an overview and the one who wants to examine every detail.

Multidisciplinary Review

An effective privacy notice is not written by the legal department alone. We recommend that the text be reviewed by information technology professionals (who confirm the technical accuracy of the processing descriptions), communications professionals (who ensure the language is clear) and compliance professionals (who check alignment with internal policies). This multidisciplinary review significantly reduces the risk of inconsistencies between what the notice says and what the organization actually does.

Comprehension Testing

Whenever possible, we test the notice with people who have no legal or technical background. If the average reader cannot tell, after a careful read, what data is collected and why, the notice needs to be rewritten. This simple step reveals drafting problems that professionals used to technical vocabulary tend to miss.

Trends and Regulatory Developments

The data protection regulatory landscape is constantly evolving, and privacy notices must keep pace. The ANPD has issued supplementary regulations that directly affect how we communicate data processing to data subjects, including rules on the processing of children’s and adolescents’ data, international transfers, and the calculation of sanctions.

Internationally, we see a growing demand for more granular, contextual notices, meaning notices presented at the exact moment the data is collected rather than only in a single central document. This “just-in-time” approach complements the main notice and significantly improves the data subject’s experience, because the relevant information arrives in the right context.

Another important trend is the demand for privacy notices tailored to emerging technologies such as artificial intelligence, facial recognition and the Internet of Things. Data processing by these technologies has distinctive features (such as automated decision-making and profiling) that call for additional, specific information in privacy notices.

For organizations operating in multiple jurisdictions, harmonizing privacy notices is an added challenge. You have to meet the requirements of the LGPD, Europe’s GDPR, California’s CCPA and any other applicable laws at the same time, without making the document excessively long or confusing. The layered approach mentioned earlier is especially useful here, because it lets you present each jurisdiction’s specific information in an organized way.

Ultimately, drafting effective privacy notices is an ongoing exercise in balancing legal precision, clear communication and fidelity to actual data-processing practices. Organizations that invest in this process reap benefits that go beyond regulatory compliance: they build reputation, strengthen relationships with clients and partners, and position themselves competitively in a market that is paying ever closer attention to privacy and personal data protection.

This topic is directly related to privacy impact assessment, which we cover in a dedicated article.

To round out your reading, see also our article on privacy by design.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.