At the beginning of everything are the legal bases of the LGPD, that is, the legal grounds (legitimate reasons) why companies not only can, but must access customer data in order to do their jobs well. 
You might wonder, isn’t selling a product or providing a service a legitimate reason to use customer data? What if I need this information in order to meet the terms of a contract? And in fact, both of these are examples of situations addressed by the legal bases of the LGPD.

These ten legal bases describe the conditions that justify the use of personal data, and they were designed to encompass all of the various hypothetical reasons data usage may be necessary. They are the structural basis that supports the ethical use of data, in order to prevent this same legislation from becoming a subterfuge used to circumvent other equally essential regulations.

Your task as manager or the person in charge of your company's data is to find among these ten the basis that best suits your business model and other governing legislation to which your company is subject. This applies to all possible steps included in data processes within your company, such as:

- Collection,
- Storage,
- Treatment,
- Transference,   
- Sharing of personal data.

Remember, we are talking about the right to privacy in the context of data that not only identifies the citizen, but also assigns them to behavioral and demographic matrices.

According to the LGPD, sensitive personal data include:

_Racial or ethnic origin, religious or philosophical beliefs, political opinions, union membership, genetics, biometrics, and issues about a person's health or sex life._

With that in mind, let's look at the 10 legal bases of the LGPD.

They are:

1. Consent of the data holder.
2. Legitimate interest.
3. Legal obligation.
4. Compliance with public policies.
5. Research bodies.
6. Execution of contracts.
7. Exercise of rights.
8. Protection of life.
9. Guardianship of health.
10. Credit protection.

Before we delve into each of the legal bases, let’s separate “consent” and “legitimate interest” into a category of their own, because despite being the most popular, they are less straightforward than the others and require additional care in their use. The eight bases that follow are clearer and more secure from a legal perspective.

Now, let’s take a closer look at each one:

## 1 – Data Holder's Consent

This is perhaps the most widely known legal basis in the entire market. There are already many sites that have used it to adapt to the LGPD by displaying the well-known warning, “This site uses cookies…” Well, whether in the virtual or offline environment, consent is a very quick way to obtain authorization from customers so that businesses can legally access their data and provide their services.

However, it is worth noting that the law specifies that this consent must be in writing, or by means that demonstrate the unequivocal expression of the holder's will. Therefore, when citizens are asked to give their consent, they must have clarity, ease, and the freedom to do so autonomously.

Precisely here is a feature that differentiates this legal basis from the others: it must be as easy for customers to revoke their consent as it is for them to provide it in the first place. 

Thus, it is important that the collection of consent, or opt-in (in the language of the market) is as agile and easy as revocation, or opt-out. This means that consent should not generate friction in the commercial relationship. Legal experts emphasize that, as a business owner, you should not rely solely on this modality to legitimize your use of data because this form of authorization tends to be fragile.

This is exactly why AdOpt so greatly values the agility, speed, and appearance of its communication, which corresponds with the visual identity of the company in question. When we studied the GDPR and its impact on large publishers (news and content portals) we saw that one of the biggest effects of those huge and unattractive notices (which look like the legal department designed them in Word) was the increase in bounce rate, a digital marketing and UX metric that shows the percentage of visitors that leave your website as soon as they access it.

Imagine yourself in your store watching customers come and go in a matter of seconds, without introducing themselves, asking for a product, or interacting with a salesperson.

This is the in-person analogy for the bounce rate metric. So, think carefully about the cookie notice you place on your site. It can act as a giant barrier for your customers.

Finally, understand that the use of consent in online and offline environments must be integrated with the other steps of data use and processing within your company. Therefore, it’s important to map the flow of data within your company so that you do not miss any blindspots.

## 2 – Legitimate Interest.

This is the second most popular legal basis and perhaps the most widespread because, for many, legitimate interests serve as a lifeline or card up the sleeve if they cannot fit in with the others. This doesn't make it any less important, but it is necessary to emphasize that “legitimate interest” is somewhat subjective when we consider the parties: data owner versus data operator or controller. After all, money talks and commercial interests can speak louder. But not all commercial interests will necessarily constitute a legitimate interest for the use of such data.

Why not? Because this could damage the individual rights of the owner or even another express provision of the LGPD. Article 10 of the LGPD establishes that the legitimate interest of the controller can only serve as a basis for the processing of personal data for legitimate purposes, considered from concrete situations, which include but are not limited to:

### 1) support and promotion of the controller's activities and;

### 2) protection, in relation to the holder, of the regular exercise of their rights or provision of services that benefit them, respecting their legitimate expectations and fundamental rights and freedoms.
Therefore, it’s important to ensure that the use of data is legitimately justified by the provision of the service or sale of the product, without any deviance that could weaken this legal basis under other current legislation.

### 3 – Legal Obligation.

As the LGPD is a fairly recent law, there are many other laws that oblige companies to, for example, collect, process, and share citizens’ personal data for other prior purposes. As such, if your business model, activity, or process is already subject to legislation in force that requires you to collect data, this legislation would be the best justification for its usage.

An example of this would be the personal data that companies must collect from their employees to report to the Ministry of Labour, Social Security, etc. Here, the holders - and in this case also employees, could not oppose their data being shared due to the legal obligation that the company is fulfilling by doing so.
### 4 – Compliance with Public Policies.

This is perhaps one of the biggest benefits that the LGPD has given to data subjects, all of us citizens, and every taxpayer in this country. Governments must also comply with the LGPD, making this one of the biggest - if not the biggest - legal bases of the LGPD.

Today, the government, one of the institutions that benefits most from its citizens' data, including commercially, must also conform with this regulation.

According to article 7, paragraph III of the LGPD, public administration bodies need to comply with the law when processing or sharing personal data for the execution of public policies, contracts, agreements, or similar instruments, without the need for the consent of the holders.

Although there is no need for consent, data owners still have the right to a clear and unambiguous explanation of the purposes for which their data has been collected and the processes to which it is subject. A final note, however, is that public administration is not subject to fines. However, it is still subject to warnings, publication of infractions, and restriction or even deletion of data.

### 5 – Research Bodies.

The LGPD also authorizes scientific researchers and developers to access personal data for the purpose of their studies. It is recommended, however, that this information is always anonymized in order to guarantee the privacy of the holders and to avoid possible leaks. This way the identities of the research subjects are protected, and the researchers themselves can rest assured of the safety of their scientific methods.

### 6 – Execution of Contracts.

Once a contract is signed, the parties have their obligations and rights established therein. Thus, once a data holder has signed such a contract, the legal basis for the proper use of their data has been established. In this case, the owner himself gives his data and legitimizes the legal basis for its use as part of the document. In this sense, the situation is quite similar to that of consent. However, unlike with consent, if the data owner changes their mind, revocation of their permission is not as simple, since the contract has its own force of validity and may include additional legal bindings. 

### 7 – Exercise of Rights.

Another legal purpose for using personal data, by choice of the data controller, is the regular exercise of rights in judicial, administrative, or arbitration proceedings.

This legal basis aims to guarantee the right of one party to produce evidence against another in legal proceedings. This is intended to prevent one party from being able to defensively obstruct the other from accessing and processing data as part of the legal process. 

### 8 – Life Protection.

The use of data is also granted by law in cases that relate to the protection of the life or physical integrity of the data owners, or third parties.

Based on article 11, section II of the LGPD, sensitive data may be processed without providing the consent of the owner if it is essential for the protection of life or the physical safety of these or third parties.
As an example, imagine the work of first responders who bring in unconscious people in emergencies. Once the citizen and their medical records have been identified within a medical or hospital network, their information may be shared among physicians for the sake of the person, without their consent.

### 9 – Guardianship of Health.

As in the previous item, the LGPD also provides a legal basis that authorizes the access and processing of data for the protection of health, as long as it is carried out by a health professional, health services, or a health authority.

This legal basis tends to be widely discussed and put to the test, mainly because of the interest in information that can be used on a public and commercial basis. However, the legislation emphasizes that data sharing cannot be performed in order to harm the owner or gain economic advantage over them.
For example, imagine a scenario where access to some of the owner's health information automatically readjusted their health plan. This would be categorically vetoed by the LGPD. In other words, health plan operators are prohibited from using this data to assess risk or decide whether or not to accept clients.

### 10 – Credit Protection.

The 10th and final legal basis is intended to ensure that in situations of collection or debt incurred, data owners do not use the mechanisms of the LGPD as a loophole to escape their financial obligations.
An example would be if the owner requested that the creditor financial institution delete their data from its database, or even from agencies such as Boa Vista and Serasa, thus circumventing the charge.
This also tends to be a much discussed legal basis given the controversial implications that the context involves.

Legal bases are just the foundation!

Finally, we hope we’ve made these ten legal bases clear enough that you’ll be able to process data within the guidelines of the law.

With this in hand, you’re ready to take the next steps on the path to compliance.

To deepen your understanding, our next chapter is: What is the ideal privacy policy for your company?

Understand the legal bases of the LGPD

João Bruno Soares

## Do you want to understand why there are cookie banners on every website you visit today? This article is for you!

Cookie banners, cookie notices, GDPR notices or Privacy Notices… call them what you want. (We’ve even heard them called “that boring legal notice,” but more on that later.)

