Website privacy policy: what Brazil's LGPD requires

Brazil's LGPD (Lei Geral de Proteção de Dados, the country's data protection law) does not use the term "privacy policy", but it requires that the data subject have easy, clear and conspicuous access to seven pieces of information about how their data is processed (Art. 9): the specific purpose, form and duration, who the controller is, how to contact it, who the data is shared with and why, the responsibilities of the agents, and the rights in Art. 18. The identity and contact details of the data protection officer (encarregado) must also be public (Art. 41, § 1); small processing agents may go without one, but they need a service channel for data subjects (CD/ANPD Resolution No. 2/2022, Art. 11). The site's policy is the most common place to bring all of this together, with a link in the footer of every page and at the points of collection. It needs to describe what the site actually does, including cookies and third-party scripts, and be updated when something changes.

This article explains Brazil's LGPD and the regulations and guides of the ANPD (Brazil's data protection authority) based on the sources listed at the end, consulted on October 26, 2026. It is not legal advice or a policy template: the content depends on the data each site processes, and the final wording belongs to the controller and its legal team.

Privacy policy or privacy notice: does the name matter?

No. The LGPD (Law No. 13,709/2018) speaks of a right of access to information, not of a document with a fixed name. The ANPD cookie guide uses "Privacy Notice (or 'Privacy Policy')" for the agent's public statement about data processing in general (p. 29). This article uses "privacy policy" because it is the most common name on websites.

A few terms come up constantly, all defined in Art. 5 of the law: the data subject (titular) is the person the data refers to; the controller decides on the processing; the processor (operador) processes data on the controller's behalf; the data protection officer (encarregado) is the person appointed as the channel between the controller, data subjects and the ANPD (Agência Nacional de Proteção de Dados, the National Data Protection Agency).

What the LGPD requires you to disclose

Art. 9 says the data subject has the right to easy access to information about the processing, presented "in a clear, adequate and conspicuous manner". The table shows each item and what it usually means on a website.

The same article has three rules that affect the wording:

• If consent is requested with misleading or abusive information, or without prior transparency, it is null (§ 1).

• If the purpose changes in a way that is incompatible with the original consent, the controller gives notice beforehand, and the data subject can withdraw (§ 2).

• When processing is a condition for providing a product, service or right, this must be stated prominently, together with how to exercise the rights (§ 3).

Anyone relying on legitimate interest as the basis also has to make the processing transparent (Art. 10, § 2). In practice, the policy is where the data subject learns that this processing exists and how to object to it.

Data subject rights and how to handle them

Art. 18 lists what the data subject can request from the controller, at any time:

1. confirmation that processing exists;

2. access to the data;

3. correction of incomplete, inaccurate or outdated data;

4. anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;

5. portability to another provider, under ANPD regulations;

6. deletion of data processed with consent, except for the exceptions in Art. 16;

7. information on the public and private entities the controller shared data with;

8. information on the possibility of not consenting and the consequences of refusing;

9. withdrawal of consent.

The same article guarantees the right to object to processing carried out without consent when the law is not complied with (§ 2) and the right to file a petition against the controller with the ANPD (§ 1). Art. 20 gives the right to request a review of decisions made solely on the basis of automated processing, which matters if the site makes automated decisions that affect the person, such as approving credit.

Deadlines: confirmation of existence or access can be provided in a simplified format, immediately, or through a clear and complete statement within 15 days of the request (Art. 19). Small processing agents get double the time to handle the requests in Art. 18, §§ 3 and 5, and up to 15 days for the simplified statement (CD/ANPD Resolution No. 2/2022, Arts. 14 and 15). The policy does not need to repeat the whole law, but it should say through which channel requests come in.

Data protection officer or service channel

The LGPD requires the controller to appoint a data protection officer and publicly disclose their identity and contact details, "clearly and objectively, preferably on the controller's website" (Art. 41, § 1). The officer's activities include accepting complaints and communications from data subjects and receiving communications from the ANPD (Art. 41, § 2).

