Is there an ideal and foolproof Privacy Policy?

This is one of the most difficult questions to answer nowadays. Especially considering all the jurisprudence already established in Europe with the GDPR, the extensive history of cases, and the numerous tips we see in the market. Not to mention the judicial decisions that are already emerging in Brazil with the LGPD.

I'll answer you promptly: No. And I'll help you understand why.

I believe it is possible to develop a line of reasoning that can assist each one of us entrepreneurs, DPOs, lawyers, third-party consultants, etc. Ultimately, everyone can have a clear understanding of how the game works to avoid being caught off guard.

Below is the logic behind a privacy policy and some principles to help you understand the game. Perhaps even assist you in adapting your company and addressing any doubts that may arise along the way.

What makes a privacy policy better or worse?

To be as straightforward as possible: Does it accurately reflect the reality of data usage and flow within the company?

Here is the key to understanding any privacy policy: It must truthfully reflect the motivations and data flow in the company's routines.

Therefore, before we evaluate the quality of a privacy policy, it is essential to understand why it exists and its purpose. Is it becoming clearer?

In a simple and direct manner, I would highlight that a company's privacy policy is:

A public declaration of the objectives, interests, and responsibilities that companies have regarding the use and application of data, especially personal data, for the execution of their business model.

In other words, the guidelines provided in the privacy policy give us a real understanding of how that business operates regarding data usage and the actual commercial and/or legal purposes for which the data is used.

What do I need to know and map out to create my Privacy Policy?

In essence, it is not possible to structure a privacy policy without understanding the foundations of the business. Don't worry, I'm not complicating things for the sake of it, but rather showing you that without this knowledge, even a lawyer charging thousands of dollars per hour won't be able to assist you.

By the way, a good piece of information for you is that the privacy policy does not necessarily need to be written by a lawyer or in "legalese." According to the LGPD, before anything else, it must be clear, educational, and easily readable for the data subject. So, whether it's you, your lawyer, or anyone who understands the processes, purposes, or legislation of your market, it's all good. Prioritize readability, clarity, and the ability for any visitor or customer accessing your platforms to understand and interpret the information.

However, it is worth noting that we recommend at least seeking advice from a lawyer. There are certain criteria and potential complexities in the market that they can assist you with more adeptly. For example, the healthcare industry has specific legislation that already treats patient data differently, and therefore, it may sometimes supersede LGPD requirements.

We are in Brazil, my friend, so, as usual, everything depends on the specific circumstances.

Anyway, let's go through the essential points you need to know to create any privacy policy. Points such as:

1. Corporate structure;

2. Market sector;

3.### Relevant laws governing the activities of players in the market;

4.### Product and/or service portfolio;

5.### Revenue streams and distribution channels;

6.### Basic understanding of the company's organizational structure; (Headquarters and branches, size, number of departments involved, decision-making hierarchy, etc.)

7.### Supply chain;

8.### Sales and after-sales service;

9.### Communication channels; ...

Without this initial detailed understanding, the privacy policy will be incomplete and consequently flawed.

For example, what good does it do if I state that I use data on Facebook, collect addresses, emails, and CPF (Brazilian individual taxpayer registry number) for signing up for my plan and for email marketing, with data disposal in case of opt-out, if there is a legislation in my market that requires me to store this data beyond the data subject's requests?

I believe it is clear now how much information we need to consider. However, this should not discourage you! In fact, it is precisely the knowledge of these processes, or in other words, the understanding of the entire operation, that will give you greater confidence to determine whether the privacy policy is "good" or not. Again, it must reflect the reality and day-to-day operations of the company.

One of the tools/processes that can help you confidently structure the privacy policy is Data Mapping. If you don't have one yet or haven't considered implementing it, I'll summarize it for you in the link below.

Data Mapping: The Life Jacket for LGPD