Who data subjects are and what rights they have
Photo: Avila Ops Tecnologia
Data subjects are the people data refers to: customers leaving phone numbers, payroll employees, individual suppliers, followers sending messages. LGPD Law 13.709/2018 grants rights in article 18, and your business as controller must respond.
Eventually a customer will ask “delete my number” or “what do you have about me?” The law permits the request and requires your response.
What rights do subjects have?
Those most common in small businesses:
- Confirmation and access: whether you hold their data and what it is.
- Correction: fix incorrect phones or misspelled names.
- Deletion: erase consent-based data when requested.
- Sharing information: who received their data.
- Consent withdrawal: leave promotion lists.
- Portability: receive data in a format transferable to another supplier, according to ANPD regulations.
How should I respond?
With a channel and deadline. An email such as [email protected] published in the privacy policy suffices. Full access responses have 15 days under article 19; small processing agents get double under CD/ANPD Resolution 2/2022. Other deadlines depend on regulation; respond promptly.
A clothing customer requests removal from WhatsApp promotions and a copy of her data. Before disclosing anything, confirm identity: the request came from the registered contact or she verified a code. Acknowledge that day, remove her number from broadcasts, and reply with name, phone, and three orders with dates and values retained for tax requirements. Ten minutes. Without a system, searching spreadsheets and conversations takes an afternoon.
What to do now
Create a privacy email and publish it. Assign a responder and deadline. Scattered spreadsheets, phones, and notebooks become painful when a request arrives. Moving from spreadsheets without losing history is our work: avilaops.com/sistema-para-pequenas-empresas or WhatsApp: wa.me/5517997811471.
Frequently asked questions
Must I delete invoices when customers ask to erase everything?
No. Legally required records remain for statutory periods. Delete what you need not retain, such as promotion subscriptions, and explain what remains and why.
Must I answer WhatsApp requests?
Yes. Your published channel is official, but requests elsewhere cannot be ignored. Route them to the channel and record the date.
Who is controller and who is processor?
The controller decides data use: your business. Processors act for it: email platforms, accountants, carriers. See LGPD for businesses with three employees.
Turn what you learned into your next step.
Tell us about your company and what you want to improve. We can explore the right tools, integrations or custom project together.