In fact, all the world’s largest and most serious companies have already added a cookie banner to their website, and this is for a good reason: GDPR, LGPD, CCPA and many others are live!

Completely inspired by the GDPR ,the LGPD in Brazil, as it’s commonly known, is a regulation that was created in 2018 specifically to address the way that personal data, such as a user’s name, e-mail, telephone number, address, etc.,  is collected and utilized by companies.

## The GDPR, LGPD…CCPA and cookie banners are here to stay!

Why does the GDPR require cookie banners? Does every website now need a banner?

The LGPD, as said, was inspired by the European Union’s General Data Protection Regulation (GDPR), and similar laws are already being enacted all over the world. Even North Korea now has its own privacy regulation! That is to say, this is not a passing trend and must be taken seriously. 

This shift does not necessarily mean more bureaucracy, but it does mean real empowerment. Thanks to these new privacy laws, ordinary citizens now have the right to authorize, deny, or even revoke companies’ ability to use their data!

## You mean I didn’t already have the right to decide what happens with my data?!

Don’t worry, we can explain! 

The answer is not that simple, as this law needs to function in parallel with innumerable others that also govern individual rights, including consumer, health, and internet law, among others. 
Keep going, it will be worth it! Soon you’ll be able to speak like an expert on this subject. 

With the advancement of advertising technologies that are linked to [digital marketing](https://br.sharpspring.com/marketing-digital/) and the exponential growth of social media, everyone now has a machine that generates and stores valuable data in the palm of their hands: cellphones. Every time an individual accesses a website, e-commerce account, Instagram, Facebook, or any similar platform, the visit generates data that is collected and stored by cookies. 

Cookies are simply text files that are capable of storing information generated by websites. 

## Want a practical example of cookie technology? 

I'm sure you know when you enter a website through your browser and it recognizes that you’ve already accessed the page before, allowing you to re-enter the site without signing in again? This happens because your browser has already stored a cookie from that site which can authorize your access. 

In the same way, cookies can also store data like which photos you’ve liked on Instagram or if you “forgot” a product in your shopping cart. All of this information is saved for later use.  

## And this is very valuable! 

Did you know that a person needs, on average, at least six interactions with a product or service before making the decision to purchase? 

It’s no wonder that when you “forget something in your shopping cart,” the product seems to follow you all over the internet with ads. Only then do you end up making the purchase. Is this a coincidence, or magic? 
Neither, these are the processes and technologies that utilize cookies for advertising.

If you’ve been through this, welcome! You’re in good company. 

Simply put, cookies are a piece of the wheel that moves the internet. It’s the use of data for advertising that allows us to consume the content that we love for free. After all, who do you think pays for that cool, free YouTube video? Advertisers! And now you know they use cookies to find you on your favorite channel. 

The use of cookies is not necessarily positive or negative, but it reached a point where individuals like you or I were not fully in control of what the internet giants were doing with our data. This is why privacy laws like the GDPR, LGPD and CCPA were created: to rebalance the relationship between companies and people.   

Ok, but weren’t you going to talk about data, privacy, and the rights I have? 

Yes! When the LGPD was enacted by Brazil in August of 2020 it forced companies to examine the way that they handled the plethora of consumer data generated by their business, and to make changes to their processes and databases. One of these changes was the obligation to inform visitors of the reason for their data collection, as well as the legal basis for it. 

Thus, in accordance with the LGPD, GDPR, CCPA and several others, every business must present a clear and objective communication that informs visitors of their purposes for collecting personal data. Whether on or offline, it is essential that every citizen is notified of the collection of their personal data as well as the many ways it might be used. 

As for us data “subjects,” as some law refers to us, we are now able to make a “free, informed, and unequivocal declaration,” as to whether or not we permit its use. That is to say, if we consent to the terms outlined by the business, we authorize them to use our data. In Brazil, for example if businesses violate this flow by collecting data without consent, they could face serious consequences including being fined up to 2% of their annual revenue, with a ceiling of 50 million real. Has your business ever considered the threat of being fined simply for not having a cookie banner on its website? 

Want to understand exactly how the GDPR, LGPD and CCPA impact your business? Here are some articles on the subject.

## But how do I know what they already do, or will now do with my data? Will the cookie banner tell me? 
Who among us has actually read the privacy policy or terms of use of a website we use? Not many, but it’s precisely in these official documents that these answers are found.

According to the Privacy Laws, businesses must comply with certain official documentation requirements and legal basis to inform users of their entire data collection process and its purposes. Well-known by lawyers, the “Privacy document kit” fulfills the standard that every company must meet, including a privacy policy, terms of use, data mapping, and contact information of the DPO, among others.

## Now the good news! 
These documents don’t need to be written in “legalese,” nor should they be, as LGPD, GDPR and CCPA requires that the information presented be “clear and accessible.” A user cannot consent to the collection of their data if they cannot understand the banner. 

What’s the use of a company acting cool in its marketing and communications, or speaking beautifully in advertisements, if when addressing privacy and transparency it starts speaking in code? It doesn’t make sense, right?

Anyway, this article aims to inform you that, along with the laws like GDPR, LGPD and CCPA, we also have new rights and duties, both as citizens and, especially, as companies. In this matter, the cookie banners actually serve a noble purpose! Businesses that use these banners correctly are able to show customers that they care about their individual rights, freedom of choice, and privacy. 

## A good cookie banner should meet certain minimal requirements outlined by the GDPR, LGPD and CCPA: 

Inform users clearly and objectively of all of the ways in which the company collects consumer data. 
Point to official documents such as the privacy policy, terms of use, etc. (referring back to the Privacy document kit mentioned above). 

List the options that you as the data owner have to fully or partially accept “the rules of the game” with that company, thus allowing you to receive their content or consume their products or services. 

Make it clear where, upon accepting the cookies, you could access the data that the company will gather about you, and how to opt-out if you change your mind. 

Allow users to consent to the data collection in a way that is free, informed, and unambiguous. 

**Last but not least:**

When you see the banner: “If you continue browsing, we understand that you consent…” know that the law has determined this to be insufficient, and there are several arguments why. Mainly, this banner without further detail does not give the visitor enough information to give their consent in a manner that is “free, informed, and unambiguous.”

We hope this article helped you to understand the “why” of the now popular cookie banners, which will soon be installed on all company websites. With this new regulation, there is no going back. 

## We’ll leave you with two final invitations: 

1. Do you know a business that needs to know more about cookie banners?

Again, any and all companies that collect personal data, such as name, email, or telephone number on their site, and use third-party services like the Facebook pixel, Google Analytics, etc. MUST include this banner.

We at AdOpt are experts in cookie banners and can help them today! And even better, for many it’s free! Send this article to whoever you know that could use this content. They will thank you when they avoid an unpleasant fine!

2. Want to dive deeper into the subject of cookie banners?
We’ve got more articles for you [here](https://goadopt.io/blog/significado-da-lgpd/) para você:).



Why are cookie banners everywhere?

It's time to talk about one of the most impactful tasks, both for the company and for the visitors of your websites: tag categorization. But why is it so impactful? What is the relevance of this configuration and how can it affect us? It is precisely because of these common questions we receive from our clients that we have written this article on best practices in tag categorization.

## What is a tag?

To start off on the right foot, let's clarify some basic concepts that will help situate each one of you at AdOpt and in the market as a whole.

In a straightforward manner: **1 Tag = Trigger for 1 or more Cookies.**

What does that mean?

Basically, most Tags or pixels – as they are also known – when installed in the HTML of a website, are responsible for triggering cookies for each visitor on that specific page. A Tag can perform various functions such as tracking button clicks, page scrolling, collecting text fields, always associating these behaviors with that specific visiting browser.

Once this is possible, the way the Tag stores the data generated by the visitor is:

- Sending it to their server (the service provider's server that created the Tag) and;
-It can also record all the information in cookies that it generates and stores on your machine.

For example, when we visit an e-commerce website and it recognizes that we are returning after a previous visit, showing products that are of interest to us, it happens thanks to cookies and tags doing their job. In summary, 1 Tag can trigger N cookies and perform N functions.

Ultimately, the Tag itself is not inherently good or bad; it all depends on its application.

## What is tag categorization?

Categorization involves the work of the Data Protection Officer (DPO) in organizing all the tags installed on the website(s) under their responsibility into specific categories that represent their purpose and reason for being there.

Since GDPR, which was the pioneer in this regard, the market has created "standard categories." These categories are:

- **Essential / Necessary**: Without them, your business model or website does not function, or you are required to use them by law or regulations.

- **Marketing / Advertising**: With them, you can trigger re-marketing, populate ad pixels, automate email sequences, etc.

- **Statistics / Analytics**: With them, you have an analysis of what visitors do, where they come from, and how they behave on your website.

- **Performance**: Tags that maintain website functionality, ensuring its operation and response speed. For example, they can prevent DDoS attacks.

- **Functional**: Tags that handle functional aspects, such as remembering preferences or recognizing that you are already logged into the system, chatbots.