CD/ANPD Resolution No. 18 of July 16, 2024 detailed this disclosure. According to the ANPD guide on the data protection officer's role (December 2024, pp. 18 to 20):

• The identity is, at minimum, the full name, if the officer is a natural person. If it is a legal entity, the business name or trade name and the full name of the responsible natural person.

• The contact must allow data subjects to exercise their rights and the ANPD to send communications. Email and phone are the most common, but other means work if communication is effective.

• The disclosure must be on the controller's website (Art. 9 of the regulation), kept up to date and in a prominent, easy-to-find place.

• An email such as encarregado@empresa.com.br alone is not enough: in example 7 of the guide, the ANPD says the address is contact information and does not identify the officer.

When the site can go without a data protection officer

CD/ANPD Resolution No. 2 of January 27, 2022 says small processing agents are not required to appoint a data protection officer (Art. 11). This category includes microenterprises, small businesses, startups, private legal entities (including nonprofits), natural persons and unincorporated entities that process data (Art. 2, I).

The waiver has conditions:

• An agent that does not appoint an officer must provide a communication channel for data subjects (Art. 11, § 1). That channel is what goes in the policy in place of the officer.

• The waiver does not apply to agents that carry out high-risk processing, have gross revenue above the limit in Complementary Law No. 123/2006 (or Complementary Law No. 182/2021, for startups) or belong to an economic group whose global revenue exceeds those limits (Art. 3).

• High risk requires at least one general criterion (large scale or processing that may significantly affect rights) and one specific criterion, such as use of emerging technology, solely automated decisions, or sensitive data or data about children, adolescents and older people (Art. 4).

• Appointing an officer even without the obligation counts as a good governance practice (Art. 11, § 2).

Cookies: a section in the policy or a separate policy

The ANPD cookie guide (pp. 28 and 29) recommends a cookie policy with the specific purposes, the retention period and sharing with third parties, and accepts three formats: a section of the privacy policy, a separate page or the banner's own layers. All of them work, as long as the essential information is there.

In example 7 of the guide, an accounting firm puts its cookie policy inside its privacy policy. The ANPD says this is legitimate, preferably with easy access to that section (a tab, a sidebar or a table of contents at the top), but that it may not be enough, because not every visitor opens the policy. So it recommends that the information also appear as soon as the person enters the site, in the second-layer banner. The guide to the LGPD, cookies and consent covers the banner in detail.

Ad pixels, analytics and session recorders send data to third parties and fall under Art. 9, V. The article Pixels and Brazil's LGPD: what data leaves your website shows what each one collects and what needs to be disclosed.

International transfer in the policy

If the site uses vendors abroad and transfers data on the basis of the ANPD standard contractual clauses, CD/ANPD Resolution No. 19/2024 requires publishing on the site a document in Portuguese, in plain language, with the form, duration and purpose of the transfer, destination country, controller identity and contact, shared use, responsibilities and security measures, and data subject rights with an easy-to-reach channel (Art. 17, § 2, of the regulation). This document can be a page of its own or a highlighted part of the privacy policy (§ 3). The same requirement applies to anyone transferring under specific clauses or global corporate rules approved by the ANPD (Art. 32).

How to write it so people read it

The law asks for information that is "clear, precise and easily accessible" (transparency principle, Art. 6, VI). The recommendations below are this article's own, built from that requirement:

1. Start with the survey, not the text. List the site's collection points (forms, sign-up, checkout, newsletter, chat, cookies and scripts) and, for each one, the data, purpose, legal basis, retention period and who receives it.

2. Organize by situation, not by article of law. Sections such as "when you buy", "when you subscribe to the newsletter" and "when you browse the site" are easier to read than a single list of data.

3. State the purpose with a verb and an object. "Send the invoice and the tracking code" informs; "optimize the experience" does not.

4. Give the retention period. When it comes from another law, such as keeping tax documents, say which one. When there is no fixed period, explain the criterion.

