Cookie Consent, DSAR Management & Policy Generator for LGPD

General Data Protection Law

Proactive management of data privacy compliance to handle challenging LGPD requirements

CPRA

CCPA

GDPR

UCPA

CDPA

CTDPA

CPA

PIPEDA

LGPD

What is the LGPD?

The General Data Protection Law (LGPD) is Brazil’s comprehensive data protection law that governs the collection, use, and processing of personal data. It provides individuals with rights such as access to their personal data, the right to correct inaccurate information, and the right to request the deletion of their data. The LGPD also requires organizations to implement security measures to protect personal data and mandates that they notify authorities and affected individuals in the event of a data breach.

Criteria for LGPD

Applicability: LGPD applies to both public and private organizations that process personal data in Brazil or collect data from individuals located in Brazil.
Geographical Scope: The law covers any processing of personal data collected within Brazil, regardless of where the organization is based.
Target Audience: It applies to companies that offer goods or services to Brazilian residents or process their personal data.
Consent Requirement: Organizations must obtain explicit, informed consent from individuals before collecting or processing their personal data, particularly for sensitive data.
Data Minimization: Personal data collected must be limited to what is necessary for the specified purpose.
Transparency: Organizations must provide clear information to individuals about how their data will be used and who it will be shared with.
Individual Rights: Individuals have rights to access, correct, delete, and transfer their personal data, as well as to object to its processing.
Data Security Measures: Organizations are required to implement appropriate security measures to protect personal data from breaches or unauthorized access.
Breach Notification: Organizations must notify both authorities and affected individuals in case of a data breach.
Accountability: Organizations must appoint a Data Protection Officer (DPO) to oversee compliance with the LGPD and ensure responsible data handling practices.

Cookie Consent under LGPD

Under Brazil’s LGPD, organizations must obtain consent before collecting or processing personal data through cookies. For cookie consent to comply with the LGPD, the following requirements should be met:

Informed Consent: Users must be clearly informed about the use of cookies, what data is being collected, and the purpose of that collection.
Explicit Consent: Consent must be affirmative, meaning users should actively agree (e.g., by clicking “Accept”) before cookies that collect personal data are placed.
Transparent Information: Organizations should provide clear, detailed information in simple language about how cookies are used and how personal data is handled.
Right to Revoke Consent: Individuals must have the ability to easily revoke their consent at any time, typically through cookie settings or management tools.
Purpose Limitation: Cookies should only collect personal data for the specific purposes for which the individual gave consent.

The LGPD emphasizes user control and transparency, ensuring that consent for cookies is freely given, specific, and informed.