In other words, each company may have a group of tags installed on its website, with their purpose described and detailed in the Privacy Policy (or cookie policy). This purpose should be replicated in communication with visitors - the cookie banners - as well as in all processes that use this data.

## Why categorize tags?

Many companies use cookie banners that do not organize tags or cookies into specific categories, forcing visitors to accept all tags without distinction.

This poses a significant risk of fines for your operation since various regulations require that consent be specific and detailed for a particular purpose. In the LGPD, for example, Article 5, Item XII is clear:

> #info XII - consent: the free, informed, and unequivocal expression by which the data subject agrees to the processing of their personal data for a specific purpose.

This is one of the reasons why AdOpt has always worked with a design that prioritizes freedom for all visitors to navigate through categories and their respective tags.

## How to differentiate the function of each tag?

Certainly, the market already anticipates some purposes and their respective categories. However, it is worth noting that this step often involves areas of the company that go beyond those apparent on the website. A collection made through cookies can be the operational basis for an entire department and all processes within a company.

This means that, although the market already provides a standard for the category of each tag, especially the most popular ones, data controllers must adjust this difference within the company's operation, ensuring the reality of the situation and primarily supporting such choices with the chosen legal bases.

Therefore, even though there is a standard, companies are free to adjust the facts and must be prepared to respond to them with complete clarity to individuals.

That's why at AdOpt, when tags are scanned, some of them already come with a pre-classification. However, this does not prevent the data controller of a specific company from adjusting this categorization according to their Cookie and Privacy Policy.

As a platform, AdOpt cannot enforce a specific configuration or principle. However, it values freedom within its environments so that the responsibilities of the data controller are respected at all times.

## What do privacy regulations say about classifying each type of tag?

Privacy regulations do not delve into this "micro" analysis of tag categories. It would be impractical for national authorities to issue a classification opinion for every new tag that emerges in the market.

Thus, it is up to companies to ensure that communication is clear, objective, and respects the aspects of freedom and purpose already mentioned. Naturally, the market adjusts and creates standards and even specific terms for each of them.

For example, the terms "Essential" or "Necessary" are not determined by law. However, these terms help in quickly understanding their purpose, which is why the market has adopted them. The less confusion in this regard, the better. After all, subjectivity exists in all places and contexts. If we can avoid these points with a certain "standard," we minimize these variables.

## Where to apply and/or replicate this information?

As mentioned earlier, the categorization of tags is an organization that should reflect the operational purpose of using that data. Therefore, before a conceptual application, it should have a practical use that mirrors this classification.

However, it is worth noting that this classification is often explained or expanded upon in official company documents such as the Privacy Policy and Cookie Policy.

In addition, a crucial aspect directly related to tag categorization is the configuration of blocking third-party tags according to the visitor's choice. In other words, the cookie banner only allows a certain tag to be executed after the visitor's consent.

What does that mean?

Each visitor is free to choose whether or not to consent to that group of tags declared by the company. Therefore, their will is respected when cookies are only stored upon "free, informed, and unambiguous" consent (without ambiguity, clear, without equivocation).

**That's why AdOpt advises all users of the tool, without exception, to configure the blocking of third-party tags. Only with this configuration in place will the banner be complete and properly installed.**

Here's a tutorial for configuring the blocking of third-party tags on your website.

## Why do some websites don't block third-party tags?

It is not up to AdOpt to judge why a particular site, and even its clients, have chosen not to implement this configuration, even though it is constantly reinforced in our communication and classified as "essential."

Certainly, such a decision harms the image of both the company and even AdOpt. However, it is important to remember that prior to this setup, each tag has a unique function within each company, in its unique environment and context. Imposing a technological mechanism by AdOpt would go against the freedom of choice for its clients in the interpretation and application of the law that applies to everyone.

Keeping in mind the necessary proportions and equivalences, let's consider an example. It would be like holding vehicle manufacturers responsible for cars that have the capability to exceed the speed limit. The automaker can install alerts, reinforce communication in various ways. But they can never impose that a citizen does not drive according to their freedom of choice.

## Last point, as a golden rule!

**Always align the Actual Use of data with Processes, Documentation, and Communication.**

**Process: **The data collection declared for a specific purpose should indeed have the same destination and use of data within your company.

**Documentation**: Official documents should always be up to date and truly reflect the practices within the company.

**Communication**: The tag classified as Necessary or other classifications should indeed be necessary. The tag should not be classified as "essential" just because visitors cannot block it. This would be an attempt to bypass the freedom of individuals accessing your website.

The same market that creates classification standards for certain tags is also capable of judging the truthfulness of intentions and facts declared by your cookie banner on your website.

Always remember that people come before companies. The LGPD (General Data Protection Law) was created precisely to better balance the relationship between companies and citizens. After all, privacy is a universal right and should not only have value when it is lost.

---

Did you feel that something was missing or need further explanation?
Let us know at [hey@goadopt.io](hey@goadopt.io), and we'll be happy to discuss the topic further with you!


Best practices in tag categorization

While internet cookies, commonly referred to as just "cookies," are widely recognized today, some companies also use Local Storage and Session Storage as other methods used by programmers to store persistent information in a visitor's browser. However, what's the main difference between cookies and local storage, and why choose one over the other? This article will help you with these questions!

As mentioned earlier, [Cookies](https://goadopt.io/blog/en/cookies-and-lgpd/), Local Storage, and Session Storage are methods used through programming languages to store information in a website visitor's browser.

In other words, they store information in your browser about your access and how you navigate the website. Many of these have been used maliciously, even capable of storing all the information entered in text fields in forms, for example.

## Relax, cookies and local storage aren't synonymous with invasion of privacy.

Few people know that cookies were originally developed by hackers to capture people's data on the internet. Later, this technology gained a commercial purpose and is now widely used across the web.

Before you get alarmed or want to reject all internet cookies and storage, remember, they make your life much easier.

Thanks to them, your products stay in the shopping cart when you switch tabs or go back to the store to add more items.

They keep a pre-filled form in case there's a connection glitch, preventing you from starting over.

And they also welcome you by recognizing your previous access, without needing to log in to your account hundreds of times a day.

## What are the Key Differences Between [Cookies](https://goadopt.io/blog/en/cookies-and-lgpd/), Local Storage, and Session Storage?

Now that we've discussed the similarities, let's delve into the differences using three main criteria: **storage capacity, storage location, data persistence, and performance.**

**- Storage Capacity**

This capacity usually varies between browsers. In general, cookies can store up to 4096 bytes or 4KB, while Local Storage can handle 5MB, and Session Storage ranges from 5MB to 10MB.

Moreover, there's a maximum limit on the number of cookies per domain, and it's not recommended to exceed 30 cookies.

Some browsers, such as Opera, will prompt the user to allow more data usage when this limit is reached.

**- Storage Location**

Cookie information is stored in both the browser and the originating server of the referenced service.

Local Storage and Session Storage use only the browser as the storage location for data.

**- Data Persistence**

Data persistence refers to HOW and WHEN the stored information is deleted, erased, or invalidated.

**Cookies**

Cookies have an expiration date, causing the stored information to become invalid and outdated when that date is reached. However, whenever a visitor deletes cookies from a website, that information is also removed from the browser.

Some browsers automatically clear cookies periodically, and you can usually configure this in settings.

[Learn how to clear cookies and browser cache.](https://goadopt.io/en/blog/delete-cookies-cache-chrome/)

Today, due to privacy regulations like LGPD, GDPR, and CCPA, websites using these trackers must inform their visitors of their existence using a cookie banner. This technology, called a [CMP (Consent Management Platform)](https://goadopt.io/blog/en/what-is-a-cmp/), must then block cookies based on user consent.

[To learn all about GDPR, CCPA, and LGPD, we have this article for you.](https://goadopt.io/blog/en/lgpd-general-data-protection-law/)

**Local Storage**

Local Storage has no expiration date, so the information persists in the browser until the user performs a cleanup and deletion. Additionally, there are fewer browsers that offer features to block or periodically delete Local Storage data.

Regarding privacy regulations, especially [GDPR](https://goadopt.io/), the same obligation to inform its usage applies to Local Storage. Therefore, when choosing your cookie banner, ensure that it also lists third-party tracker Local Storage used on your site.

To learn more about [how a CMP works](https://goadopt.io/blog/en/what-is-a-cmp/), here's an article to help you understand.

**Session Storage**

In Local Storage, information remains stored until a deletion is performed. However, in Session Storage, the information is automatically deleted whenever the visitor leaves the site or closes the browser tab.

This is the main difference between Local and Session Storage.

**- Performance**

To analyze performance between web storage (Local and Session) and cookies, a highly technical language would be necessary. However, let's try to simplify the facts.

Every website has a visually coded part connected to a server. The server keeps the site online, and when someone accesses that URL, it operates those visual settings and responds to interactions on the screen.

This interaction is performed by the [browser (Chrome, Safari, Opera, Brave...)](https://goadopt.io/en/blog/delete-cookies-cache-chrome/)

If your browser has cookies from that site, in addition to communicating with the site's server, it must also await the server's reading of those cookies and their respective servers. This is because there may be cookies from that specific site and cookies from third-party companies installed.

