You've probably already come across numerous predictions of fines and sanctions that LGPD brought along, right?

Now that we have the so-called "new" [General Data Protection Law, LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/), what's next?

Hold on!

Before adopting an alarmist or even pessimistic perspective on the law, it's essential to make it clear that the use of personal data (read: processing and treatment) is not prohibited by the law, but merely regulated by it. As a result, you, as an entrepreneur or an expert in your field, can and should continue your work and strategies as a whole. However, you now need to understand how to adapt your business model to the regulations prescribed by the law for the use of such personal data.

So, what does the [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) mean for your company?

My goal here is to provide you, as succinctly and practically as possible, with a compilation of key information that will serve as a guide amidst the questions and forks you'll encounter on your path to understanding and, above all, compliance!

## Introduction

### Before We Begin, Who Is AdOpt to Help Me with This?

After several years at the forefront of work and studies on data, marketing, and internet privacy, a confession is in order. We've genuinely seen it all. We've been in this market since the birth of predictive analysis concepts, and all the AdTechs that have emerged since then. We witnessed the rise and fall of Cambridge Analytica and its scandals and leaks, numerous analyses and documentaries, Wikileaks, Snowden, and so on.

Naturally, we followed the entire market with the emergence of GDPR, CCPA, and their derivatives worldwide, which now, here in Brazil, culminate in LGPD. For almost 8 years, we've been working daily on several of the pillars that the "Data-Driven Marketing" market is so familiar with today. - Building data models for performance metrics analysis,

\- Sequential databases, non-relational databases, physical, cloud, and so many others that have passed through our hands.

\- Numerous tracking tag characteristics, fingerprints, SDKs, etc. - Endless technology updates, privacy issues, rumors, and browsers with their third-party cookie blocking. - Various integrations with Ad servers, CRMs, email tools, DSPs, Cookie Syncs with DMPs, Data Providers, Credit Bureaus, etc. - Firewalls, Backdoors, Security Routines, DNS, etc.

In short, more than 200 million unique users mapped in our systems, and 40 thousand websites have passed through our network since 2015, when we created our first Tag and Cookie version.

All of this is to tell you that all this knowledge we've accumulated until today gives us one certainty. It's worthless to know all of this if:

1 – We don't promptly execute best work and security practices, 
2 – We can't translate international theories into our local legislation and market realities. 
3 – We don't demystify the need for infinite, extremely elaborate resources to start good work. 
4 – If theory doesn't generate real benefits for clients and, consequently, sales for both sides.

Throughout 2019, we interviewed nearly 250 companies about LGPD and their perceptions of its impacts and challenges for compliance. Most of the difficulties listed at the time were: _the difficulty of understanding the law, a lack of skilled labor, difficulties with managing new technologies, and, not least, the administration and collection of consent from data subjects_.

Since then, we've had the same feeling: LGPD remains an enigma for most, and at the same time, we, who are a vital part of the market, have the opportunity to reinforce how seriously Privacy should be taken. Not just valued when lost but, in essence,** as an individual right of all citizens.**

Especially today, where it's impossible to ignore the elephant in the room, or rather, the increasing number of mobile phones and devices collecting text, audio, and video data in practically every household. Who hasn't felt like their phone is listening to them? Throw the first stone!

The fact is, all privacy regulations are here to stay! 

Yes, we're on an irreversible path when it comes to data usage by our favorite gadgets. Therefore, it's crucial that we understand the value of Privacy while theoretically, we still have control. But more importantly, we need access to technologies that work in our favor, not just collecting data but also giving us freedom in the face of the numerous data collection instances we encounter daily. 

Yes, before data collection, there's a choice made by a free citizen, which must be respected and informed clearly and transparently.

So, in the midst of all this data, services, endless questions, and technology tests, AdOpt was born.

These are years of study and practical applications aimed at minimizing the consequences that the marketing and advertising market has faced. Not just when GDPR came into effect in Europe and drastically reduced the revenue of major publishers but also due to the maturation of our local market - Brazilian, facing the numerous technologies we couldn't even test, thanks to our limited budgets.

AdOpt starts as a quick and practical way for all companies to communicate and collect consent from their visitors without risking destroying their metrics and engagement with yet another ugly notice that looks more like a Pay Wall, or shall we say - Cookie Wall?

In the entire roadmap of AdOpt and its evolution as a product, our goal is also to democratize access to information about the legislation and its applications so that we respect everyone's privacy! Again, the context in which AdOpt was born makes it impossible to ignore, given its immense importance in today's world.

#### From a commercial standpoint, we've come to the conclusion that the market lacks easily understandable positions, and above all, demystifying the interests of certain market segments concerning the new General Data Protection Law, LGPD. It's certain that lawyers, accountants, marketing agencies, IT professionals, and various other "experts" are eager to grab their share of the market. This is perfectly understandable because the law encompasses knowledge from various areas simultaneously. However, before any market advantage or class of workers, we at AdOpt believe that there are 2 principles that should always guide our interpretation of all this, in light of privacy; exalted by the numerous privacy laws worldwide.

## 1 – **A principle of freedom.**

Yes, freedom is of immeasurable value, and only those who lose it can truly describe the impact of its absence. Whether in access to information, the right to move freely, freedom of the press, or the simple right to be forgotten. We are the generation that created memes, but also "cancel culture," fierce criticism of Fake News, banning some social networks, and more. Guided by the premise of valuing truth, sometimes we forget to measure the real impact of some unilateral mechanisms that end up overshadowing the true value of freedom. 

LGPD, GDPR, CCPA, and many others are also mechanisms that help citizens maintain their freedom in the face of internet giants.

#### 2 – **Without content creators, we wouldn't have the internet.**

When this (the internet) "was all wild territory" and we had a handful of blogs and news portals, LGPD would never make sense. However, it was thanks to these internet anchors that the opportunity to monetize people's attention on certain pages was created! Without major publishers, we wouldn't have programmatic advertising and all the opportunities to automate the cash flow generated globally today, at the scale and proportion we experience.

#### Without programmatic advertising, we wouldn't have social media as we know them today. After all, as Mr. Zuckerberg would say.

"We Run Ads."

Perhaps this introduction has a touch of a "Manifesto" for you, as we emphasize the value of Privacy and Freedom, expressed in free access to information and, consequently, content production.

Here's another confession for you, dear reader. AdOpt today serves as a cookie notice, assisting as a [CMP](https://goadopt.io/blog/en/what-is-a-cmp/)._ But you have no idea what lies ahead when we connect all these points above and provide you with access to the technologies we're designing!

#### If data is the new oil, then Privacy will be the new currency!

The discussion isn't over yet, but I hope you've understood how passionate we are about this subject and want to guide you through it!

In our next chapter (article), I want to show you the foundation of understanding the law: [The Legal Bases of LGPD,](https://goadopt.io/blog/en/legal-bases-of-lgpd/) see you there!


Understand the meaning of the LGPD for your company

João Bruno Soares

One of the biggest dilemmas for those who start studying and understanding the LGPD more deeply is the realization that, as challenging as the compliance process may be, it is only the beginning. Yes, a series of changes and adjustments should now become part of the company's routine. There are several marketing processes involving personal data that you must reconsider now because of the LGPD!

Therefore, compliance with the LGPD goes beyond setting up a cookie banner or updating the privacy policy. Depending on the size of your company, numerous processes need to be reviewed and adjusted to the new realities established by the law.

The bureaucracy may seem extensive and never-ending for companies. However, we always need to put ourselves in the shoes of visitors, data subjects. Remember, both you and I are data subjects before being companies or professionals – we are citizens! The LGPD's priority is precisely to empower data subjects so that they, as individuals, have full rights and access to the necessary information regarding the use of their personal data.

That's why we're here!

Let's be the professionals who see the legislation as a new opportunity to raise the bar, to apply our knowledge with quality and respect to our clients and visitors!

The LGPD has brought new rules, new marketing processes, new positions...

So, how can we not anticipate the new standards and the new quality references that will ultimately be perceived by our clients?

One of the beautiful concepts, such as Privacy by Design (we've already discussed it here on the blog), can and should always be brought to the forefront!

That being said, I want to help you! Below, then:

##The 10 marketing processes you should rethink because of the LGPD!

###**1 - Sharing data lists with suppliers and third parties (freelancers, real estate agents, salespeople...)**
If by this point it's not already obvious to you, I don't know how else to make clear the risk of this type of sharing. After all, the visitor has provided their personal and sensitive data to the company. They have no way of knowing that you have numerous other people hanging on to your mailing list.

So be very careful with this practice! Especially if there is no confidentiality or liability agreement between the parties involved!

