What the LGPD is and whom it applies to
Photo: Avila Ops Tecnologia
The LGPD is Brazil’s General Personal Data Protection Law, Law 13.709/2018. It regulates collecting, storing, and using information about people: names, phones, CPF, email, addresses. Any business processing personal data in Brazil is covered, with no revenue minimum. A WhatsApp customer list already brings you under it.
Risk is concrete: regulator ANPD can warn, fine, and order deletion. Trust matters too: customers asking why you need their CPF expect a clear answer; providing it wins sales.
Who must comply?
Everyone processing personal data for economic purposes: MEI, ME, EPP, independent professionals, one-person online stores. The law considers data use, not business size.
Smaller businesses face lighter obligations. ANPD’s simplified regime reduces bureaucracy and waives a data protection officer appointment, requiring a subject contact channel instead. Core rules remain: collect only necessary data, explain uses, store securely, delete when unnecessary. Personal uses such as family WhatsApp groups are excluded.
What does the law require in practice?
A reason for each requested datum, called a legal basis; consent is only one of ten. Plain-language explanations of data use. Protection starting with strong email passwords and locked company phones. Responding to requests to access, correct, or erase data.
Example: a beauty clinic requests name, WhatsApp, and birth date for booking. Name and WhatsApp serve the service. Birth date needs a real purpose, such as birthday discounts. Without one, do not request it.
What to do now
List current customer-data locations: phone, spreadsheet, system, notebook. See LGPD for businesses with three employees. To identify operational exposure, we diagnose in a conversation: avilaops.com/contato or WhatsApp: wa.me/5517997811471.
Frequently asked questions
Must MEI businesses comply?
Yes. Anyone processing personal data economically is covered. MEI qualifies for ANPD’s simplified regime unless processing high-risk data, with less bureaucracy but the same basic rules.
Does employee data count?
Yes. Employee, supplier, and applicant data are personal data. Employment contracts and legal obligations such as eSocial support most processing.
Do I need a lawyer?
Not initially. Data maps, privacy policies, and form adjustments can be done with guidance and judgment. Lawyers help with sensitive data such as health or large customer volumes. For service AI, see avilaops.com/guias/como-usar-ia-no-atendimento-sem-violar-a-lgpd.
Turn what you learned into your next step.
Tell us about your company and what you want to improve. We can explore the right tools, integrations or custom project together.