In July 2019, the General Data Protection Regulation (GDPR) of the European Union issued the largest fine in the history of the law: 183 million euros. The fined company was British Airways, the English airline. The reason for the fine was a security breach that resulted in the personal data of over 500,000 customers being leaked.

Although the LGPD (Brazil's General Data Protection Law) has been in effect for some time now, the subject still generates many questions among Brazilians. What fines are specified in the LGPD? What is the maximum fine a company can receive? What is the deadline for a website to comply and avoid fines?

In this article, we will answer all your questions regarding fines under the LGPD (Brazil's General Data Protection Law).

##What fines have been imposed under the GDPR?

In the European Union, companies can be fined up to 20 million euros or 4% of their annual revenue, whichever is higher. As we saw, British Airways incurred a loss of 183 million euros due to mishandling of data.

In Germany, a police officer was fined 1,500 dollars for using a citizen's license plate to find his phone number for personal purposes. This shows that it is not only large companies that draw attention with their mistakes and get penalized.

But what about our LGPD? Will the fines be the same under Brazil's General Data Protection Law, which is inspired by the European regulation?

##What cases under the LGPD are subject to fines?

The LGPD must be fully complied with, not in parts. British Airways was fined a record amount for an unintentional slip.

Therefore, it is extremely important that you read everything about the LGPD and make the necessary adjustments as quickly as possible. Every company must have a Data Protection Officer, and it is recommended to use a [CMP](https://goadopt.io/en/), which makes the work much easier.

More significant slip-ups will result in higher fines, while minor slip-ups will obviously be penalized differently. The law states that the following factors will be taken into account:

• The severity and nature of the violations and the affected personal rights;
• The good faith of the infringer;
• The advantage gained or intended by the infringer;
• The economic condition of the infringer;
• The recurrence;
• The degree of harm;
• The cooperation of the infringer;
• The adoption of good practices and governance policies;
• The prompt adoption of corrective measures; and
• The proportionality between the gravity of the offense and the intensity of the sanction.

The complete administrative sanctions are specified in 52nd Article of the law, which can be consulted [here](http://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13709.htm).

##What are the fines and penalties under the LGPD?

The LGPD provides for six penalties or fines. They are as follows:

1. **Warning**: This warning comes with a deadline for the company to comply with the law. If the company fails to make the necessary corrections within the specified timeframe, penalties will be imposed.

2. **Simple** fine based on revenue: This fine can be up to 2% of the legal entity's revenue. The maximum limit is 50 million Brazilian reais per violation.

3. **Daily fine**: This fine is also limited to 50 million Brazilian reais.

4. **Public disclosure of the violation**: The violation becomes public, and the damage to the company's reputation can be significant.

5. **Blocking of personal data**: This administrative sanction prevents companies from using the collected personal data until the situation is regularized.

6. **Deletion of personal data**: The sixth penalty provided by the LGPD requires the company to completely delete the data collected in its services, causing harm to the company's operations.

The maximum limit for fines under the LGPD is 50 million Brazilian reais. However, some of the penalties can be even more severe, depending on the company. For example, publicly acknowledging the leakage of personal data from thousands of customers can undermine even solid companies, completely eroding the credibility of a brand.

But do these fines also apply to smaller businesses with minimal data processing operations? Or only to large companies like British Airways and Google?

**Can anyone be fined?**

The law refers to "data controllers." Any website or company that collects data automatically becomes a data controller.

However, there are exceptions. They are as follows:

• Natural persons who use data for personal and non-economic purposes;
• Persons who use data for journalistic, artistic, or academic purposes;
• Public security or national defense agents who use data to enforce the law.

In these cases, there is no need for formal consent. Therefore, there is no possibility of a fine since these activities do not violate the law.

However, every business, without exception, will be subject to fines once the law comes into effect. But until then, you have a task:

What is the deadline for compliance?

The deadline has already passed! The law came into effect in Brazil on August 16, 2020.

If your company is not yet compliant, we recommend that you start as soon as possible and gather as much information as possible about the law to avoid fines and penalties. 

To better understand the regulations, read the article **Everything about the LGPD**!







Fines in LGPD - What are they, amounts, and compliance deadlines

João Bruno Soares

Every day, millions of users generate data on the web, which is used by companies around the globe to improve their offerings. Therefore, in 2018, a law was created to regulate the use of personal data by companies, and this directly impacts digital marketing. We're talking about LGPD.

## What is LGPD?
[LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) stands for Lei Geral de Proteção de Dados (General Data Protection Law) in Brazil. It was sanctioned by interim President Michel Temer on August 14, 2018, after eight years of debates. The law came into effect in September 2020.

The focus of the law is not only to ensure transparency from companies that collect personal data but also to regulate the use of such data, aiming to uphold the right to privacy for all citizens.

According to the law, the user has the right to know the purpose and destination of the use of data such as:

- Name;
- Address;
- Location;
- IP address;
- Email;
- Phone number.

The data subject (you and me, as citizens, as named by the law) must have the option to [consent](https://goadopt.io/blog/en/consent-website-lgpd/) or not to the use of their data, know the purpose for which it will be used, and have the right to request its removal if desired.

The use of cookies is also regulated by LGPD, so if you use services that utilize cookies on your website, be aware!

The law defines four principles that companies must follow, with the principles of purpose, adequacy, necessity, and transparency being the most important.

The principles of purpose and adequacy determine that data collection must have a specific purpose, meaning that the company cannot use the data as it pleases.