It may be that your business model requires this distribution of data, so reinforce it - clearly, in your policy and terms! Remember, when in doubt, prioritize privacy!

###**2 - Receiving customer email lists to upload to Facebook for matching and look-alike audiences.**

Does this list have consent for Facebook actions? What is the origin of the list? You may have noticed that since GDPR, Facebook has already been questioning advertisers when they upload email lists... I wonder why, right?

Whether you are a marketing department or a third-party agency to the client, always question these lists and avoid extending the channels of direct communication with the customer as much as possible, as it may violate consent and/or the legal basis that supports the use of the data.

###**3 - Buying cold lists to send emails, SMS, and SPAM. (If it was a crime before, now it's even more so)**
Who hasn't thought about "obtaining" a contact list, cast the first stone! Or even, who has never been approached by companies that sell these cold leads!

Lucky are those who generate quality content and transparency to the point where visitors trust the company with their data...

It's no wonder that email marketing tools have numerous warnings to avoid spam. It harms everyone's reputation, and the internet has no patience for spam, agree?

###**4 - Exchanging email lists for sending articles and newsletters with partners and clients. **
(A practice that may seem innocent but can violate the rights of data subjects)

It may seem innocent, but it's only an appearance! Just like the points above, data subjects have entrusted their data for that exclusive purpose. Any interaction that goes beyond that can directly violate the rights acquired through consent and/or legal basis.

###**5 - The agency as a whole has access to clients/visitors' email lists.**
(Access levels for sensitive data - responsibility contract)

Here we enter the realm of management and processes! 
Several marketing tools allow us to create hierarchies within their user accounts. This is precisely because each person has their level of activity and responsibilities.

It is a fact that many companies today work with decentralized or even horizontal management. But when things go wrong, who will be held responsible? Avoid problems by reviewing approval levels and access to data according to your team's responsibilities. After all, the actions of one employee affect the entire organization, and this should be considered as a contingency.

###**6 - Hiring freelancers and professionals with high turnover without a data responsibility contract with clients.**
(the infamous "flash drive")

This point is quite similar to the previous one bu,t has an even greater detail. Third-party professionals have limited or even extended responsibilities based on their contracts and the criteria they are bound to. So, every time a third party has access to your company's database, what security do you have over that data?

What guarantee does the data subject have when the data is exposed? Yes, it's basic! But there have been many cases of Employee X or Agency Y who deleted everything before leaving or took everything with them. And then? Was there a contract?

###**7 - CTAs in campaigns and ads saying "leave your contact information below if you want to receive..."**
This CTA (call-to-action) may seem "cheesy," but it is still widely used, and as they say, "if there's a rule, it's because there's a story behind it," meaning it works.

Be cautious with this kind of approach, especially if your audience is less tech-savvy and unaware of the risks of the internet.

Remember the case of people providing their data on a Facebook post to get a superhero credit card? Well, you don't want your company's reputation to be associated with an opening for scammers.

###**8 - Offline actions without a strong data collection guideline (legal basis) or associated consent.**
The LGPD is not only applicable to the online environment.
So, which offline, in-person actions should also be adapted to comply with the guidelines? Do you use registration forms? What is the data collection process in physical environments?

Every company has its own reality, but I have seen companies using "offline" consent forms (actual printed forms) to be attached to visitor registrations! Or even collecting all registrations via tablets, where consent is also recorded in the CRM.

Our radar should be tracking both online and offline! If you bring everything online, for example, through QR codes, you can use the AdOpt cookie notice as your consent tool and also implement tracking tags on the same landing page!

Perhaps this way, you can not only automate the opt-in process but also have authorized remarketing at the same time!

###**9 - Maintaining email lists out of vanity.**
The days when that Excel spread sheet full of emails from the 90s was considered a treasure for a company are gone.

Aside from being a vanity metric, it is also a significant cost within automation tools. Outdated and cold email lists pose a huge risk to the organization today. Avoid it, eliminate all of that, and make an effort to obtain updated consent from your active base as soon as possible!

Don't say I didn't warn you!

###**10 - Including personal data (such as personal cell phone numbers) in the Company's organizational chart without obtaining approval in the employment contract.**

Some companies like marketing agencies, have their organizational chart, a source of joy for SDRs when making those old-fashioned cold calls and scheduling appointments for the Field Sales team! #WhoHasNeverDoneThat?

If you're not familiar with it, let me explain!

Many agencies, especially the larger ones in São Paulo/BR, still have the infamous "organizational chart" displayed at the reception.

Accessing this file brings great joy to the sales team because it not only reveals the decision-makers but also provides their contact information!

However, there is also a potential danger lurking here!

If your organizational chart contains not only employees' professional data but also the personal cell phone number of an employee who didn't want to use two phones, for example...

Is this sharing of personal data specified in the employment contract?

It may not be a problem now, but in times of crisis, labor law can utilize all available resources. Why wouldn't it consider this aspect as well?

In the end, our goal has never been to predict doom for companies or to be part of the LGPD's Apocalypse Cavalry. But since we've been in the market for some time, these kinds of issues always catch our attention when we start data mapping and having conversations with colleagues.

Do you remember any other processes that could be included in this list?

Comment below, maybe it will help colleagues in the journey of compliance!

10 Marketing Processes You Should Rethink under the LGPD!

It's time to talk about one of the most impactful tasks, both for the company and for the visitors of your websites: tag categorization. But why is it so impactful? What is the relevance of this configuration and how can it affect us? It is precisely because of these common questions we receive from our clients that we have written this article on best practices in tag categorization.

## What is a tag?

To start off on the right foot, let's clarify some basic concepts that will help situate each one of you at AdOpt and in the market as a whole.

In a straightforward manner: **1 Tag = Trigger for 1 or more Cookies.**

What does that mean?

Basically, most Tags or pixels – as they are also known – when installed in the HTML of a website, are responsible for triggering cookies for each visitor on that specific page. A Tag can perform various functions such as tracking button clicks, page scrolling, collecting text fields, always associating these behaviors with that specific visiting browser.

Once this is possible, the way the Tag stores the data generated by the visitor is:

- Sending it to their server (the service provider's server that created the Tag) and;
-It can also record all the information in cookies that it generates and stores on your machine.

For example, when we visit an e-commerce website and it recognizes that we are returning after a previous visit, showing products that are of interest to us, it happens thanks to cookies and tags doing their job. In summary, 1 Tag can trigger N cookies and perform N functions.

Ultimately, the Tag itself is not inherently good or bad; it all depends on its application.

## What is tag categorization?

Categorization involves the work of the Data Protection Officer (DPO) in organizing all the tags installed on the website(s) under their responsibility into specific categories that represent their purpose and reason for being there.

Since GDPR, which was the pioneer in this regard, the market has created "standard categories." These categories are:

- **Essential / Necessary**: Without them, your business model or website does not function, or you are required to use them by law or regulations.

- **Marketing / Advertising**: With them, you can trigger re-marketing, populate ad pixels, automate email sequences, etc.

- **Statistics / Analytics**: With them, you have an analysis of what visitors do, where they come from, and how they behave on your website.

- **Performance**: Tags that maintain website functionality, ensuring its operation and response speed. For example, they can prevent DDoS attacks.

- **Functional**: Tags that handle functional aspects, such as remembering preferences or recognizing that you are already logged into the system, chatbots.

In other words, each company may have a group of tags installed on its website, with their purpose described and detailed in the Privacy Policy (or cookie policy). This purpose should be replicated in communication with visitors - the cookie banners - as well as in all processes that use this data.

## Why categorize tags?

Many companies use cookie banners that do not organize tags or cookies into specific categories, forcing visitors to accept all tags without distinction.

This poses a significant risk of fines for your operation since various regulations require that consent be specific and detailed for a particular purpose. In the LGPD, for example, Article 5, Item XII is clear:

> #info XII - consent: the free, informed, and unequivocal expression by which the data subject agrees to the processing of their personal data for a specific purpose.

This is one of the reasons why AdOpt has always worked with a design that prioritizes freedom for all visitors to navigate through categories and their respective tags.

## How to differentiate the function of each tag?

Certainly, the market already anticipates some purposes and their respective categories. However, it is worth noting that this step often involves areas of the company that go beyond those apparent on the website. A collection made through cookies can be the operational basis for an entire department and all processes within a company.

This means that, although the market already provides a standard for the category of each tag, especially the most popular ones, data controllers must adjust this difference within the company's operation, ensuring the reality of the situation and primarily supporting such choices with the chosen legal bases.

