LGPD for a business with three employees
Photo: Avila Ops Tecnologia
A three-employee business can comply with Brazil’s LGPD (Law 13.709/2018) in seven steps, none requiring consultants. ANPD created a simplified regime for small processing agents, waiving a data protection officer and reducing recordkeeping bureaucracy. The essentials remain: know where data lives, have a reason for each item, protect it, and respond to customers.
Small businesses get stuck at two extremes. Either they think the law “is for big companies” and do nothing, or buy 40 pages of documents nobody reads. Neither protects them. Practice protects them, and it fits into one afternoon weekly for a month.
Where should compliance begin?
With a data map answering four questions for each location: what data is here, whose is it, what is it for, and who can access it? Use a simple spreadsheet, one row per location. In a three-person business, it usually has eight to 15 rows: WhatsApp, customer spreadsheet, sales system, email, website form, payroll, card terminal, physical files.
The map reveals purposeless data to delete, ownerless locations to assign, and unnecessary access to revoke. This exercise alone reduces risk because typical breaches come from forgotten data rather than actively used data.
What are the seven steps?
| Step | What to do | Time |
|---|---|---|
| 1. Data map | Spreadsheet: location, data, purpose, who has access | One afternoon |
| 2. Privacy policy | One page in clear Portuguese, based on the map | Two hours |
| 3. Data subject channel | A privacidade@ email address and a person replying within 15 days | One hour |
| 4. Passwords and two-step verification | Password manager and two-step verification for email, Instagram, and business system | Two hours |
| 5. Individual access | Each employee has their own login; no shared passwords | Two hours |
| 6. Suppliers | Confirm the accountant, platform, and carrier have data-processing contracts or terms | One afternoon |
| 7. Staff | A 30-minute conversation: what is allowed, prohibited, and what to do if something goes wrong | 30 minutes |
Step 5 is skipped most and hurts most later. Shared passwords mean you do not know what departing staff can still access. Individual logins are disabled with one click on departure day.
Step 7 is worth more than any document. These rules suffice: do not keep customer data on personal phones, do not send spreadsheets through WhatsApp, and report lost phones or suspicious link clicks immediately. Personal phones have a dedicated guide: Customer data on an employee’s personal WhatsApp.
What can small businesses skip?
Under ANPD’s simplified regime, small businesses need not appoint a data protection officer but must maintain a data subject contact channel. An impact assessment, a long risk document, is prepared when ANPD requests it. However, the simplified regime (CD/ANPD Resolution No. 2/2022) excludes high-risk processing, such as large-scale sensitive data. Processing records can be simplified: your data map serves this purpose.
What stays the same for everyone: a legal basis for each data item, clear information to data subjects, proportionate security, and notification of significant incidents. If you process sensitive data, such as a clinic or gym using biometrics, care requirements rise and a conversation with an expert is worthwhile.
What to do now
Reserve the first afternoon for data mapping. Without it, the other six steps are guesswork. With it, write the policy in two hours and correct access the same day. If you prefer someone to inspect operations and identify exposure, we assess it in a conversation: avilaops.com/contato or contact us on WhatsApp: wa.me/5517997811471. The law’s basics are in What is the LGPD, and who does it apply to?.
Frequently asked questions
Do I need a data protection officer (DPO)?
Not under ANPD’s simplified small-business regime. You need a published contact channel, such as email, and someone responsible for replying. The owner can do it.
Does my accountant handle LGPD compliance?
No. The accountant processes payroll data and needs a contract or terms stating that. Your business’s compliance is your responsibility.
What does compliance cost?
The seven steps cost time rather than money: password managers have free versions, and professional email starts around R$ 10 per inbox monthly. Actual costs arise when a system must replace spreadsheets and phones, depending on the assessment.
Turn what you learned into your next step.
Tell us about your company and what you want to improve. We can explore the right tools, integrations or custom project together.