What personal data means in practice
Photo: Avila Ops Tecnologia
Personal data is any information identifying or enabling identification of a person. That is article 5 of the LGPD, Law 13.709/2018: name, CPF, phone, email, address, photo, license plate, order number linked to a customer. It need not be secret to be protected.
Almost every small business thinks it “keeps no data.” It does. A credit notebook has names and debts. WhatsApp has numbers, photos, conversations. Card terminals have the card’s last digits. Each falls under the law.
What counts as personal data?
Use the “can this lead to a person?” rule. Alone or combined with other information, if it identifies someone, it is personal data. Generic [email protected] is not; [email protected] is.
Legal entity data is excluded. A supplier’s CNPJ is not personal data; for MEI sole entrepreneurs, where owner and company overlap, treat it as such. The salesperson’s name and mobile number are personal data.
Sensitive data has stricter rules: health, biometrics, religion, politics, union membership, sex life, racial or ethnic origin, genetics (article 5, II). Nutritionists and fingerprint-entry gyms process it daily. Article 11 sets specific legal bases, requiring extra care.
Where do small businesses store data unknowingly?
These appear in our diagnoses:
- Google Drive customer spreadsheets shared with “anyone with the link.”
- Website forms sending everything to a personal email.
- Customer ID photos left in salespeople’s WhatsApp.
- Pix receipts with names and CPF saved in phone galleries.
- Birthday lists in reception notebooks.
None is forbidden. The law requires knowing data is there, having a reason, and protecting it. An ID photo kept “just in case” has no purpose. Delete it.
What to do now
Open the business phone and Drive. List five places containing customer names, phones, or documents. Mark sensitive data. Following guides use this map, starting with Who data subjects are and their rights. To discuss exposures: avilaops.com/contato or WhatsApp wa.me/5517997811471.
Frequently asked questions
Is a phone number personal data?
Yes. It identifies someone even without a name. A business WhatsApp contact list is a personal database requiring purpose and protection.
Is public data, such as Instagram information, protected?
Yes. Publishing does not authorize every use. Copying a competitor’s followers for bulk messages is processing unlikely to have a legal basis.
Does anonymized data leave the LGPD’s scope?
Yes, if identification cannot be reversed. “120 customers bought in February” is anonymous. A list of names and amounts is not. See What the LGPD is and whom it applies to.
Turn what you learned into your next step.
Tell us about your company and what you want to improve. We can explore the right tools, integrations or custom project together.