Therefore, even though there is a standard, companies are free to adjust the facts and must be prepared to respond to them with complete clarity to individuals.

That's why at AdOpt, when tags are scanned, some of them already come with a pre-classification. However, this does not prevent the data controller of a specific company from adjusting this categorization according to their Cookie and Privacy Policy.

As a platform, AdOpt cannot enforce a specific configuration or principle. However, it values freedom within its environments so that the responsibilities of the data controller are respected at all times.

## What do privacy regulations say about classifying each type of tag?

Privacy regulations do not delve into this "micro" analysis of tag categories. It would be impractical for national authorities to issue a classification opinion for every new tag that emerges in the market.

Thus, it is up to companies to ensure that communication is clear, objective, and respects the aspects of freedom and purpose already mentioned. Naturally, the market adjusts and creates standards and even specific terms for each of them.

For example, the terms "Essential" or "Necessary" are not determined by law. However, these terms help in quickly understanding their purpose, which is why the market has adopted them. The less confusion in this regard, the better. After all, subjectivity exists in all places and contexts. If we can avoid these points with a certain "standard," we minimize these variables.

## Where to apply and/or replicate this information?

As mentioned earlier, the categorization of tags is an organization that should reflect the operational purpose of using that data. Therefore, before a conceptual application, it should have a practical use that mirrors this classification.

However, it is worth noting that this classification is often explained or expanded upon in official company documents such as the Privacy Policy and Cookie Policy.

In addition, a crucial aspect directly related to tag categorization is the configuration of blocking third-party tags according to the visitor's choice. In other words, the cookie banner only allows a certain tag to be executed after the visitor's consent.

What does that mean?

Each visitor is free to choose whether or not to consent to that group of tags declared by the company. Therefore, their will is respected when cookies are only stored upon "free, informed, and unambiguous" consent (without ambiguity, clear, without equivocation).

**That's why AdOpt advises all users of the tool, without exception, to configure the blocking of third-party tags. Only with this configuration in place will the banner be complete and properly installed.**

Here's a tutorial for configuring the blocking of third-party tags on your website.

## Why do some websites don't block third-party tags?

It is not up to AdOpt to judge why a particular site, and even its clients, have chosen not to implement this configuration, even though it is constantly reinforced in our communication and classified as "essential."

Certainly, such a decision harms the image of both the company and even AdOpt. However, it is important to remember that prior to this setup, each tag has a unique function within each company, in its unique environment and context. Imposing a technological mechanism by AdOpt would go against the freedom of choice for its clients in the interpretation and application of the law that applies to everyone.

Keeping in mind the necessary proportions and equivalences, let's consider an example. It would be like holding vehicle manufacturers responsible for cars that have the capability to exceed the speed limit. The automaker can install alerts, reinforce communication in various ways. But they can never impose that a citizen does not drive according to their freedom of choice.

## Last point, as a golden rule!

**Always align the Actual Use of data with Processes, Documentation, and Communication.**

**Process: **The data collection declared for a specific purpose should indeed have the same destination and use of data within your company.

**Documentation**: Official documents should always be up to date and truly reflect the practices within the company.

**Communication**: The tag classified as Necessary or other classifications should indeed be necessary. The tag should not be classified as "essential" just because visitors cannot block it. This would be an attempt to bypass the freedom of individuals accessing your website.

The same market that creates classification standards for certain tags is also capable of judging the truthfulness of intentions and facts declared by your cookie banner on your website.

Always remember that people come before companies. The LGPD (General Data Protection Law) was created precisely to better balance the relationship between companies and citizens. After all, privacy is a universal right and should not only have value when it is lost.

---

Did you feel that something was missing or need further explanation?
Let us know at [hey@goadopt.io](hey@goadopt.io), and we'll be happy to discuss the topic further with you!


Best practices in tag categorization

Now that we have the data flow within your company, we need to highlight 2 aspects of LGPD that will help you determine the extent of your responsibility in relation to the many points listed in the company. I'm talking about the difference between Data Controller and Data Processor.

##How to determine the differences between the parties?
A simple example would be the roles between a company and its marketing agency. In this case, the company would be the data controller and the agency the data processor because their functions are distinct in the chain of services and responsibilities.

##Always put yourself in the Data Subject's position.
For example, when the Data Subject goes to an e-commerce website to purchase a product, from their perspective, who are they entrusting their personal data to in order to make that purchase?

Can they know if the agency receives the lead and then enters it into the email marketing tool? No. Therefore, the e-commerce website becomes the data controller and the agency becomes the data processor. Each has their own role under the law, but all are co-responsible, in their respective functions, for the proper handling of the data of the Data Subjects.

Therefore, in your data mapping that we mentioned a few lines back, what is your role: data controller or data processor? Or, depending on your business model, both depending on the stage?

It is important for you to highlight this because, just as your responsibilities differ based on the role you perform, the way you handle a request for data deletion or data download is different. You may have the data on hand and the capability to deliver it to the Data Subjects.

However, it may also happen that you can only refer this power to the data controller, after all, you are just a link in the chain and do not have direct access to the data, but to some encryption that only provides you with anonymized visualization.

##More Examples of Data Controller and Data Processor - LGPD
Other common examples where there are different roles but clear co-responsibility for the data and its use include:

**Company <> Third-party Accounting Firm. Real Estate Company <> Third-party Brokers. Investment Fund <> Independent Agents. E-commerce Website <>Logistics companies and delivery services. Law firms <> Customer and employee qualification data.**

In conclusion, it is clear the importance of an accurate listing of all data controllers and data processors within your company's data mapping. With this information in hand, it is advisable to link all parties involved in the process according to your privacy policy and terms of use.

In the future, we can discuss the obligations prescribed by the law.

However, you can also consult directly with your lawyer, especially if you have any legislation that supersedes the LGPD.

In our next article, we delve into the responsibilities of the Data Protection Officer or Data Controller. 
See you there.

The Differences Between Data Controller and Data Processor - LGPD

While internet cookies, commonly referred to as just "cookies," are widely recognized today, some companies also use Local Storage and Session Storage as other methods used by programmers to store persistent information in a visitor's browser. However, what's the main difference between cookies and local storage, and why choose one over the other? This article will help you with these questions!

As mentioned earlier, [Cookies](https://goadopt.io/blog/en/cookies-and-lgpd/), Local Storage, and Session Storage are methods used through programming languages to store information in a website visitor's browser.

In other words, they store information in your browser about your access and how you navigate the website. Many of these have been used maliciously, even capable of storing all the information entered in text fields in forms, for example.

## Relax, cookies and local storage aren't synonymous with invasion of privacy.

Few people know that cookies were originally developed by hackers to capture people's data on the internet. Later, this technology gained a commercial purpose and is now widely used across the web.

Before you get alarmed or want to reject all internet cookies and storage, remember, they make your life much easier.

Thanks to them, your products stay in the shopping cart when you switch tabs or go back to the store to add more items.

They keep a pre-filled form in case there's a connection glitch, preventing you from starting over.

And they also welcome you by recognizing your previous access, without needing to log in to your account hundreds of times a day.

## What are the Key Differences Between [Cookies](https://goadopt.io/blog/en/cookies-and-lgpd/), Local Storage, and Session Storage?

Now that we've discussed the similarities, let's delve into the differences using three main criteria: **storage capacity, storage location, data persistence, and performance.**

**- Storage Capacity**

This capacity usually varies between browsers. In general, cookies can store up to 4096 bytes or 4KB, while Local Storage can handle 5MB, and Session Storage ranges from 5MB to 10MB.

Moreover, there's a maximum limit on the number of cookies per domain, and it's not recommended to exceed 30 cookies.

Some browsers, such as Opera, will prompt the user to allow more data usage when this limit is reached.

**- Storage Location**

Cookie information is stored in both the browser and the originating server of the referenced service.

Local Storage and Session Storage use only the browser as the storage location for data.

**- Data Persistence**

Data persistence refers to HOW and WHEN the stored information is deleted, erased, or invalidated.

**Cookies**

Cookies have an expiration date, causing the stored information to become invalid and outdated when that date is reached. However, whenever a visitor deletes cookies from a website, that information is also removed from the browser.

Some browsers automatically clear cookies periodically, and you can usually configure this in settings.

[Learn how to clear cookies and browser cache.](https://goadopt.io/en/blog/delete-cookies-cache-chrome/)

Today, due to privacy regulations like LGPD, GDPR, and CCPA, websites using these trackers must inform their visitors of their existence using a cookie notice. This technology, called a [CMP (Consent Management Platform)](https://goadopt.io/blog/en/what-is-a-cmp/), must then block cookies based on user consent.