Therefore, when using cookies, all requests you make to the site also depend on sending cookie information to your origin server and then to the site. Hence, simply using a cookie in your application consumes a bit more "bandwidth" and "data" to read and execute it on the site, and present it in the browser.

**In contrast, Local and Session Storage do not require this triangulation between servers, resulting in less bandwidth needed for the site to respond to the information contained in web storage.**

## How to Create a Consent Strategy as the [Legal Basis for LGPD](https://goadopt.io/blog/en/legal-bases-of-lgpd/)?

Want to learn more about [how a LGPD cookie banner works](https://goadopt.io/blog/en/operation-of-cookie-banner/)? In this link, I explain the step-by-step of the technology developed by [AdOpt](https://goadopt.io/blog/en/why-the-cookie-banner/) and used on thousands of websites.

After all, if your site uses cookies, you can't simply [ignore LGPD](https://goadopt.io/blog/en/ignoring-lgpd/). You need to choose a strategy to avoid the [fines](https://goadopt.io/blog/en/fines-in-lgpd/) associated with this new legislation.


What is the difference between cookies, local storage, and session storage?

A privacy policy is a document that outlines how an organization collects, uses, discloses, and manages a customer's data. It's essential for building trust with users and complying with legal requirements.

While it's not exactly breaking news, discussions about privacy policies have been popping up more frequently since the start of GDPR (General Data Protection Regulation) in Europe in 2018. And despite it seeming coincidental, it's not!
After all, this term is directly linked to several other regulations that came into effect since then. However, if you're not familiar with it, don't worry as we're here to help you.

Below, you'll find everything about this type of policy, how it works, and its importance. Also, take the opportunity to learn how to develop one for your company and thus, comply with the legislation that's already in effect in your country or even, state.
## Why is a Privacy Policy Important?

Privacy policies are crucial for compliance with various global privacy laws, such as [GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/), [CCPA](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) (California Consumer Privacy Act), and [LGPD](https://goadopt.io/en/blog/anpd-cookies-guidance-personal-data-protection-lgpd/) (Brazilian General Data Protection Law). 
They help protect consumer data and ensure transparency in data handling practices. By clearly explaining how your company manages data, you can foster trust and demonstrate your commitment to privacy.

It's time for you to understand once and for all what these terms are and why you shouldn't ignore them when visiting a website! After all, your security and your data's security are at stake. Want to understand how? Read on!

### Applications of a Privacy Policy

Privacy policies apply to the online and offline environment and concern the protection of your data. In general terms, they correspond to a company's statement regarding how it handles your information, and now, with all these new regulations blooming, specifically, your personal data.

But how is that so? Well, your online and offline activities leave traces… You fill up forms to win "free gifts"on hotels and restaurants, subscribing to newsletters; sounds familiar?

That is all personal data that stores, websites and social networks store, generating information about you. Similarly, these are recorded by CRM systems, or mostly in your browser. However, this can't happen inadvertently because merely "browsing these environments" already generates data and, consequently, personalized data collection.

In other words, the legislation protects us citizens from companies simply collecting information and using it as they see fit. Of course that the online environment favors its applications, but, nonetheless all data collection must be considered.

This, in fact, is the focus of all regulations like [GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/), [TDPSA](https://goadopt.io/en/blog/texas-tdpsa-and-cookies-all-you-need-to-know/), CCPA, LGPD. This makes it even more evident that a website should have an easily accessible privacy policy that formally organizes this information.

First and foremost, data collection can only occur with the user's explicit authorization. Whether through express consent or other [Legal Basis](https://goadopt.io/en/blog/gdpr-legal-basis/) that support data collection by the company. Therefore, you are a key player in determining what information can be collected, stored, and eventually be used.

># Here's a significant gain provided by Privacy Regulations for all citizens - the power to exercise their rights of access or restriction to anything related to their personal data. Citizens can now actively participate in the decision, freely and protected by the law.

However, it doesn't stop there!

According to most laws, companies are not only responsible for collecting data within the visitors' will when they visit their websites, installations or networks.

They must also clearly demonstrate how they store and for what purposes they use such data. After all, they belong to someone! Their use must align precisely with their intended purpose, ensuring that the information is not misused or leaked, which could lead to serious problems.


## Privacy Policy and cookies, are they related?

Before we dive into how this policy affects you and how to write a good one, let's clarify something. Many people confuse cookies and such policies. Although they are closely related, they are not synonyms.

Remember the data we mentioned earlier, the focus of the privacy policy? Well, some of it is collected through cookies! After all, the website needs to know which data you've given permission to access. Similarly, it needs to know what "marks" it can leave in your browser.

These data are usually collected for commercial or digital marketing purposes, i.e., for promoting products and services online. However, they also often contribute to navigation and the visitor's experience.

But how does this work? You've probably visited websites where you're already registered, and when you do, you see your login and password automatically filled in. This is nothing more than the action of these "marks" on your browser.

The same thing happens when you look at a product, think about it, and leave it in your online cart. It probably kept following you after that, right? Whether through advertisements on social networks or on websites, it surely didn't stop appearing.

Again, we have the action of cookies, which provide access information to web pages. Therefore, as they relate to personal data, Privacy Regulations care about them.

So, where does the privacy policy come in? Well, it's precisely the information that the website provides to the visitor about how it handles data, how it stores and secures it, and its intended use. Both for data that enables direct identification - i.e., data that directly identifies the individual (Name, Email, ID, Tax ID, etc.), and indirect data that, when combined, can lead to an individual (IP, Address, Position, Profession, etc.).

**In other words, the policy acts like a code of conduct.**

It's important because it's a public commitment by the website to the visitor. By having it, the site assumes a responsibility that must be strictly followed.


## Key Elements of a Privacy Policy

Now that we know more about privacy policies, data collection, cookies, and how regulations has made them so important, the question arises: how to create a high-quality policy? This is a crucial issue if you have a website, regardless of its purpose.

### Use simple and clear terms
First and foremost, it's crucial that the terms are clear. Avoid using legal jargon and opt for simple language. This ensures that users can easily understand how the website handles their data and reduces the likelihood of them being overlooked.

Leaving no room for doubts or suspicions is crucial and also helps in building the page's image. So, remember to adopt a simple and very clear language.

### Types of Data Collected
Your privacy policy should clearly list the types of data your organization collects. This includes:

- **Personal Information**: This can be anything from names and dates of birth to location data. It's the kind of data that can identify an individual.

- **Technical Data**: Information like IP addresses, browser types, and device details fall into this category. These are used to improve user experience and ensure site functionality.

>#tip Always check your local official regulatory documents. and look for their definition of Personal Data and mainly the Sensitive Data. It should not vary from country to country, state to state, but it is always good to have it double-checked. Because, you may find different guidelines for specific cases and market applications.

__________________________________________
Interested in learning how AdOpt can help your business' privacy policy? [Schedule a demo](https://calendly.com/valquiriaadopt/englishmeeting) with our specialist today!

### Methods of Data Collection
Explain how you collect data from your users. Common methods include:

- **User Entries**: Data provided directly by users, such as filling out forms or creating accounts.
- **[Cookies](https://goadopt.io/en/blog/gdpr-cookies-explained/) and other Tracking Technologies**: These are small files stored on users' devices that track their activity on your site. They help in personalizing user experience and improving website functionality. (LocalStorage also counts as a tracker…)

### Purpose of Data Usage
It's important to be transparent about why you're collecting data. Typical purposes include:

- **Marketing**: Using data to create personalized ads or email campaigns.
- **Service Functionality / Performance**: Enhancing user experience by remembering preferences and login details.
- **Analytics**: Understanding user behavior to improve site performance and content.

Ps.: Once you have a Cookie Banner with all your tags/cookies correctly categorized, you should reply the same categorization scheme from the policy to the banner.

### Data Sharing Practices
Detailing your data sharing practices helps users understand who else might have access to their data. This includes:

- **Third-Party Partners**: Data shared with advertising networks or analytics providers.

- **Service Providers**: Companies that host your website or provide customer support services.

Ps.: Some companies create a separated document with all third-party Sub-processors that may interact with user data. [Here is AdOpt's](https://goadopt.io/en/support/faq/other/adopt-sub-processors/), to help you understand this stage.

### Data Protection Measures
Assure your users that their data is safe by explaining your security measures. This can involve:

- **Storage Locations**: Where and how data is stored, such as in secure data centers or cloud services.

- **Security Protocols**: Measures like encryption and access controls to protect data from unauthorized access.

### User Rights and Opt-Out Options

Every regulation determines guidelines for DSARs or DSRs which stands for Data Subject Access Request, or simply Data Subject Request. So, make sure you always check your local official regulatory documents! Look for their definition and guidelines for User Rights. 

Mainly because they may vary depending on how the request is made, the mandatory time to respond depending on the company size, parallel regulations, etc. In short, all DSRs can be compiled into two main categories: 

Data Opt-Out / Deletion 
Data Access / Download.

For both of these cases you need to give Instructions on how users can ask for their data to be deleted. And, if needed, the steps for opting out of [cookies](https://goadopt.io/en/blog/why-are-cookie-banners-everywhere/) and other tracking technologies.


