One of the biggest dilemmas for those who start studying and understanding the LGPD more deeply is the realization that, as challenging as the compliance process may be, it is only the beginning. Yes, a series of changes and adjustments should now become part of the company's routine. There are several marketing processes involving personal data that you must reconsider now because of the LGPD!

Therefore, compliance with the LGPD goes beyond setting up a cookie banner or updating the privacy policy. Depending on the size of your company, numerous processes need to be reviewed and adjusted to the new realities established by the law.

The bureaucracy may seem extensive and never-ending for companies. However, we always need to put ourselves in the shoes of visitors, data subjects. Remember, both you and I are data subjects before being companies or professionals – we are citizens! The LGPD's priority is precisely to empower data subjects so that they, as individuals, have full rights and access to the necessary information regarding the use of their personal data.

That's why we're here!

Let's be the professionals who see the legislation as a new opportunity to raise the bar, to apply our knowledge with quality and respect to our clients and visitors!

The LGPD has brought new rules, new marketing processes, new positions...

So, how can we not anticipate the new standards and the new quality references that will ultimately be perceived by our clients?

One of the beautiful concepts, such as Privacy by Design (we've already discussed it here on the blog), can and should always be brought to the forefront!

That being said, I want to help you! Below, then:

If by this point it's not already obvious to you, I don't know how else to make clear the risk of this type of sharing. After all, the visitor has provided their personal and sensitive data to the company. They have no way of knowing that you have numerous other people hanging on to your mailing list.

So be very careful with this practice! Especially if there is no confidentiality or liability agreement between the parties involved!

It may be that your business model requires this distribution of data, so reinforce it - clearly, in your policy and terms! Remember, when in doubt, prioritize privacy!

Does this list have consent for Facebook actions? What is the origin of the list? You may have noticed that since GDPR, Facebook has already been questioning advertisers when they upload email lists... I wonder why, right?

Whether you are a marketing department or a third-party agency to the client, always question these lists and avoid extending the channels of direct communication with the customer as much as possible, as it may violate consent and/or the legal basis that supports the use of the data.

Who hasn't thought about "obtaining" a contact list, cast the first stone! Or even, who has never been approached by companies that sell these cold leads!

Lucky are those who generate quality content and transparency to the point where visitors trust the company with their data...

It's no wonder that email marketing tools have numerous warnings to avoid spam. It harms everyone's reputation, and the internet has no patience for spam, agree?

(A practice that may seem innocent but can violate the rights of data subjects)

It may seem innocent, but it's only an appearance! Just like the points above, data subjects have entrusted their data for that exclusive purpose. Any interaction that goes beyond that can directly violate the rights acquired through consent and/or legal basis.

(Access levels for sensitive data - responsibility contract)

Here we enter the realm of management and processes!
Several marketing tools allow us to create hierarchies within their user accounts. This is precisely because each person has their level of activity and responsibilities.

It is a fact that many companies today work with decentralized or even horizontal management. But when things go wrong, who will be held responsible? Avoid problems by reviewing approval levels and access to data according to your team's responsibilities. After all, the actions of one employee affect the entire organization, and this should be considered as a contingency.

(The infamous "flash drive")

This point is quite similar to the previous one bu,t has an even greater detail. Third-party professionals have limited or even extended responsibilities based on their contracts and the criteria they are bound to. So, every time a third party has access to your company's database, what security do you have over that data?

What guarantee does the data subject have when the data is exposed? Yes, it's basic! But there have been many cases of Employee X or Agency Y who deleted everything before leaving or took everything with them. And then? Was there a contract?

This CTA (call-to-action) may seem "cheesy," but it is still widely used, and as they say, "if there's a rule, it's because there's a story behind it," meaning it works.

Be cautious with this kind of approach, especially if your audience is less tech-savvy and unaware of the risks of the internet.

Remember the case of people providing their data on a Facebook post to get a superhero credit card? Well, you don't want your company's reputation to be associated with an opening for scammers.

The LGPD is not only applicable to the online environment.
So, which offline, in-person actions should also be adapted to comply with the guidelines? Do you use registration forms? What is the data collection process in physical environments?

Every company has its own reality, but I have seen companies using "offline" consent forms (actual printed forms) to be attached to visitor registrations! Or even collecting all registrations via tablets, where consent is also recorded in the CRM.

Our radar should be tracking both online and offline! If you bring everything online, for example, through QR codes, you can use the AdOpt cookie banner as your consent tool and also implement tracking tags on the same landing page!

Perhaps this way, you can not only automate the opt-in process but also have authorized remarketing at the same time!

The days when that Excel spread sheet full of emails from the 90s was considered a treasure for a company are gone.

Aside from being a vanity metric, it is also a significant cost within automation tools. Outdated and cold email lists pose a huge risk to the organization today. Avoid it, eliminate all of that, and make an effort to obtain updated consent from your active base as soon as possible!

Don't say I didn't warn you!

Some companies like marketing agencies, have their organizational chart, a source of joy for SDRs when making those old-fashioned cold calls and scheduling appointments for the Field Sales team! #WhoHasNeverDoneThat?

If you're not familiar with it, let me explain!

Many agencies, especially the larger ones in São Paulo/BR, still have the infamous "organizational chart" displayed at the reception.

Accessing this file brings great joy to the sales team because it not only reveals the decision-makers but also provides their contact information!

However, there is also a potential danger lurking here!

If your organizational chart contains not only employees' professional data but also the personal cell phone number of an employee who didn't want to use two phones, for example...

Is this sharing of personal data specified in the employment contract?

It may not be a problem now, but in times of crisis, labor law can utilize all available resources. Why wouldn't it consider this aspect as well?

In the end, our goal has never been to predict doom for companies or to be part of the LGPD's Apocalypse Cavalry. But since we've been in the market for some time, these kinds of issues always catch our attention when we start data mapping and having conversations with colleagues.

Do you remember any other processes that could be included in this list?

Comment below, maybe it will help colleagues in the journey of compliance!