[To learn all about GDPR, CCPA, and LGPD, we have this article for you.](https://goadopt.io/blog/en/lgpd-general-data-protection-law/)

**Local Storage**

Local Storage has no expiration date, so the information persists in the browser until the user performs a cleanup and deletion. Additionally, there are fewer browsers that offer features to block or periodically delete Local Storage data.

Regarding privacy regulations, especially [GDPR](https://goadopt.io/), the same obligation to inform its usage applies to Local Storage. Therefore, when choosing your cookie notice, ensure that it also lists third-party tracker Local Storage used on your site.

To learn more about [how a CMP works](https://goadopt.io/blog/en/what-is-a-cmp/), here's an article to help you understand.

**Session Storage**

In Local Storage, information remains stored until a deletion is performed. However, in Session Storage, the information is automatically deleted whenever the visitor leaves the site or closes the browser tab.

This is the main difference between Local and Session Storage.

**- Performance**

To analyze performance between web storage (Local and Session) and cookies, a highly technical language would be necessary. However, let's try to simplify the facts.

Every website has a visually coded part connected to a server. The server keeps the site online, and when someone accesses that URL, it operates those visual settings and responds to interactions on the screen.

This interaction is performed by the [browser (Chrome, Safari, Opera, Brave...)](https://goadopt.io/en/blog/delete-cookies-cache-chrome/)

If your browser has cookies from that site, in addition to communicating with the site's server, it must also await the server's reading of those cookies and their respective servers. This is because there may be cookies from that specific site and cookies from third-party companies installed.

Therefore, when using cookies, all requests you make to the site also depend on sending cookie information to your origin server and then to the site. Hence, simply using a cookie in your application consumes a bit more "bandwidth" and "data" to read and execute it on the site, and present it in the browser.

**In contrast, Local and Session Storage do not require this triangulation between servers, resulting in less bandwidth needed for the site to respond to the information contained in web storage.**

## How to Create a Consent Strategy as the [Legal Basis for LGPD](https://goadopt.io/blog/en/legal-bases-of-lgpd/)?

Want to learn more about [how a LGPD cookie notice works](https://goadopt.io/blog/en/operation-of-cookie-banner/)? In this link, I explain the step-by-step of the technology developed by [AdOpt](https://goadopt.io/blog/en/why-the-cookie-banner/) and used on thousands of websites.

After all, if your site uses cookies, you can't simply [ignore LGPD](https://goadopt.io/blog/en/ignoring-lgpd/). You need to choose a strategy to avoid the [fines](https://goadopt.io/blog/en/fines-in-lgpd/) associated with this new legislation.


What is the difference between cookies, local storage, and session storage?

LGPD, GDPR, and CCPA are data privacy regulations like so many others that are comming into force.
And, like all regulations, their text is long and detailed. 

To simplify understanding, we've outlined the key similarities and differences. There are six main differences:

## 1. Applicable Territory

- LGPD applies throughout Brazilian territory.
- GDPR is applicable across the entire European Union.
- CCPA is specific to the state of California, USA. It's important to note that only data subjects residing in California fall under this law; in other words, the law applies to anyone doing business in the state.

However, it's a misconception to think that these regulations are mere replicas of each other just because they concern data protection and privacy. Compliance with one doesn't guarantee compliance with the others.

## 2. Scope of Data Subjects

- GDPR applies to personal data of data subjects, which includes users, whether they are customers or mere visitors to a website.
- CCPA applies to consumers, households, and residents.

## 3. Definition of Personal Data

1. For LGPD, personal data refers to any information related to an identified or identifiable person. Some information doesn't personally identify you; you remain anonymous. However, other information, like names, emails, and personal documents, can identify you individually.
2. For CCPA, personal data is any information that individually identifies a person or household. Anonymous data is not considered personal.
3. For GDPR, all of the above is considered personal data. There are even two distinct categories: data made public by the data subject and data related to nonprofit organizations.

Among these definitions of personal data, there's a more special category: sensitive data.

Sensitive data includes information revealing racial or ethnic origin, political beliefs, religious or philosophical affiliations, union membership, and matters related to health and sexuality.

Unlike LGPD and CCPA, GDPR prohibits the use of sensitive data unless such use is provided for by law.

## 4. Data Controllers

LGPD and GDPR, within their respective territories, apply to all data processing except for personal use. Whether it's a company, NGO, or government institution, the law applies.

CCPA is different in this regard. It specifically applies to:

1. Companies with an annual gross revenue exceeding $25 million.
2. Companies that obtain data from more than 50,000 consumers, households, or devices.
3. Companies that generate over 50% of their revenue from selling personal information.

## 5. Sale of Personal Data

In LGPD and GDPR, the sale of personal data requires a legal basis prescribed by the law. It's not something anyone can do.

On the other hand, CCPA doesn't prohibit the sale of data. It only provides the option for the data subject to opt out of having their data sold. In other words, a person can agree or disagree with the sale of their data, and the company must respect that choice.

## 6. Fines and Penalties

GDPR, LGPD, and CCPA impose different fines and penalties, so each one should be consulted separately. [In this article, you can find more details about LGPD fines and penalties.](https://goadopt.io/en/blog/fines-in-LGPD/)

We've already seen that there are significant differences between the three regulations. So, what are the similarities?

## Similarities Among LGPD, GDPR, and CCPA

## 1. Transparency About Data Use

All three regulations ensure transparency regarding data usage, including whether data is being processed, whether it can be sold, and the purpose behind these actions.

## 2. Power to Update and Delete Data

All three regulations allow users to revoke data consent and ensure they can update their data whenever they wish.

## 3. Regulatory Authority

The regulations establish a governmental authority to ensure compliance. In the case of LGPD, it's the National Data Protection Authority. For CCPA, it's the Attorney General of the State of California.

## Do I Need to Comply with All Three Laws?

As discussed in the previous sections, the laws apply to their respective territories. If your company handles data from Californians and Brazilians, you need to be fully aware of CCPA and LGPD. If your company processes data of European Union customers, GDPR compliance is necessary.

However, in practice, this is simpler. Since LGPD is based on GDPR, it's easy to align with both regulations. Given that all three are based on principles of transparency and consent, three steps will ensure that your website doesn't run into issues with any of these laws.

## 3 Steps to Comply with LGPD, GDPR, and CCPA

## 1. Understand Consent and Transparency

One thing LGPD, GDPR, and CCPA have in common is their emphasis on transparency and consent, which underpin the entire law.

What does this mean in practice?

Every user needs to know that their data is being collected and for what purpose your company will process this data. This information needs to be explicit. Knowing this, the user needs to agree. This is transparency and consent.

If the user doesn't agree to data processing, they should be able to express this decision clearly and directly. Your company should respect this choice without pressuring the user to provide data.

However, manually managing this process would make operations for any company complex. To streamline this service, we move on to the second step.

## 2. Install a Cookie Banner

A [cookie banner](https://goadopt.io/blog/en/what-is-a-cmp/) is a text notice, similar to what you saw when entering this blog. The cookie banner informs the user that the site collects data and requests the user's consent for data collection. The cookie banner also explains the purpose of collecting this information.

Most importantly, it records all of this. We can prove which data you agreed to provide, which is crucial for legal compliance. Moreover, through the [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/), you can specify which data you want to provide and which you don't, or even refuse to provide any information. And that's perfectly fine.

To ensure this operation runs smoothly, LGPD, GDPR, and CCPA require that each company has a responsible person. This professional is called a DPO: Data Protection Officer, which is the third step.

## 3. Appoint a DPO

DPO stands for [Data Protection Officer](https://goadopt.io/blog/en/responsibilities-of-a-data-protection-officer/). Your company can outsource this service or select an internal employee for this role.

The DPO is legally responsible for the company's data protection policy, acting as the liaison between the company and the data protection authority. In the case of LGPD, this authority is the ANPD. For CCPA, it's the Attorney General of California.

With these best practices, your company is assured in this ever-changing landscape and extensive debate on data usage.


GDPR, LGPD, and CCPA: What Are These Laws, Similarities, and Differences

With Data Mapping, we gain a deep understanding of the 5 stages that every piece of data goes through within any department of a company, regardless of its size or industry. Again, my dear friend, you don't need to be a PhD in PMBOK or Project Management to understand these crucial stages! Data Mapping and Data Inventory have become one of the most essential tools for Data Protection Officers (DPOs)!

The market today has brought a lot of technology and quality to these processes! We have no complaints about that. But my goal here today is to teach you to see things in a simpler and more objective way, as they truly are – a straightforward arrangement of facts, and that will already help you.

So, let's get started!