### Effective Date and Updates
Your privacy policy should include:

- **Effective Date**: When the policy takes effect.
- **Policy Updates**: How users will be informed about any changes to the policy.

This is important because it will guide the way a company may change certain data processing over time.

For example, if you gave consent to a policy, prior to a major change, like a new advertising provider selected to run the ads and marketing. Do you agree that you shouldn't receive any ad from this company?  Therefore, the company's campaign public should have a segregation, actionable data collected "prior to" and "after" the change date.

### Provide complete and informative information

Another essential aspect when developing a privacy policy is to provide complete information. In other words, don't leave anything out and provide a full understanding of what's being done with the data and how it's being handled.

Among the essential pieces of information are:

- Information about the company behind the website;
- Data collection sources;
- Data usage (purpose);
- Cookie policies;
- Information about visitor's rights;
- Storage duration.

You might wonder, with the list above, how do I identify all this? Where do I start? The simplest answer would be to understand that the Privacy Policy is the result of a series of other readings and data mappings you should go through to write it more securely.

[Data Mapping or Data Inventory, the DPO's Lifesaver](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/)

[Is there and Ideal Privacy Policy for Your Company?](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/)


## How to Create a Privacy Policy
Creating a comprehensive privacy policy can be daunting, but there are tools to help:

- **Templates and Generators**: Many online tools can help you draft a privacy policy. But, please make sure you can edit the final text with a more concise and tailored version reflecting your business details. 

- **Legal Consultation**: It's wise to consult with legal experts to ensure your policy complies with all relevant laws.

- **Customizing for Specific Needs**: Tailoring the policy to fit your business practices and specific data handling processes.

- **Keep it updated**:  A Privacy Policy must evolve with the business so that it reflects all process changes and needs.

## Common Privacy Policy Mistakes to Avoid
To maintain compliance and build user trust, avoid these common pitfalls:

- **Vague Descriptions**: Be clear and transparent about your data practices.

- **Ignoring Updates**: Regularly update your policy to reflect any changes in data handling.

- **Non-Compliance**: Ensure your policy meets all legal requirements and industry standards.

- **Legalese**: Ensure your policy is written using simple terms in order to increase acceptance and comprehension.


## Privacy Policy Jurisdictions and Enforcement
Understanding the legal landscape for privacy policies is essential as it varies across different regions. Here's a breakdown of key jurisdictions and their enforcement:

### United States
In the United States, privacy regulations can be complex due to the mix of federal and state laws:

- **Federal Laws**: The Health Insurance Portability and Accountability Act (HIPAA) protects medical information, while the Children's Online Privacy Protection Act (COPPA) safeguards the privacy of children under 13.

- **State Laws**: States like California have implemented robust privacy laws such as the California Consumer Privacy Act (CCPA). Other states have their own specific regulations that businesses must comply with, making it essential to be aware of the laws relevant to each state where you operate.

In the articles below we can help you understand some of the new local state regulations.

- [Texas TDPSA: All you need to know.](https://goadopt.io/en/blog/texas-tdpsa-and-cookies-all-you-need-to-know/)
- Florida
- Colorado
- Oregon

### European Union
The European Union has some of the strictest data protection regulations in the world:

- **[GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/)**: The General Data Protection Regulation (GDPR) applies to all EU citizens and imposes stringent requirements on how businesses collect, store, and manage personal data. It mandates transparency, user consent, and gives individuals significant control over their personal information. Non-compliance can result in heavy fines.

### Other Regions
Countries outside the US and EU also have their own privacy laws that businesses need to be aware of:

- **Australia, Canada, India**: Each of these countries has established privacy regulations that require organizations to handle personal data responsibly. For instance, Australia has the Privacy Act, Canada has PIPEDA (Personal Information Protection and Electronic Documents Act), and India is working on its own data protection bill. Staying informed about these laws ensures global compliance and fosters trust with users from these regions.

### Schedule a Demo

Interested in learning how AdOpt can help your business' privacy policy? [Schedule a demo](https://calendly.com/valquiriaadopt/englishmeeting) with our specialist today!

## FAQ: What is a Privacy Policy?

### What is privacy in simple words?
Privacy, simply put, is the right to be left alone or free from intrusion. Specifically, information privacy entails having some control over how your personal information is collected and used.

### What is the standard privacy policy?
A standard privacy policy is a document that outlines how your website collects, uses, shares, and protects personal information. It must adhere to specific legal requirements depending on applicable laws.

### How to create a privacy policy?
Creating a privacy policy involves drafting it in clear, understandable language. Regular updates to reflect legal changes, business modifications, or protocol adjustments are essential. Users should be informed of updates, including an effective date with the policy.

### What is the GDPR privacy policy?
Under the GDPR, data processing must adhere to principles of fairness, accountability, and specific purposes outlined in your privacy policy. Only necessary data should be collected, and transparency is paramount.

### What do you write in a privacy policy?
A comprehensive privacy notice should include your contact details, types of collected personal data, sources of data, purposes of data usage, lawful basis, data sharing practices, data retention duration, and disposal methods.

### Can I write my own privacy policy?
Yes, you can craft your own privacy policy using templates. Legal expertise isn't mandatory, but ensuring all necessary clauses regarding data handling are included is crucial.

### How do you manage privacy policy?
Practical tips include designing products/services to minimize privacy risks, publicly sharing a privacy policy, collecting de-identified data where possible, obtaining consent for new data uses, and facilitating easy contact for privacy inquiries.

### How to improve privacy policy?
To enhance your privacy policy, make it business-centric, specific, and meaningful. Address more than just cookies, provide privacy choices, facilitate access, update information regularly, ensure ease of contact, and use plain language for clarity.

### What is this privacy policy?
A privacy policy elucidates how personal information collected through mobile apps or websites will be used. It serves as a legal document, sometimes called a privacy statement or notice, safeguarding both company and consumer interests.

### What happens if you don't have a privacy policy?
Companies without a privacy policy risk fines from government agencies and potential lawsuits from customers feeling their privacy have been violated.

### What is the ISO for privacy?
ISO/IEC 27701 provides a framework for managing data privacy, also known as a privacy information management system. It ensures compliance with privacy standards.

### What is the privacy policy specification?
A privacy policy outlines how a company processes and safeguards personal data collected. It should include clauses on data collection, processing, and protection measures.

### What are the 7 main principles of GDPR?
The seven main principles of GDPR are: Lawfulness, fairness, and transparency; Purpose limitation; Data minimization; Accuracy; Storage limitation; Integrity and confidentiality; and Accountability.

### What is the difference between GDPR and privacy?
Unlike the GDPR, other privacy laws may not include provisions for sensitive data, pseudonymized data, automated processing, or clear definitions of data processing types falling under their scope.


What is a privacy policy?

Terms of use are an essential part of many websites, especially regarding [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/). Despite being frequently overlooked, Terms of Use are, quite literally, the contract established between you and the company offering that product or service in a digital manner. Therefore, not only their development but also any eventual changes require careful consideration.

This care pertains to both the situations in which such changes can or should be applied and the manner of alteration and its consequences. In the following text, you'll find an explanation of how each of these aspects works and how to ensure the validity of your terms, as well as compliance with [LGPD, GDPR, CCPA, PIPEDA, POPIA](https://goadopt.io), among others.

## What Are the Key Topics Addressed in Terms of Use?

Before delving into why and how to make changes to the Terms of Use, let's first briefly review some of the main chapters/topics typically found in any standard document.

Based on AdOpt's own [Terms of Use](https://goadopt.io/blog/en/terms-of-use-lgpd/), the text is divided as follows:

**1. Object**

**2. Features**

**3. Contracting and Service Provision**

**4. Term**

**5. Remuneration**

**6. Service Interruption**

**7. Responsibilities**

**8. Processing of Personal Data**

Here's a brief summary of what each section covers:

1. **Object**: Identification of the involved parties and detailed description of the services provided, including their characteristics and operational definitions.

2. **Features**: In the case of software like AdOpt's, this section lists the features involved and provides detailed information within the plans.

3. **Contracting and Service Provision**: Description of the processes and necessary details for service contracting.

4. **Term**: Delivery frequency and/or product/service availability after/during purchase.

5. **Remuneration**: Explanation of how payments will be made, including pricing, payment deadlines, and conditions.

6. **Service Interruption**: Explanation of situations where service interruption is prescribed, necessary, and justified, as well as the events that may lead to interruption.

7. **Responsibilities**: Clarification of the responsibilities of both parties upon accepting the terms. On one side, the provider commits to providing the service, and the customer commits to making payments and using the system/platform as necessary for service delivery.

8. **Processing of Personal Data**: Definition of the roles of [data controller vs. data processor](https://goadopt.io/blog/en/differences-operator-controller-of-data-lgpd/) within the processes established by the contract. If data is collected, the legal basis used is specified, along with the responsibilities arising from the operation.

9. **General Provisions**: Declarations that position the contract geographically, establish conditions for possible updates, provide guidance in case one of the parties breaches the contract, and specify the jurisdiction.

## Why Change the Terms of Use?

Changes to these documents, although often overlooked, are necessary whenever there is a significant alteration in the content description. Aspects such as the nature of the service or product delivered by the company, conditions of public service, official data, and now, mandatory aspects under LGPD, all necessitate changes.

