Sharing Data With Third Parties: What a Company Can Pass Along to Partners

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Sharing customer information with suppliers, business partners, and service providers has become routine in the digital economy, but Brazil’s General Data Protection Law (LGPD) sets strict limits on that flow. Without an adequate legal basis, without transparency toward the data subject, and without a proper division of responsibilities along the processing chain, passing data along stops being operational efficiency and becomes legal exposure.

Every data transfer requires its own legal basis

The first mistake companies make is to assume that, because they already hold a customer’s data, they can freely pass it to third parties. Law 13.709/2018 does not work that way. Every processing operation, and transferring data to suppliers is one of them, must rest on one of the grounds listed in Article 7 of the law.

The most common legal bases in this setting are performance of a contract, compliance with a legal or regulatory obligation, the controller’s legitimate interest, and the data subject’s consent. The choice is neither free nor interchangeable: it depends on the specific purpose of the sharing and the type of data involved.

When the transfer serves to carry out the very contract signed with the customer, such as sending an address to a shipping company, the natural basis is performance of the contract. Sharing for marketing, profile enrichment, or monetization, on the other hand, rarely holds up without specific, prominent consent.

Legitimate interest is the delicate point. It is not a wild card. Using it requires a documented proportionality test, known as a legitimate interest assessment or impact report, that can show the purpose is concrete, the data is strictly necessary, and the data subject’s legitimate expectations were taken into account.

When sensitive data is involved, meaning the categories in Article 11 (health, biometrics, religious belief, union membership, among others), the standard rises. The grounds for processing are narrower, and absent a specific provision, consent must be prominent and tied to a defined purpose. Transferring sensitive data to partners without a solid basis is among the conduct that carries the greatest risk of sanctions.

Data subjects have a right to know where their data goes

Transparency is a foundational principle of the law (Article 6, item VI) and takes concrete form in the duty to inform under Article 9. Data subjects have the right to easy access to clear information about the purpose of the processing, its form and duration, and, expressly, about the shared use of data and the identity of the recipients.

This means a privacy policy cannot be limited to generic formulas such as “we may share your data with partners.” The text must identify the categories of recipients, the purposes of each instance of sharing, and the corresponding legal basis. The vaguer the document, the weaker the company’s defense before the authority and the courts.

The duty to inform does not end at the moment of collection. If a new purpose for sharing arises that is incompatible with the one originally disclosed, the earlier processing does not legitimize it. In that case, the data subject must be informed again and, depending on the applicable legal basis, new consent must be obtained.

Data subjects also have the right to question the sharing. They may request information about the public and private entities with which the controller has shared their data, revoke consent, and demand deletion of data processed on the basis of that consent. The system for handling these requests must be in place before the request arrives.

Failures of transparency tend to be underestimated because they do not cause visible, immediate harm. But they are precisely what reveals, in an inspection or lawsuit, whether the company handled data fairly or simply moved information in the dark, hoping no one would ask.

Read together, these duties make clear that informing the data subject is a condition of legitimacy, not an ancillary formality.

Sharing data without a legal basis and without informing the data subject is not operational efficiency. It is legal liability waiting for an inspection.

Once the legal basis is set and the duty to inform is met, the problem that generates the most litigation remains: who is responsible when something goes wrong along the chain.

Responsibility follows the data along the chain

The law distinguishes two central roles. The controller is the one who makes decisions about the processing (Article 5, item VI). The processor carries out the processing on the controller’s behalf and according to its instructions (item VII and Article 39). Suppliers and partners can take on either role, and the correct classification determines the liability regime.

When the partner acts as a processor, it must strictly follow the controller’s instructions. If it goes beyond those instructions or violates the law, it becomes answerable as a controller for that conduct. For this reason, a contractual label of “mere service provider” does not protect someone who, in practice, decides the purposes and means of the processing.

Article 42 establishes the duty to compensate property, moral, individual, or collective damage caused in violation of the data protection legislation. Paragraph 1 provides for joint and several liability: the processor is jointly and severally liable when it fails to meet its obligations or does not follow the controller’s lawful instructions, and controllers directly involved in the processing are jointly and severally liable for the damages.

In practice, this dismantles the illusion that “the data left my company, so the problem belongs to the partner.” If the controller chose the supplier poorly, failed to oversee it, or transferred data without a legal basis, it remains on the front line of compensation, even if the actual breach occurred on the other side.

Article 43 sets out the grounds that relieve liability: proving that the agent did not carry out the processing, that there was no violation even though it did carry out the processing, or that the damage resulted from the exclusive fault of the data subject or a third party. The burden of proving these defenses falls on the agent, which underscores the importance of documentation.

Contracts and governance are the concrete line of defense

Given this regime, the contract between controller and supplier is no longer mere paperwork. It is the document that defines purposes, prohibits secondary uses, imposes security measures, governs subcontracting, and provides for the return or deletion of data when the relationship ends.

A well-built contract defines the partner as a processor, states that it will process data only according to instructions, and sets incident notification obligations. Reporting security incidents to the national authority and to the data subject, as provided in Article 48, depends on the controller being informed in time by the link in the chain that suffered the failure.

Governance complements the contract. Mapping which data is shared, with whom, under which legal basis, and for how long is the minimum expected of anyone processing data at scale. Without that inventory, a company cannot respond to data subjects’ requests or demonstrate compliance during an inspection.

Periodic audits of partners close the loop. It is not enough to sign a robust contract and ignore how the supplier actually handles the data. Choosing and diligently supervising the processor is part of the controller’s own duty of security, and failing to do so weighs against it when liability is determined.

Data sharing, then, is not prohibited by the law. What the law requires is that it be done on an identified legal basis, communicated clearly to the data subject, and supported by a contractual chain that allocates responsibilities expressly. Companies that treat data transfers as a legal decision, and not merely an operational one, reduce risk and preserve their customers’ trust.

Frequently Asked Questions

Do I need the customer’s consent to share data with a supplier?

Not always. Consent is only one of the possible legal bases. If the sharing is indispensable to perform the contract signed with the customer, such as sending an address to a shipping company, the basis may be performance of the contract. Sharing for marketing or monetization purposes, however, generally requires specific, prominent consent. The rule is to choose the legal basis that fits the concrete purpose, not to assume that holding the data authorizes any transfer.

If the leak happened at the supplier, is my company free of liability?

Not necessarily. Under Article 42 of the law, controllers involved in the processing may be jointly and severally liable for damages, and the processor is jointly and severally liable when it fails to meet its obligations. A company that chose its partner poorly, failed to oversee it, or transferred data without a legal basis remains exposed. Escaping liability depends on proving one of the defenses in Article 43, and that burden falls on the processing agent itself.

What does the privacy policy need to say about sharing?

The policy must state, clearly and accessibly, the purposes of the processing, the categories of recipients with whom data is shared, and the legal basis for each operation. Generic formulas, such as saying that data “may be shared with partners,” do not satisfy the duty of transparency under Article 9. The more precise the document, the stronger the showing of compliance before the authority and in any court dispute.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.