A basic concept that will guide your understanding from now on:

## **With the grouping of processes, we have a department.**

Therefore, each process can be organized in an order, or not, thus forming the routines of the departments.

Thus, for each process in your company, the following 5 points can be fulfilled in full or in part.

They are:

1. #### Motivation - Why do we need this data?

2. #### 2.1 – Consent.

3. #### Processing / Treatment
    
    #### 1 – Internal sharing among departments and systems.
    
    #### 3.2 – Storage for internal use and consultation.
    
    #### 3.3 – Backup.
    
4. #### Disposal

5. #### End of the process?

_And what do I do with these 5 points above?_

### **Fill them in and structure this logic in all your processes and consequently, departments.**

Yes, it's hard, I know!

But, it will be extremely valuable in case of a notification from the National Data Protection Authority (ANPD) or even before that, in case a customer or visitor to your website asks for access to the data you may have about them.

Of course, if you're a small business or have very few employees and processes, all of this can be summed up in 3 or 4 systems (email, marketing automation, some Google Drive, and accounting) because everything is stored in these places. Now, imagine a company with 500 employees in 10 cities.

Remember, according to LGPD, any data subject can knock on your door asking if you have any of their data, and you must respond promptly.

So, without the "treasure map," how will you know that [name@personalemail.com](mailto:name@personalemail.com) subscribed to the Newsletter, made a purchase 3 months ago, and was your employee 5 years ago?

In the above example, you would have to report to that person that you have data such as:

\- Name, Email, CPF, Phone, Address, Work Permit, Parentage (HR data), and sharing with Google and Facebook.

For the following reasons:  
1- Hiring in the past, so labor legislation obliges you to keep this data in your accounting for X years. In other words, even if he requests deletion, you can deny it, due to another legislation.

2 - Purchase of products X, Y, Z 3 months ago.  
This also generated registration in the newsletter (with the famous "I accept to receive promotions"). From the newsletter, you have him on the mailing list for new products and updates from your e-commerce, and all remarketing tools are connected, pursuing him daily across the internet, every time he visits to see your products.

Therefore, he can freely request the deletion of all his data for marketing purposes. This will lead to a series of actions. These include:

\- Deleting the email and other data in the CRM and email delivery tool.  
\- Distributing the Opt-out request to any systems you are integrated with that use this data. (logistics and ERP systems, for example)  
\- Removing him from the Google and Facebook remarketing segment.  
\- Reporting in an official company document that the above steps were promptly completed.

(For AdOpt clients, when integrated with Tag Manager, the cookie part becomes much easier! Because when a visitor does not authorize some of them, AdOpt automatically blocks this firing!  

[Here's a tutorial for you!](https://goadopt.io/en/support/essential-setups/3rd-party-cookie-blocking/manual-third-party-tag-blocking/)

Additionally, a visitor's request on the opt-out page sends an email to you immediately, with this request linking the requester's email to the Cookie ID generated in the Opt-In.

So, you can start this search with greater direction if the requester has given consent to any tools and when.

Do you understand now the importance of mapping your company's processes?

Only with all this in hand will you have peace of mind and, more importantly, ease of accessing all this data promptly. For some companies, around 48 to 72 hours (a reasonable response time...) is more than enough, for others, it's practically impossible.

Whether you or your hired DPO, we can't stop the company for every request from a visitor. With Data Mapping in hand, this search is much faster, targeted, and, I dare say, automated, if you use software just for that.

Here's a more detailed breakdown of each of the points in Data Mapping:

1. **Motivation - Why do we need this data?** If LGPD hasn't already prompted you and your company to reflect on the real need for personal data in your business, stop and do it as soon as possible.

    Yes! Often, especially in Marketing and Sales, there's a compulsion for qualification and identification information about prospects and leads for each stage of the funnel. It's great to pick up the phone and close the final details of a sale or surprise an undecided customer and convince them of the value of your business.

    But the point I emphasize is: Reconsider the real needs of accessing, processing, and storing this data. You don't necessarily need to have an Excel sheet with thousands of lines of your inactive customers from 5 years ago, hoping to rekindle this dead list one day. In light of LGPD, your risk has already been measured; is it worth it?

    [In this article, I present 10 marketing processes that you should rethink in light of LGPD!](https://goadopt.io/blog/en/10-risky-processes-in-your-marketing/)

2. **Collection**.  
    What are the ways in which each process collects/receives your data, along with your consent? Do all data enter the company through a single entry point, or more than one?

    List them all and review whether each entry point displays the necessary policy and process communications, and whether consents from each data subject are also collected alongside the data. Even if in an analog/offline manner, consent is essential.  
    1 – Consent.  
    Yes, consent is essential, but it's not the only instrument that allows you to access or process personal data.

    In this [article, we list all the legal bases](https://goadopt.io/blog/en/legal-bases-of-lgpd/) that support the use of personal data according to LGPD.

3. **Processing / Treatment**  
    1 – Internal sharing among departments and systems.  
    - Are third-party software used for data processing?  
    - How do data flow between them?  
    - Is the software aligned with your process and privacy policy?  
    - If a data subject requests the deletion of their personal data from your company, how do you notify this external or internal supplier to process the deletion?

    - Is there any documentation or search tool to assist the DPO in case of scanning, making it easy to locate data of a data subject in the department?

    3.2 – Storage for internal use and consultation.

    - During the processes where data is stored?  
    - For how long?  
    - Files, physical hard drives, or in the cloud?  
    - Is this cloud in the national or international territory?  
    - Who will be responsible for deleting or querying the database in case of a request?

    - Is there any documentation or search tool to assist the DPO in case of scanning, making it easy to locate data of a data subject in the department?

    3.3 – Backup.  
    - What is the frequency and rules for backup?  
    - Files, physical hard drives, or in the cloud?  
    - Is this cloud in the national or international territory?  
    - Who will be responsible for deleting or querying the database in case of a request?

    - Is there any documentation or search tool to assist the DPO in case of scanning, making it easy to locate data of a data subject in the department?

4. **Disposal**  
    Although greatly facilitated for digital files, this stage of the process is quite serious. Many files remain in the "trash" and are not properly deleted.  
    For physical files, this problem is even greater when disposal is done poorly or neglected.  
    Understand this process and, especially if there are third parties involved in the stage, include them in your monitoring of third parties potentially involved.

5. **End of the process?**  
    Is the end of the process indeed the end of the data's journey in the company, or is it just the beginning of another?

Certainly, at first glance, all these questions and concerns may seem excessive. But believe me, these are just some of the questions you would/have to answer if you hire a consulting and compliance service.

Or, in a scenario not as informal as this text, a visit from the ANPD.

I hope I have helped you gain a better understanding of how these stages are essential in a DPO's routine.  
With Data Mapping, we certainly have the foundation for creating a more robust privacy policy.

Did you miss any items or descriptions?  
Send them our way; we are open to improvements, always! - You can send them to hey@goadopt.io

A recommended further reading to delve deeper into the subject is:

[The differences between Data Controller and Data Processor.](https://goadopt.io/blog/en/differences-operator-controller-of-data-lgpd/)


Data Mapping or Data Inventory - a life jacket for the DPO!

While it's not exactly breaking news, discussions about privacy policies have been popping up more frequently since the start of GDPR in Europe. And despite it seeming coincidental, it's not!

After all, this term is directly linked to the [LGPD or General Data Protection Law](https://goadopt.io/blog/lgpd-lei-geral-de-protecao-de-dados/) that came into effect in August 2020. However, if you're not familiar with it, don't worry because we're here to help you.

Below, you'll find everything about this type of policy, how it works, and its importance. Also, take the opportunity to learn how to develop one for your company and thus, comply with the legislation that's already in effect in the country.

## **Understand everything about privacy policies**

It's time for you to understand once and for all what these terms are and why you shouldn't ignore them when visiting a website! After all, your security and your data's security are at stake. Want to understand how? Read on!

Privacy policies mainly apply to the online environment and concern the protection of your data. In general terms, they correspond to a company's statement regarding how it handles your information, and now, with LGPD specifically, your personal data.

But how is that so?
Well, your online activities leave traces. That is, data that websites and social networks store, generating information about you. Similarly, these are recorded by your browser. However, this can't happen inadvertently because merely "browsing these environments" already generates data and, consequently, personalized data collection.

In other words, the legislation protects us citizens from websites simply collecting information and using it as they see fit.
This, in fact, is the focus of LGPD. This makes it even more evident that a website should have an easily accessible privacy policy that formally organizes this information.