Both [LGPD (General Data Protection Law)](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) and other applicable regulations specify aspects related to data collection, processing, and treatment that may be part of the service or product and, therefore, must be included in the terms of use.

Furthermore, changes are often required to align the content of the terms of use with the reality of the brand. After all, these terms should reflect the company's actual situation and not be a work of fiction.

Otherwise, there's a risk of non-compatibility between the website's terms of use and its reality, services, rules, and regulations that apply to it. In essence, it renders the terms useless.

Aspects of our lives are constantly changing, and this is also true when it comes to brands, how they operate, and the rules they are subject to.

Since the terms of use relate to these matters, any changes in them should also reflect on them to ensure they remain valid and relevant, fulfilling their role in relation to the brand.

## When Is It Necessary to Change the Terms of Use?

In general terms, changes should be made whenever one of these aspects is identified:
- Alteration in the site's mode of operation.
- Addition or modification of available services and products.
- Legal changes affecting the rules a site can apply, as well as the duties and rights it imposes.
- Inadequacy between the terms and the reality of the brand (such as its characteristics, offerings, and operations), or between the terms and current laws (such as LGPD or the Consumer Code, for example).

Therefore, there are various reasons that can lead to changes in the terms of use. All of them are relevant, especially to maintain the validity of this document and its applicability.

## Do I Need Authorization to Change the Terms of Use?

Yes! The terms are among the documents that clarify to the public what the rules are in that space, meaning on the website.

They join the [privacy policy](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/) and the cookie notice to promote transparency with the user. While the terms indicate the applicable rules, rights, and duties, the policy pertains to privacy and data usage, which cookies are also part of.

All these documents are important because they assist in complying with LGPD regulations. Transparency is at its core.

Therefore, it wouldn't make sense for changes to the terms of use to occur without the consent of the user, right? It's not necessarily about authorization; after all, it's up to the user to decide whether to accept the terms, thereby maintaining access to the site's services and making their information available or to forfeit this and withdraw their consent.

In conclusion: whenever there are changes in rules and policies that affect users and data subjects, they must be notified to express their acceptance or rejection of the new rules and guidelines.

That's why changes are always announced for a future date, giving users ample time to read and understand the changes.

## My terms of use include a clause indicating the possibility of changing them, do I still need to notify users?

Once again, the answer is yes. Despite many terms and policies including the possibility of changes, it's not a good idea to change them without any notification and obtaining the consent of the data subject.

After all, this would be a unilateral change. Since terms of use function as an online contract, this isn't a favorable decision and can be seen as abusive. Likewise, it goes against LGPD, where transparency and consent are essential.

## How to Notify Your Users of Changes to the Terms of Use?

It's essential that you inform your users and customers of changes to your privacy policies and terms. Here are some tips on how to do it effectively.

## Notification by Message

One of the ways to notify your users of changes to the terms of use on your website is through message notifications. In this case, you can opt for email or other communication methods provided by the data subject (SMS, etc.).

In this scenario, inform users about the changes and provide access to the new terms. Similarly, ensure that when users access the document, they have the opportunity to indicate whether they accept these changes (in the famous "I declare that I have read and accept the terms of use" checkbox).

Additionally, make sure that this type of consent for changes is identifiable and properly archived as evidence.

## Notification upon Website Access

Another option is to have a banner that indicates changes to the terms of use appear as soon as the user accesses your website. In this scenario, it's advisable to prevent the user from navigating the page until they have read and agreed (or disagreed) with the new terms.

This practice is typically used when the new terms are already in effect, as it can have a more significant impact on the user experience. However, it's essential for both scenarios.

## Beware! Silence Does Not Imply Consent

Lastly, our final tip when changing the terms of use is to be careful regarding silence. Unlike what we often assume, silence does not imply consent. It's essential to obtain explicit consent from the data subject regarding changes to the terms.

## Help the Visitor Read the New Terms of Use!

Not all of your visitors, if not the minority, have the patience and interest to read your Terms of Use. Yes, this is concerning given its importance, but it's a fact we observe daily.

So, since you'll already have to notify users of changes, a good practice is to highlight the main changes and how they might affect the user so they can quickly grasp the key points, accelerating their understanding and, consequently, the collection of their acceptance of the terms.

So, since you'll already have to notify users of changes, a good practice is to highlight the main changes and how they might affect the user so they can quickly grasp the key points, accelerating their understanding and, consequently, the collection of their acceptance of the terms.

Do you have any questions or work as a [Data Protection Officer](https://goadopt.io/blog/en/responsibilities-of-a-data-protection-officer/) and can contribute with these tips?

Please let us know how we can improve; we're always open to feedback!

Tips on how to notify users after a change on the Terms of Use.

ROPA in LGPD? Get to Know the Records of Processing Activities

The [LGPD - General Data Protection Law](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) brought with it several acronyms and specific terms. Many of them imported from other countries and legislations. One of them is ROPA (Record Of Processing Activities), adapted in Brazil to _Registros das Atividades de Tratamento_. An essential document for any DPO, Data Processor.

If you work in the field or are in the process of adapting your company, this article was made to help you better understand this document.

ROPA (_Record Of Processing Activities_), is nothing more than a document that organizes the company's official records about:
- **How data collection is done**, its processes, and activities;
- **What is done with the data**, if there is any processing or sharing;
- **How data is deleted**, if applicable.

In other words, the essential questions and answers in case of consultation by the ANPD - National Data Protection Authority, to your company. Below, we'll discuss each of these points in more detail.

It's worth noting that all documents and processes mapped by the company's Data Processor are "living," constantly being updated and changed. A new process created in department X can change the ROPA, the [Privacy Policy](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/), and many other controls.

So, regardless of the size of your company, documents should always reflect reality and be constantly updated.

Smaller companies may not feel the need or complexity of keeping these "Mapping of flows" updated, after all, everything is smaller and involves fewer people. Now, for a larger company, there are already software solutions that help with this control in a more automated way, such as [LGPDNOW](http://lgpdnow.com.br/), for example.

## What is ROPA?

ROPA (_Record Of Processing Activities_), translated by the Brazilian market to Records of Processing Activities, is an official document of companies, generated by a system or not, that records all flows, processing, and activities involving personal data.

In it, mainly list all the purposes and reasons why the company needs that data(s) for its operation, legal basis ([Legal Basis](https://goadopt.io/blog/en/legal-bases-of-lgpd/)), security criteria, data storage/retention period.

## Is ROPA the Same as Data Mapping?

The easy answer is: _it depends_.

[Data Mapping or Data Inventory](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/) functions as a visual map of the flow of personal data within the Data Controller, bringing much more than ROPA, such as system and international transfer maps, ISO compliance parameters, NIST, among others.

On the other hand, ROPA focuses on activities involving data processing. In a more structured company, it may happen that a Data Mapping contains some ROPAs as part of it.

In any case, recording activities is an essential part of both documents. The perspective and methodology applied in each can be their differential.

## What Should a ROPA Include?

According to the [ICO (Information Commissioner’s Office), a ROPA must include at least:](https://ico.org.uk/for-organisations/accountability-framework/records-of-processing-and-lawful-basis/#requirements)

- Name and contact details of your organization, whether it's a controller or a processor (and where applicable, the joint controller, its representative, and the DPO);
- The purposes of processing;
- A description of the categories of individuals and personal data;
- Categories of recipients of personal data;
- Details of transfers to third countries, including a record of the safeguards in place for the transfer mechanism;
- Retention/storage times;
- A description of the technical and organizational security measures in place.
- If you have an internal record of all processing activities carried out by any processor on behalf of your organization.

**### Questions the ROPA Should Answer:**

- Have you considered the effectiveness of your accountability measures?
- Would staff say you have effective processes to keep the record up-to-date, accurate, and ensure data is minimized?
- Could staff explain their responsibilities and how they carry them out in practice?

## Best Practices for a Good ROPA.

Also, according to the [ICO (Information Commissioner’s Office)](https://ico.org.uk/for-organisations/accountability-framework/records-of-processing-and-lawful-basis/#requirements), ROPA also includes or links to documentation covering:

- Information needed for privacy banners, such as the legal basis for processing and the source of personal data;
- Consent records;
- Controller-processor contracts;
- The location of personal data;
- DPIA reports;
- Records of personal data breaches;
- Information needed for processing special category data or criminal conviction and offense data under the Data Protection Act 2018 (DPA 2018); and
- Retention and deletion policy documents.

**Questioning for the creation of your ROPA:**

- Have you considered the effectiveness of your accountability measures?
- Do staff understand how to access other relevant documents linked to the ROPA?
- Is it easy for staff to access relevant documentation from the ROPA?
- Could staff explain this process and how it impacts their role?

## How to Create a ROPA for LGPD?

A good example for those starting out or with a smaller company is to use spreadsheets for this control and organization.

In addition, on the [gov.br website, there are various guides and templates to help you comply with LGPD.](https://www.gov.br/governodigital/pt-br/seguranca-e-protecao-de-dados/guias-operacionais-para-adequacao-a-lei-geral-de-protecao-de-dados-pessoais-lgpd)

For larger companies that need to structure these processes better, a privacy management and data mapping platform can be very helpful!