5. Name the third parties, or at least the categories with the purpose of each. The data subject has the right to know who the data was shared with (Art. 18, VII).

6. Use short sentences, the second person and Portuguese. Technical terms (cookie, pixel, processor) come with an explanation the first time.

7. Use layers. A summary at the top with the main points and links to the full sections helps people who only want an overview.

8. Make clear how to exercise rights: the channel, what to include in the request and the response time.

Where to put the link

The law speaks of easy access and conspicuous information (Art. 9); it does not say where to put the link. The places below are recommendations, each with its reason:

• The footer of every page. It is where people look, and it meets the easy-access requirement.

• The cookie banner. The ANPD guide recommends an easy-to-reach link on the first layer for data subjects to exercise their rights (p. 31).

• Collection points. Contact, sign-up, newsletter and checkout forms, near the submit button. That is the moment the data is collected.

• A contact or privacy page with the identity and contact details of the data protection officer, or the service channel, in a prominent place, as CD/ANPD Resolution No. 18/2024 requires.

• The app, if there is one: in the settings and on the app store page.

Updates and versioning

The LGPD has two rules about changes. If the purpose, the form and duration, the controller's identity or the shared use changes, the controller informs the data subject, prominently, of the content of the changes; when the basis is consent, the data subject can withdraw it if they disagree (Art. 8, § 6). If the new purpose is incompatible with the original consent, the notice comes before the change (Art. 9, § 2).

Since the controller bears the burden of proving consent (Art. 8, § 2), it makes sense to keep old versions. Practical recommendations:

• An effective date at the top and a short history of what changed in each version.

• Previous versions kept, with the dates they were in force, to know what the person read when they consented.

• Consent records linked to the version of the text and banner in force at the time.

• Reviews triggered by events, not only by the calendar: a new vendor, a new tag or pixel, a new purpose, a change of data protection officer, a change of legal name or CNPJ.

Common mistakes

• A template copied from another site. It lists data the site does not collect and leaves out data it does, cites foreign laws and sometimes carries another company's name. The Art. 9 information has to describe your own processing.

• Missing third parties. The policy mentions "partners" without saying who they are, and leaves out the pixels, analytics, chat or email platform that are on the site.

• No data protection officer and no channel. Only a generic "contact us", or only an email without the officer's identity.

• Generic purposes. "Improve the experience" or "commercial purposes" do not say what each piece of data is for.

• "By continuing to browse, you agree to this policy." Continuing to browse is not consent: the ANPD guide rules out tacit consent and pre-selected options (p. 19).

• Undefined retention periods. For the guide, "indefinite, excessive or disproportionate" retention periods are not compatible with the LGPD (p. 17).

• Text only in another language. The guide lists cookie information only in a foreign language among the practices to avoid (p. 33).

• An outdated policy. A vendor was replaced, a new pixel was installed, and the text is the same as years ago.

When some of this does not apply

• Personal sites with no economic purpose: the LGPD does not apply to processing by a natural person "for exclusively private and non-economic purposes" (Art. 4, I). A blog with ads or product sales already has an economic purpose.

• Foreign sites: the law applies when processing takes place in Brazil, when the offer targets people in Brazil or when the data is collected in Brazil (Art. 3).

• Data about children and adolescents has its own rules (Art. 14) that this article does not cover.

• Small size simplifies obligations, such as the one about the data protection officer, but does not waive Art. 9. CD/ANPD Resolution No. 2/2022 itself says these agents must make the information in Arts. 9 and 18 available (Art. 7).

How to check your site

The free WebVyze cookie consent checker checks whether the page links to the privacy policy and shows the cookies stored before any click, the trackers in the HTML and whether there is a consent tool. Comparing that list with the policy is a quick way to find third parties the text does not mention. The free check looks at privacy and accessibility risks on the home page. The tools do not read or assess the content of the policy and do not replace legal analysis.