First and foremost, data collection can only occur with the user's explicit authorization. Whether through express consent or other [Legal Bases of LGPD](https://goadopt.io/blog/en/legal-bases-of-lgpd/) that support data collection by the company. Therefore, you are a key player in determining what information can be collected, stored, and eventually used.

> Here's a significant gain provided by LGPD for all citizens - **the power to exercise their rights of access or restriction to anything related to their personal data. Citizens can now actively participate in the decision, freely and protected by the law.**

However, it doesn't stop there!

According to the law, companies are not only responsible for collecting data within the visitors' will when they visit their websites or networks.

They must also clearly demonstrate how they store and for what purposes they use such data. After all, they belong to someone! And their use must align precisely with their intended purpose, as well as ensure that the information doesn't leak out and cause serious problems.

## Cookies vs. Privacy Policy

Before we dive into how this policy affects you and how to develop a quality one, let's clarify something. Many people confuse cookies and such policies. Although they are closely related, they are not synonyms.

Remember the data we mentioned earlier, the focus of the privacy policy? Well, some of it is collected through [cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/)! After all, the website needs to know which data you've given permission to access. Similarly, it needs to know what "marks" it can leave in your browser.

These data are usually collected for commercial or digital marketing purposes, i.e., for promoting products and services online. However, they also often contribute to navigation and the visitor's experience.

But how does this work? You've probably visited websites where you're already registered, and when you do, you see your login and password automatically filled in. This is nothing more than the action of these "marks" on your browser.

The same thing happens when you looked at a product, thought about it, and left it in your cart. It probably kept following you after that, right? Whether through advertisements on social networks or on websites, it surely didn't stop appearing.

Again, we have the action of cookies, which provide access information to web pages. Therefore, they are related to data and the care that LGPD reinforces about them.

> [**_Learn more about: Cookies and LGPD_**](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/)

So, where does the privacy policy come in?
Well, it's precisely the information that the website provides to the visitor about how it handles data, how it stores it, how it ensures its security, and its intended use. Both for data that enables direct identification - i.e., data that directly identifies the individual (Name, Email, CPF, RG, etc.), and indirect data that, when combined, can lead to an individual (IP, Address, Position, Profession, etc.).

In other words, the policy acts as a code of conduct for the company.

It's important because it's a public commitment by the website to the visitor. By having it, the site assumes a responsibility that must be strictly followed.

## **How to create a privacy policy according to LGPD?**

Now that we know more about privacy policies, data collection, cookies, and how LGPD has made them so important, the question arises: how to create a high-quality policy? This is a crucial issue if you have a website, regardless of its purpose.

### Use simple and clear terms

First and foremost, it's essential that the terms are clear. Leave legal jargon behind and use simple terms. This ensures they won't be ignored and, at the same time, provides a clear understanding of how the website handles user data.

Leaving no room for doubts or suspicions is crucial and also helps in building the page's image. So, remember to adopt a simple and very clear language.

### Provide complete and informative information

Another essential aspect when developing a privacy policy is to provide complete information. In other words, don't leave anything out and provide a full understanding of what's being done with the data and how it's being handled.

Among the essential pieces of information are:

- Information about the company behind the website;
- Data collection sources;
- Data usage (purpose);
- Cookie policies;
- Information about visitor's rights;
- Storage duration.

You might wonder, with the list above, how do I identify all this? Where do I start? The simplest answer would be to understand that the Privacy Policy is the result of a series of other readings and data mappings you should go through to write it more securely.

So, below are two articles that can help you with the next steps:

#### [**_Data Mapping or Data Inventory, the DPO's Lifesaver_**](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/)

#### [**_What's the Ideal Privacy Policy for Your Company?_**](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/)

## Rely on an intelligent and automated cookie notice platform

As we saw earlier, cookie collection and privacy policies go hand in hand. Therefore, our final tip couldn't be any different! It corresponds to adopting a cookie notice platform.

With this, your visitors have simultaneous access to cookie customization and authorization and to the policy the website applies to their privacy. And for this, count on [AdOpt](https://goadopt.io/), a reference in the market that is here to help you comply with LGPD and respect all your visitors' rights!

[Learn more about how a cookie notice works!](https://goadopt.io/blog/en/operation-of-cookie-banner/)


What is a privacy policy?

Since the sanction of the [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) in August 2018, through the approval of Provisional Measure No. 869/2018, until the conversion of the MP into law (Law No. 13.853/2019), the Data Protection Officer (DPO) role has gone through some twists and turns, such as the possibility of the DPO being an individual or legal entity, and the requirement of having regulatory legal knowledge.

Therefore, this brief article aims to provide some clarification regarding this crucial role in the context of data protection. Job vacancies have indeed arisen, but along with them, the responsibility and demands of the market!

In the definition of Article 5, item VIII, of the LGPD, the DPO is the "_person appointed by the controller and operator to act as a channel of communication between the controller, data subjects, and the National Data Protection Authority (ANPD)_."

Drawing an analogy from the world of soccer, we can think of the DPO as the "midfielder" of the team, responsible for connecting the defense and the attack. Visually, we have:

![RESPONSABILITIES DPO.png](https://strapi.goadopt.io/uploads/RESPONSABILITIES_DPO_e0c6ad2579.png)

Thus, the DPO is the figure responsible for mediating the dialogue between the controller and the data subject or between the controller and the ANPD, accommodating their needs and interests.

## What are the responsibilities of the Data Protection Officer?

Among their various responsibilities, all outlined in Article 41, § 2 of the LGPD, the DPO's activities consist of:

_I - accepting complaints and communications from data subjects, providing explanations, and taking action;

II - receiving communications from the national authority and taking action;

III - guiding employees and contractors of the entity regarding practices to be taken regarding the protection of personal data; and

IV - performing other duties determined by the controller or established in complementary regulations._

To fulfill these responsibilities, the DPO must master data [mapping techniques](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/), identifying all possible sources of collection, as well as controlling the data's lifecycle, i.e., how it will be stored and used, with whom it will be shared, when and how it will be deleted.

Another fundamental aspect for the DPO to truly fulfill the role that the [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) proposes is autonomy in decision-making power and the exercise of oversight of internal company processes. Naturally, as a professional hired by a particular company to act according to its interests, the DPO will have a degree of subjection to the guidelines of their employer. However, this should not compromise their position as an intermediary between the data subject and the ANPD.

In conclusion, it is worth considering that although the current wording of the LGPD no longer requires the DPO to have regulatory legal knowledge, knowledge and, above all, mastery of the LGPD and other applicable regulations in the context of personal data protection are essential for the effective performance of the DPO's functions. This is especially true because the LGPD should not be analyzed in isolation but always within the context of the market and the company's regulations seeking compliance.

Nevertheless, the growing concern of entrepreneurs regarding the LGPD is natural. After all, Brazil is an extremely complex country for entrepreneurship, and every new regulation brings uncertainty and instability to the game.

_**ABOUT THE AUTHOR:**_

_**Dânton Zanetti**_ _is a lawyer, founding partner of_ _Zanetti, Oliveira & Machado Sociedade de Advogados_ _([www.zomadv.com](http://www.zomadv.com)), working in the areas of Business Law, Contract Law, and Digital Law, with a Master's in privacy and data protection._

Responsibilities of a data protection officer.

ROPA in LGPD? Get to Know the Records of Processing Activities

The [LGPD - General Data Protection Law](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) brought with it several acronyms and specific terms. Many of them imported from other countries and legislations. One of them is ROPA (Record Of Processing Activities), adapted in Brazil to _Registros das Atividades de Tratamento_. An essential document for any DPO, Data Processor.

If you work in the field or are in the process of adapting your company, this article was made to help you better understand this document.

ROPA (_Record Of Processing Activities_), is nothing more than a document that organizes the company's official records about:
- **How data collection is done**, its processes, and activities;
- **What is done with the data**, if there is any processing or sharing;
- **How data is deleted**, if applicable.

In other words, the essential questions and answers in case of consultation by the ANPD - National Data Protection Authority, to your company. Below, we'll discuss each of these points in more detail.

It's worth noting that all documents and processes mapped by the company's Data Processor are "living," constantly being updated and changed. A new process created in department X can change the ROPA, the [Privacy Policy](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/), and many other controls.

So, regardless of the size of your company, documents should always reflect reality and be constantly updated.

Smaller companies may not feel the need or complexity of keeping these "Mapping of flows" updated, after all, everything is smaller and involves fewer people. Now, for a larger company, there are already software solutions that help with this control in a more automated way, such as [LGPDNOW](http://lgpdnow.com.br/), for example.