That's why we recommend that you schedule a meeting with the [LGPDNOW](http://lgpdnow.com.br/) team for a no-obligation conversation to see how they can help you develop your ROPA for LGPD.

Templates and models imported from other companies can be very helpful. But it's essential that you can clearly and objectively translate the reality of your company.

Every time we are faced with the complexity of justifying and basing the collection of data, we should always prioritize privacy throughout all processes, as taught by [Privacy by Design](https://goadopt.io/blog/en/what-is-privacy-by-design/).

## How Can AdOpt Help with ROPA?

According to the recommendations of the ICO listed above, AdOpt's LGPD Platform helps you map and organize:

- [Cookie Banner](https://goadopt.io/blog/en/cookie-banner/) within ICO, LGPD, GDPR, CCPA standards.
- Records of all written consents; (organized by user with date, time, and details of each consent.)
- API Integration with your other platforms to enrich the collected data with the consent information recorded.
- And more, depending on the size of your company.

We're here to help!

So, in this [link](https://calendly.com/valquiriaadopt), our calendar is open to discuss your business's adaptation challenges.

ROPA in LGPD? Get to Know the Records of Processing Activities.

How does your website handle privacy regulations like [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/), CCPA, GDPR...?

What strategies does it use to comply with the any of them?
Have you thought about using a [cookie banner](https://goadopt.io/blog/en/why-the-cookie-banner/) but don't know if your site has [cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/) or if it's enough? If you can't answer these questions, be cautious! Your page may be exposed to fines and other sanctions.

Below, check out 5 signs that indicate your strategies either don't exist or aren't working as they should. So keep reading to ensure the necessary compliance of your site with the principles of the law that regulates data consent.

## 5 Signs You Need a Cookie Consent Strategy Right Now

Check out the top 5 signs that your website isn't in compliance with privacy regulations and then see how to start your adjustment!

## 1 - You Have No Control Over the Data You Collect and Use
This is an undeniable sign that you need to reconsider how you view LGPD, GDPR, CCPA, etc. After all, it regulates the use of third-party data.

It requires respect for user privacy and their consent. Therefore, data usage should always be informed. Not only that, but also the purposes to which it is directed, the way it is stored, and the period of use.

So, consider that if you don't know what data you collect, how will you inform the visitor? Furthermore, how will you ensure that the use of this information complies with the limits imposed by the data subject?

These are important questions that indicate that something is not right on your website regarding privacy and its requirements.

LPs created without control, rich content available for download without accepting terms and policies, mailing lists being shared and passed from campaign to campaign... Be cautious!

I've separated this article for you, in case this is your situation:

[Understand the meaning of LGPD for your company.](https://goadopt.io/blog/en/lgpd-meaning/)

## 2 - There's No Information About the Use of Cookies

Cookies are another type of data that, in principle, should be informed by websites to their visitors. After all, they also capture information about these data subjects and, therefore, fall within the concept of data usage that any privacy regulation addresses.

The use of cookies is almost natural for most websites, especially if they come from e-commerce platforms, for example.

_### To check if your site triggers cookies, access it from a computer and - in Google Chrome, click on the padlock just to the left of the address. It should show exactly which ones and how many there are._

However, many pages fail to see cookies for what they really are: data files and personal information. Therefore, the absence of this communication to your site's visitors is dangerous as it can be a violation of the law.

In fact, not just that, but the collection of them without prior consent is also a violation. You know that "We use Cookies" pop-up? Well, it's not there for no reason.

It's a way to comply with GDPR, CCPA,LGPD... as it informs the use of this type of file while capturing authorization to use them.

- In this article, I help you understand more about [consent as a Legal Basis.](https://goadopt.io/blog/en/legal-bases-of-lgpd/)
- In this one, [how to choose an appropriate CMP - Consent Management Platform for your website.](https://goadopt.io/blog/en/how-to-choose-cmp-consent-management-platform/)

## 3 - Generic Privacy Policy and Terms of Use

Your site probably has documents such as Privacy Policy and Terms of Use. They inform, respectively, the use of visitor data (and capture authorization for it) and the prevailing rules, rights, and duties.

Therefore, they are very important, especially in the times of privacy regulations!
They stand out for their informative content to promote transparency with the data subject.

It is up to the data subject, then, to accept or not the conditions therein. In this sense, it is worth noting that the site may suspend access to some services, for example, due to a lack of acceptance of the rules and conditions. And that is natural since some of them are only possible with the authorization to use certain data.

Either way, these are important documents. But they shouldn't just be there. They should be specific to what the site offers and how it operates. So if you made your terms and policies based on Ctrl C + Ctrl V, pay attention!

It's time to review these documents and rewrite them to make them compatible with the reality of the site. Also, to fill gaps and clarify data usage. Below, I've separated a few more articles for you:

- [What is a Privacy Policy?](https://goadopt.io/blog/en/what-is-privacy-policy/)
- [What's the Ideal Privacy Policy for Your Company?](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/)
- [What are Terms of Use in LGPD?](https://goadopt.io/blog/en/terms-of-use-lgpd/)

## 4 - Data Loss or Data Breach

When it comes to data loss, it's time to sound the alarm. Data breaches are a clear sign that your privacy compliance strategy needs urgent correction or revision.

After all, it should be developed to maintain the confidentiality of data and their use in accordance with the data subject's consent or the [legal basis](https://goadopt.io/blog/en/legal-bases-of-lgpd/) chosen. Also, to ensure the protection of this information.

Data breaches are compromising! They can tarnish the company's reputation and often that of its customers and suppliers as well. Furthermore, the company can be held responsible for them and, as a result, face significant sanctions, including hefty fines.

[**Understand the difference between Data Controller and Data Processor here.**](https://goadopt.io/blog/en/differences-operator-controller-of-data-lgpd/)

And it's not just data loss itself. The lack of a clear plan of action in the event of information leaks is also an indication that you urgently need to work on your LGPD strategies. Below are some more articles to help you with this review:

- [Data Mapping or Inventory in LGPD, the DPO's life jacket.](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/)
- [How to Adapt Your Marketing to LGPD](https://goadopt.io/blog/en/how-to-adapt-digital-marketing-to-lgpd/)
- [10 Risky Processes in Your Marketing](https://goadopt.io/blog/en/10-risky-processes-in-your-marketing/)

## 5 - Absence of Designation of a Data Protection Officer

Finally, the last sign that your website needs an LGPD, GDPR, CCPA strategy is the absence of the designation of a Data Protection Officer or DPO (Data Protection Officer) for the processing of data on your site.

This figure is a requirement of LGPD, GDPR, CCPA and, according to the laws, is responsible for controlling and managing data processing. They carry out tasks determined by the Data Controller.

They are also the ones who handle complaints from personal data subjects, provide explanations, and communicate with them. Similarly, they control the entry and exit of consents, so they take the necessary actions to ensure compliance with authorizations. In this article, I explain more about [the responsibilities of a Data Protection Officer or DPO in LGPD.](https://goadopt.io/blog/en/responsibilities-of-a-data-protection-officer/)

## So, how about adapting your site to LGPD, GDPR, CCPA?

If you have recognized that your site falls into any of the signs above, it's a sign that you should take action to align it with the law. Otherwise, you may face [fines](https://goadopt.io/blog/en/fines-in-lgpd/) and other penalties that could even lead to the suspension of your page's activities.

Not to mention the impact on your brand's image in the eyes of the public, as someone who could care more about data privacy.

So, it's more than time to review your privacy strategies in the face of LGPD, GDPR, CCPA... For this, count on [AdOpt](https://goadopt.io/), which helps you not only organize them but also control the entry and use of data, as well as consents about them.

5 Signs Your Website Needs an Cookie Consent Strategy

Have you ever noticed that every time you sign up for a service to access information or register on a website for purchases, you need to give consent? If you're wondering why you have to give consent on every website you visit, you'll find the answer here.

Even though this consent is often "automatic" and happens without you thinking about it (which it shouldn't), it is very important. After all, it is a legal requirement that applies to the website and pertains to the security of your data.

Since data is becoming increasingly important and data breaches can cause significant harm, understanding what you're consenting to and what it means is indispensable. So don't miss the opportunity to learn more about this topic!

## With LGPD, Silence Doesn't Imply Consent

To understand how consent has become so important regarding data collection and use in the online environment, we need to go back to August 2020. That was the month when the [General Data Protection Law (LGPD)](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) came into effect.

It was introduced as a response to the need to protect data shared on websites and collected by web pages, as well as to regulate their processing. Notably, in recent years, massive data breaches of personal information, such as the Facebook breach, have alarmed users.

Therefore, privacy laws like [GDPR, LGPD, CCPA](https://goadopt.io/blog/en/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) have consolidated the notion of consent for data usage. In other words, all websites that use cookies and collect data from their users for any purpose (such as marketing) not only need to inform but also ensure agreement.

This happens when you access a website and need to grant permissions for cookies, for example. Even though cookies are just one form of information collection, they are a good example of consent.