## What is ROPA?

ROPA (_Record Of Processing Activities_), translated by the Brazilian market to Records of Processing Activities, is an official document of companies, generated by a system or not, that records all flows, processing, and activities involving personal data.

In it, mainly list all the purposes and reasons why the company needs that data(s) for its operation, legal basis ([Legal Basis](https://goadopt.io/blog/en/legal-bases-of-lgpd/)), security criteria, data storage/retention period.

## Is ROPA the Same as Data Mapping?

The easy answer is: _it depends_.

[Data Mapping or Data Inventory](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/) functions as a visual map of the flow of personal data within the Data Controller, bringing much more than ROPA, such as system and international transfer maps, ISO compliance parameters, NIST, among others.

On the other hand, ROPA focuses on activities involving data processing. In a more structured company, it may happen that a Data Mapping contains some ROPAs as part of it.

In any case, recording activities is an essential part of both documents. The perspective and methodology applied in each can be their differential.

## What Should a ROPA Include?

According to the [ICO (Information Commissioner’s Office), a ROPA must include at least:](https://ico.org.uk/for-organisations/accountability-framework/records-of-processing-and-lawful-basis/#requirements)

- Name and contact details of your organization, whether it's a controller or a processor (and where applicable, the joint controller, its representative, and the DPO);
- The purposes of processing;
- A description of the categories of individuals and personal data;
- Categories of recipients of personal data;
- Details of transfers to third countries, including a record of the safeguards in place for the transfer mechanism;
- Retention/storage times;
- A description of the technical and organizational security measures in place.
- If you have an internal record of all processing activities carried out by any processor on behalf of your organization.

**### Questions the ROPA Should Answer:**

- Have you considered the effectiveness of your accountability measures?
- Would staff say you have effective processes to keep the record up-to-date, accurate, and ensure data is minimized?
- Could staff explain their responsibilities and how they carry them out in practice?

## Best Practices for a Good ROPA.

Also, according to the [ICO (Information Commissioner’s Office)](https://ico.org.uk/for-organisations/accountability-framework/records-of-processing-and-lawful-basis/#requirements), ROPA also includes or links to documentation covering:

- Information needed for privacy notices, such as the legal basis for processing and the source of personal data;
- Consent records;
- Controller-processor contracts;
- The location of personal data;
- DPIA reports;
- Records of personal data breaches;
- Information needed for processing special category data or criminal conviction and offense data under the Data Protection Act 2018 (DPA 2018); and
- Retention and deletion policy documents.

**Questioning for the creation of your ROPA:**

- Have you considered the effectiveness of your accountability measures?
- Do staff understand how to access other relevant documents linked to the ROPA?
- Is it easy for staff to access relevant documentation from the ROPA?
- Could staff explain this process and how it impacts their role?

## How to Create a ROPA for LGPD?

A good example for those starting out or with a smaller company is to use spreadsheets for this control and organization.

In addition, on the [gov.br website, there are various guides and templates to help you comply with LGPD.](https://www.gov.br/governodigital/pt-br/seguranca-e-protecao-de-dados/guias-operacionais-para-adequacao-a-lei-geral-de-protecao-de-dados-pessoais-lgpd)

For larger companies that need to structure these processes better, a privacy management and data mapping platform can be very helpful!

That's why we recommend that you schedule a meeting with the [LGPDNOW](http://lgpdnow.com.br/) team for a no-obligation conversation to see how they can help you develop your ROPA for LGPD.

Templates and models imported from other companies can be very helpful. But it's essential that you can clearly and objectively translate the reality of your company.

Every time we are faced with the complexity of justifying and basing the collection of data, we should always prioritize privacy throughout all processes, as taught by [Privacy by Design](https://goadopt.io/blog/en/what-is-privacy-by-design/).

## How Can AdOpt Help with ROPA?

According to the recommendations of the ICO listed above, AdOpt's LGPD Platform helps you map and organize:

- [Cookie Banner](https://goadopt.io/blog/en/cookie-banner/) within ICO, LGPD, GDPR, CCPA standards.
- Records of all written consents; (organized by user with date, time, and details of each consent.)
- API Integration with your other platforms to enrich the collected data with the consent information recorded.
- And more, depending on the size of your company.

We're here to help!

So, in this [link](https://calendly.com/valquiriaadopt), our calendar is open to discuss your business's adaptation challenges.

ROPA in LGPD? Get to Know the Records of Processing Activities.

The Data Protection Officer, or DPO, is a new position that emerged all over the globe with the new privacy regulations, and more recently at the [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/). Although it already existed in other international legislations, such as the [GDPR](https://goadopt.io/blog/en/website-needs-cookie-consent-gdpr-lgpd-ccpa/) of the European Union, it is still a novelty here since 2020. Along with it comes the possibility of outsourcing, known as DPO as a Service (DPOaaS).

Due to its novelty and the importance of its role, many companies and organizations are opting for outsourcing this activity. But is it really a good idea? What are the risks and advantages?

Find the answers to these questions and get to know the Data Protection Officer and their responsibilities as per LGPD regulations.

## What Is a DPO?

The DPO is an individual or legal entity established within Data Protection Policies as one of the agents involved in the processing and use of data subjects' information. Thus, their role is of utmost importance.

They can be either an individual or a legal entity. However, they cannot correspond to a department or team within the company. After all, documents related to data collection and processing must specifically indicate who is responsible as the DPO.

**### Learn more about the roles of data controller and data processor in LGPD**

The DPO's functions lie in mediating the relationship between data subjects, the data processor, and the National Data Protection Authority (ANPD).

They do not necessarily make decisions regarding data and its use. However, they assist in following and complying with the guidelines imposed by the data controller and the General Data Protection Law. Another one of the DPO's responsibilities is to provide guidance to employees who have access to third-party data, instructing them on how to adhere to LGPD guidelines and the consents that have been granted.

_### Their role is to educate, organize, and audit in accordance with ANPD regulations._

Some of the main activities that a DPO, whether outsourced or not, may perform include:

- Handling data subject complaints, providing clarifications, and taking necessary actions;
- Receiving communications from ANPD and taking appropriate actions;
- Handling consent revocations or changes in consent and taking appropriate measures;
- Ensuring the application of LGPD principles regarding personal data processing;
- Monitoring organizations' compliance with the General Data Protection Law, etc.

Thus, the DPO serves as an intermediary, mediating relationships and being one of the agents responsible for ensuring compliance with LGPD.

## When Can You Outsource the DPO?

Anytime a company or organization desires, they can outsource these services. The law does not require the DPO to be an internal employee. In fact, it does not even require the DPO to be an individual.

Therefore, any self-employed professional or company that provides services in this area can offer services to other companies. This involves the establishment of a service provision or outsourcing contract.

In the case of hiring an external person as a DPO as a service (DPOaaS), a service provision contract is established directly with the professional.

On the other hand, when a company is hired, there is an outsourcing of the DPO. The entity determined as the DPO within the Privacy Policies is the legal entity.

It provides professionals who will perform the typical duties of a DPO. However, they provide this service to a company due to their employer's hiring.

## Advantages of DPO as a Service

To determine whether outsourcing the LGPD DPO is worthwhile, it is necessary to consider the advantages it offers. Here are some of the main advantages:

First and foremost, it is essential for companies, organizations, and websites to have a clear determination of who the DPO is in order to comply with the [LGPD](https://goadopt.io/blog/en/ignoring-lgpd/). Currently, all companies must have one, although there are indications of a potential limitation of this requirement in the future.

### Below are some advantages of DPOaaS

### Agility
In this regard, note that it is not always easy to hire someone with the necessary knowledge for this role or to train them to fulfill the duties of a DPO. Therefore, compliance can be more rapid and straightforward through the outsourcing of such services.

### Speed
Once a qualified professional or even a company with multidisciplinary knowledge for the role is found, the adaptation process becomes much faster. This is because each company and market has its own specificities.

### Training and Qualification
Every new area and law requires extensive study and is subject to various short-term changes. Therefore, outsourcing this role also means outsourcing the responsibility of staying up-to-date and investing in the professionals' training.

### Autonomy
Roles involving oversight and audit can sometimes create conflicts with departments and even managers. It is essential for the DPO to have autonomy in their work and even stability, as prescribed by the law. After all, they cannot be threatened with job loss for overseeing processes within the company. Therefore, outsourcing this responsibility can lighten the organizational atmosphere.

### Flexibility
Just like any service provider, working with a contract makes it much easier to replace them compared to a full-time employee. Therefore, having a DPOaaS as a legal entity provides much more flexibility in case adjustments or replacements are needed over time.

### Lower Costs
Labor and social security charges are quite substantial in Brazil. Hiring a legal entity for this role can lead to reduced costs for the company while increasing the remuneration of the service provider.