The same thing happens when you access a page where you need to enter personal data. For example, when subscribing to a newsletter and landing pages. Similarly, when registering for a purchase. In these cases, there's always a box that says "I agree to the [terms of use](https://goadopt.io/blog/en/terms-of-use-lgpd/) and [privacy policies](https://goadopt.io/blog/en/what-is-privacy-policy/), " right?

Know that in all these cases, consent is given for the use of your data. It relates to the company's security and information treatment policies, as well as which data is used, when, how, and for how long.

Of course, there are other [legal bases](https://goadopt.io/blog/en/legal-bases-of-lgpd/) that also ensure the correct use of citizens' data. However, for many, consent ends up being the quickest and most accessible option in their business flow.

[**### Discover how to adapt your digital marketing to LGPD.**](https://goadopt.io/blog/en/how-to-adapt-digital-marketing-to-lgpd/)

## What is the importance of the consent policy for the website and the visitor?

The consent that you might be tired of giving - but shouldn't, as it concerns your security - is important for both websites and you, as well as other visitors and users.

Well then, let's start with the visitors because the preference is theirs! For them, consent is important because it's only through it that the companies behind the websites can use their data. They can use it only within the limits stipulated, both in terms of time and application.

So, if you have the habit of giving consent to websites without carefully reading the terms beforehand, it's time to change that approach! The use of your data is important and relates to your security (including financial security!).

Therefore, it's important to be aware of what you're allowing and what the company's policies are for protection purposes.

In this sense, it's necessary to pay attention to two different text documents: the Terms of Use, regarding the rules of service utilization responsibility and limits of duties and rights; also, the Privacy Policy, which concerns the treatment of information and security details.

On the other hand, the consent you give to websites is also important for them, obviously. After all, this is the only way they can really use the data (within the informed and consented limits) in accordance with LGPD.

Learn more about [how the cookie banner work](https://goadopt.io/blog/en/operation-of-cookie-banner/)!

Moreover, LGPD imposes significant [penalties](https://goadopt.io/blog/en/fines-in-lgpd/) on those who violate it. In this regard, it can impose warnings as well as [fines](https://goadopt.io/blog/en/fines-in-lgpd/) that can be quite high! It can also lead to restrictions on data collection and the banning of the page.

## What types of pages need to obtain visitor consent?

The vast majority of websites that collect data in some way and use cookies need to obtain consent from their users. There are various types of data collection, ranging from cookies to voluntary information acquisition through page registrations.

In this sense, all pages that use tools for analyzing results and metrics, such as Google Analytics, already have a duty to obtain consent from their visitors for this.

Similarly, landing pages, contact pages with user information disclosure, and other data registration forms will always need policies of agreement regarding data collection and usage.

Especially when, according to the company's business model, other [legal bases](https://goadopt.io/blog/en/legal-bases-of-lgpd/) are weaker in terms of data usage rationale. Thus, consent ends up being an excellent option.

## Cookie Banner

Firstly, one of the methods for obtaining consent is through the Cookie Banner, right on the page.

In this case, the page's opening must clearly inform the use of cookies and allow the visitor to configure their preferences and give their permission. Only after consent, the cookies can be triggered.

[### **How to configure third-party cookie blocking in AdOpt?**](https://goadopt.io/en/support/essential-setups/3rd-party-cookie-blocking/manual-third-party-tag-blocking/)

For this purpose, your website can rely on AdOpt. With our tool, your cookie usage policies are always clear to the user. In addition, alongside the banner, you can configure the blocking of third-party cookies, multi-languages and legislations, text customization, positioning, colors, and images.

[_Have you heard of the ROPA document in LGPD? 
It's essential and can help you a lot in your compliance!_](https://goadopt.io/blog/en/ropa-for-lgpd/)

## Terms of Use and Privacy Policy Notices

The other method of applying consent policies on a website is precisely on pages dedicated to contact forms, landing pages, and site registration. Using those "I have read and accept" checkboxes.

In this case, it is essential that the user has access to the documents that reveal them and that they must allow the use of such information before continuing their online action.

Therefore, always make sure that these notifications halt the process. This way, only data that truly has the visitor's consent is collected.

If you are an [AdOpt](http://goadopt.io/) customer, our technology allows this online form consent collection to be integrated into the platform as a whole. This means that your CRM has another field fueled by visitor consent.

Want to know how? Just chat with us or schedule a presentation conversation [here](https://calendly.com/valquiriaadopt).

Why Give Consent on Every Website I Visit?

GDPR and Cookies all you need to know

In today's digital age, data is the lifeblood of businesses. Yet, the handling of personal data comes with great responsibility, which is where GDPR (General Data Protection Regulation) legal basis step in. Whether you're a seasoned programmer, a marketing guru, an enterprising entrepreneur, a legal expert, or an agency owner, comprehending GDPR legal basis is pivotal. In this article, we'll explore these foundations and provide practical insights from the basics to more advanced concepts.

## The Meaning of GDPR Legal Basis

Before diving into the intricacies, it's vital to grasp why GDPR legal basis hold immense importance. These legal basis essentially serve as the pillars upon which data processing activities are built. They answer the fundamental question, "Why are we collecting and using this personal data?"

Learn more about: [The differences between data operator and data controller]https://goadopt.io/en/blog/differences-data-controller-data-processor/)

### **1. Consent: The Power of Voluntary Agreement**

In Practice: [Consent](https://goadopt.io/en/blog/website-needs-cookie-consent-gdpr-lgpd-ccpa/) is perhaps the most familiar and widely recognized legal basis under GDPR.

Practical Perspective: It's akin to getting a clear green light from individuals before processing their data. Think of it as an enthusiastic "Yes!" from the data subject.

### **2. Contractual Necessity: Data for Service Delivery**

In Action: Sometimes, data processing is indispensable to fulfill a contract or service.

Real-world Scenario: Consider a scenario where you purchase a concert ticket online. The event organizers need your data to deliver the ticket to you, forming a contractual necessity.

### **3. Legal Obligation: Compliance with the Law**

In Action: GDPR permits data processing to meet legal obligations.

Practical Example: Think of tax reporting – when the law mandates sharing financial data, you're complying with legal obligations.

### **4. Vital Interests: Data for Life-Saving Purposes**

Caring for Others: Vital interests can serve as a legal basis when someone's life is at stake.

Practical Scenario: Imagine a hospital sharing a patient's medical data with another hospital in an emergency to save a life.

### **5. Legitimate Interests: Balancing Act**

Balancing Act: GDPR allows data processing when you have a legitimate reason and it doesn't infringe on individuals' rights.

Real-world Use: A company analyzing customer data to improve its services is a prime example of legitimate interests.

### **6. Public Task: Official Duties**

Public Duties: Public authorities can process data to perform their official tasks.

Everyday Context: Government agencies can collect data to fulfill their official duties, such as issuing licenses or permits.

### **7. Consent for Special Data: Special categories of data, like health information, require explicit consent.**

Real-world Scenario: Think of a healthcare provider obtaining explicit consent before processing sensitive patient health data.

## Why the Choice Matters: GDPR and Beyond

Choosing the right legal basis is not just about compliance; it's about respecting individual rights and ensuring responsible data usage. But GDPR is just one piece of the puzzle. Other global legislations like [LGPD (Brazil)](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/), CCPA (California), and PIPEDA (Canada) also have their own sets of legal basis.

Comparing with [LGPD (Brazil)](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/), CCPA (California), and PIPEDA (Canada)

LGPD: Brazil's [LGPD](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/) draws parallels to GDPR, emphasizing consent, legitimate interest, and compliance with legal obligations. Read More

Learn more about: [LGPD legal basis.](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)

CCPA: California's [CCPA](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) is similar to GDPR's consent and legitimate interests. It grants Californians rights over their data and the option to opt out. Read More

PIPEDA: Canada's PIPEDA focuses on obtaining meaningful consent, and it aligns with GDPR on consent, contractual necessity, and legal obligations. Read More

[Learn more about the similarities and differences between LGPD, GDPR and CCPA...](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/)


## Choosing Wisely and Protecting Your Website

Selecting the appropriate legal basis is critical, not just for GDPR compliance but for respecting data subjects' rights and building trust. Ensuring that your website complies with GDPR and other applicable legislations is equally vital. Utilizing a robust cookie consent notice, such as the one provided by AdOpt ([https://goadopt.io](https://goadopt.io)), can significantly enhance website protection and user trust. It's your assurance that you're not just compliant but also dedicated to safeguarding user data in an ever-evolving digital landscape.

Learn more about: [What is a CMP - Consent Management Platform?](https://goadopt.io/en/blog/what-is-a-cmp-consent-management-platform/)

In conclusion, whether you're a developer, marketer, entrepreneur, legal expert, or agency owner, grasping GDPR legal basis empowers you to navigate the data privacy realm responsibly. Make your data processing decisions wisely, and ensure that your website remains a beacon of trust in the digital world.

In this article we guide you on: [How does a Cookie Banner work](https://goadopt.io/en/blog/operation-of-cookie-banner/).

And, if you need a [CMP to help you with your website consents, look for AdOpt as a great option](https://goadopt.io)!
Here in this article we help you on: [How to choose a cookie banner for your website](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/).