**ATTENTION**: It is important to note that, regardless of how responsible a service provider may be for their role, they are still under the hierarchy of the employer. Therefore, ultimate decisions may be the responsibility of the company's administrators, even when using DPOaaS. Be cautious not to rely on outsourcing as a means of avoiding responsibility.

The same applies when the company does not appoint a DPO; the ultimate responsibility falls on the managing partners. When appointed, the professional acts on behalf of the company and its representatives before the national authority.

**### Do you know the difference between Data Mapping and [ROPA in LGPD](https://goadopt.io/blog/en/ropa-for-lgpd/)?**

## Hire Experts in the Field

Another interesting aspect of outsourcing the DPO is that this way, you can have an expert in the field. As mentioned above, it is not your company that is responsible for the training; it is the hired professional or company.

This ensures even greater security for operations to comply with LGPD and be in the hands of experts. It is even better when the professional is part of a network or multidisciplinary group that can assist with the specificities of your business and market.

## What Are the DPO's Functions When Outsourced?

In this case, the functions are the same as those of an internal DPO. After all, outsourcing only refers to the possibility that the activities are carried out by an external agent to the company.

As mentioned above, this agent can be a legal entity or a natural person. Either way, they must be specifically identified within the Privacy Policy and other documents related to consent, use, and data processing.

Any changes regarding who is responsible as the LGPD DPO must be reflected in policy changes. Failure to do so would result in a violation of the General Data Protection Law and the creation of risks such as [fines and even suspension of databases](https://goadopt.io/blog/en/fines-in-lgpd/).

Want to learn more about the [responsibilities of a Data Protection Officer](https://goadopt.io/blog/en/responsibilities-of-a-data-protection-officer/)? I've prepared this article for you!

Outsourcing the DPO (DPOaaS), Is It a Good Idea?

How do you deal with a profession that didn't even exist a few years ago and is now mandatory in companies? That's precisely the question that arises when we think of the [Data Protection Officer or DPO](https://goadopt.io/blog/en/responsibilities-of-a-data-protection-officer/).

This term, as well as the professional behind it, emerged with the enactment of privacy laws, in Brazil, the [General Data Protection Law - LGPD.](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) This law was enacted in 2018 and only came into effect in 2020. According to the law, they are responsible for ensuring the correct treatment of data that the company may use, which belongs to third parties.

And this responsibility assigned by the law to the professional figure of the Data Protection Officer may lead to the assumption that they are the sole and exclusive responsible party for the care that applies to such data. Is that the case? Is the job of the Data Protection Officer solitary or should it be a team effort? Find out all of this in the following sections.

## Data Protection Officer and Their Responsibilities

You know those lists where we see "future professions"? Well, if we considered 2021 as the future, the figure of the Data Protection Officer would be on that list because, in professional terms, it's one of the newest and most modern roles in the market.

After all, this position didn't even exist before LGPD or GDPR. The law created a new profession. This happened the moment the General Data Protection Law explicitly established the existence of this figure. At the same time, it laid out all of their responsibilities.

The Data Protection Officer or DPO (_Data Protection Officer_) is precisely a figure who must control and manage data processing - in other words, their use - in the day-to-day operations of the company. Thus, they are responsible for ensuring that all processes, flows, and actions respect the limits supported by the Legal Basis that underpins the use of that data by the company. Therefore, in the event of an inquiry from ANPD to the company, they are the ones who must respond on behalf of the institution.

### Learn more about the Legal Bases of LGPD.

Among the responsibilities of the DPO that are clearly stated in LGPD are:

- Execute tasks determined by the Data Controller and within the limits of that determination (and, of course, the law);
- Handle complaints from data subjects;
- Provide explanations about the use of data to data subjects;
- Communicate with data subjects whenever necessary;
- Take the necessary steps to reflect changes in data use and collection due to changes in the data subject's consent;
- Guide other professionals who handle this data and instruct them regarding security measures and the limits of consent and the application of this information.

By responding to the guidelines of the [Data Controller](https://goadopt.io/blog/en/differences-operator-controller-of-data-lgpd/), the DPO is not to be confused with this figure. While the controller refers to the one who defines the mode of treatment of information from its entry to its elimination, the Data Operator is the one who executes the process and ensures that it is strictly followed. When distinct, both the Controller and the Operator must have their respective DPOs.

### [Learn more about the responsibilities of the Data Protection Officer and how their work impacts companies in light of the General Data Protection Law](https://goadopt.io/blog/en/responsibilities-of-a-data-protection-officer/)

## All teamwork clichés become a reality in data treatment care as per LGPD.

There are several responsibilities that a DPO has within a company, as we've seen above. And this doesn't happen by chance, as data processing imposes specific limits and requires essential attention and care.

In this sense, it becomes clear that the Data Protection Officer accumulates a series of activities. But, no matter how well-equipped they are for their responsibilities and how up-to-date they are with the company's data processing activities, it's not enough.

_The isolated work of the DPO is something that is impossible to occur._

Or rather, it finds no possibilities of developing with the necessary quality and maintaining security against data leaks or improper use.

That's why when we talk about the work of the Data Protection Officer, we cannot understand that their activities are carried out in isolation or individually. The importance and number of responsibilities make their work a team effort.

To avoid any confusion, understand this: the DPO really is responsible for the issues involving data use. Thus, in the event of accidents or problems involving this information, they will be directly involved.

On the other hand, this does not mean that they should work alone. Quite the opposite! Ensuring that other employees and teams are involved in the care required by data processing due to LGPD is crucial.

The work of the Data Protection Officer is multidisciplinary. Legal, Technology, [Marketing](https://goadopt.io/blog/en/10-risky-processes-in-your-marketing/), Information Security, Process Management, Institutional Relations, etc. Since it's very difficult for one person to master all of these areas, the assistance of a support team is essential!

Only in this way is it possible to develop work in harmony, which takes place jointly to ensure the correct use of data. Therefore, don't isolate your DPO! Their work should take place close to other employees and with their assistance.

## Formation of a data security committee

One way to provide the Data Protection Officer with the support they need to carry out their activities successfully is to create a data security committee. It should be formed by various professionals representing the company's teams.

Moreover, they should represent the main interests involved when we are faced with data leaks or misuse. Therefore, it should have representatives from Human Resources, the Legal department, and Information Technology, at a minimum.

Likewise, they can include, regularly or in specific situations, representatives from the marketing team, as well as from the Communication, Sales, Finance departments...

With this, the DPO finds opportunities to jointly develop strategies, with each department's representatives helping with their implementation, as well as mapping the main problems that data processing encounters in various business processes.

Each representative acts as a direct extension of the DPO in their department(s), so it is important that they have a good understanding of the processes and autonomy in investigating flows and details.

## Knowledge of the company's data processing-based processes

As we've seen, the DPO is responsible for ensuring that data use occurs in accordance with the [legal basis](https://goadopt.io/blog/en/legal-bases-of-lgpd/) that supports the use of user data and within the limits of LGPD. Also, they must faithfully follow the instructions of the Data Controller.

There are numerous types of activities that occur simultaneously within a company that involve data processing. Consider, in this regard, an online sale. In this case, data such as address, CPF, phone number, and full name are collected, which should be used for:

- Billing;
- Generating invoices;
- Communicating the completion of the sale to the customer;
- Logistics for the separation and forwarding of the product;
- Offering tracking;
- Post-sale contact.
- ...

And these are just some of the activities that require data in a sales process. Therefore, it is necessary for the Data Protection Officer to be familiar with these processes, how they work, the data they use, how they are stored, discarded, and other such information.

Only in this way is it possible to know where the company is succeeding and failing in data processing, as well as to develop security strategies and ensure that data processing takes place within its limits and regulations.

## Establishing Limits and Rules for Data Use by Teams

Ideas and possibilities abound.
But to try to conclude this topic, one last tip.

When the DPO is in contact with the teams, they also become capable of guiding them so that, in their day-to-day activities, data processing occurs correctly. This can be done in various ways, such as through the development of a manual, training, etc.

It is crucial that everyone who in some way works with data processing has access to such standards and knows exactly what the limits of information use are.

With this, the teamwork of the Data Protection Officer not only becomes possible but also brings effective improvements to the company and makes it secure in compliance with LGPD guidelines.

Have you heard of [ROPA in LGPD](https://goadopt.io/blog/en/ropa-for-lgpd/), do you know what this document is?

Here, we talk a bit more about it, to help you with [compliance processes](https://goadopt.io/blog/en/10-risky-processes-in-your-marketing/).