The principle of necessity relates to collecting the minimum necessary data for the company to achieve its objectives in digital marketing.

The principle of transparency ensures that users have access to the information collected and know where it is being sent.

## The impact of LGPD on digital marketing
Firstly, the institutionalization of LGPD does not mean that companies need to stop working with data.

Instead, it is time to analyze your Instagram Ads strategies, for example, and work to improve them not only in light of the new law but in relation to the business as a whole.

The focus from now on is to value transparency with all citizens.

Emphasizing that their [consent](https://goadopt.io/blog/en/consent-website-lgpd/) is fundamental for all interactions will bring more security to both parties and ensure that business is conducted with more confidence.

Content marketing should gain strength. This is because companies need to treat customers as individuals and not just sources of data and metrics.

Investing in the production of relevant and personalized content is an excellent way to show that your brand truly cares about individuals, while also prioritizing obtaining data with consent.

Learn more about how to initiate the adaptation of your strategies to this new reality in the following section.

## Adjustments in digital marketing for LGPD

As you can see, LGPD creates new parameters for action for digital marketing companies. Adapting to it is as important for your strategies as knowing how to advertise on Google Ads.

There are a series of actions you can take without harming your business. Here are some of them:

## Obtain leads with legal support

Your leads need to be obtained based on the principles of LGPD. It is extremely important that the entire team is aware of them to ensure that the work performed does not violate the regulations.

Any action that involves third-party data (collection, access, use, storage, reproduction) must be based on user consent or another [legal base of LGPD](https://goadopt.io/blog/en/legal-bases-of-lgpd/), well-grounded, and based on the real needs of the data for the company's operations.

[In case of non-compliance with the law, the company may have to bear fines of up to 50 million Brazilian reais or 2% of their annual revenue or the equivalent.](https://goadopt.io/blog/en/fines-in-lgpd/)

## Don't hinder user navigation
Valuing customer consent also involves allowing them to:

1. Leave your website whenever they want.
2. Navigate while fully or partially consenting to data collection and the use of [cookies](https://goadopt.io/blog/en/cookies-and-lgpd/), for example.
- Some websites limit navigation to consent, thus not allowing visitors to access restricted areas without consenting. However, this is a specific decision of that company and not a mandatory requirement. Consent should be free and not subjective or coerced.
3. Revoke consent at any time.
4. Access the data that your company may have about them.
5. Request the deletion of such data.

LGPD aims to improve the user experience on the web, and this should also be one of the focuses of every company.

Prioritizing spontaneous communication is the best way to ensure more conversions.

Filling the user's page with invasive advertisements and unpleasant pop-ups will only make them never engage with your brand again.

To delve deeper into the topics of navigation and user experience according to [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/), research more about the concepts of privacy by design.

## Organize your segmentations
The creation of segmentations based on personal data, such as how Facebook Ads works, needs to follow certain parameters.

The point is to avoid practices considered discriminatory or invasive. This includes being intrusive in profile creation, manipulating customer expectations and desires, and taking advantage of people's vulnerability. And, as mentioned earlier, not using sensitive and irregular personal data for segmentation creation (e.g., uploading cold email lists).

So, always be respectful and professional when identifying profiles. Do not cross the line of common sense.

It is necessary to combat the idea that LGPD came to hinder Brazilian digital marketing. In fact, its purpose is to regulate the activity to ensure that consumer rights are being respected.

Therefore, companies benefit from the increased trust that users place in them.

And this will only be possible when marketing professionals themselves have this vision in every decision within their processes and routines.

If you want to continue on this subject, we have an article on [10 marketing processes that should be reconsidered with LGPD.](https://goadopt.io/blog/en/10-risky-processes-in-your-marketing/)

LGPD for marketing | A practical guideline.

The Brazilian Data Protection Law (_LGPD - Lei Geral de Proteção de Dados_) emerged a long time ago and has since drawn attention from numerous professionals. However, it is not uncommon to find websites and companies that ignore it, as they seek time to adapt. In this regard, how long can we ignore LGPD?

**Well, it is no longer possible to ignore it.** This has been a reality since its approval. Furthermore, it has been enforced since 2021.

With that in mind, it has been several years since this law was introduced, which leaves no excuse for ignoring it. Moreover, ignorance of the law can bring significant consequences, like [fines](https://goadopt.io/blog/en/fines-in-lgpd/).

Therefore, the clock is ticking against those who have chosen to postpone the necessary adaptations imposed by LGPD. It is time to change your stance. How and why to do so will be explained below.

##But what exactly does LGPD require?

[LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) is often mentioned, yet little is said about its actual requirements. However, it has become essential for online users and website owners to understand what it entails.

Only then can the true importance of this law be comprehended. But don't worry, we won't use legal jargon to explain it to you.

The [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) is a nationwide regulation that came into effect in 2020. Many expected it to be implemented later, as there were speculations about its postponement, as seen before.

However, that did not happen. In other words, LGPD has been a reality since 2020 and requires attention. Many believe that it only applies to companies and their websites. However, it governs how all legal entities, including companies, governments, NGOs, associations, churches, and various other organizations, handle the data of the country's citizens.

It is worth noting that [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) and all other privacy regulations do not only focus on digital data but encompass all types of data. Therefore, how a company handles an email provided on a website or on a clipboard matters! Similarly, this extends the care to not only the website's servers but also to files, cabinets, and notebooks that "store" such data.

In summary, all processes in your company that involve personal data in their workflows must be reevaluated and adapted.

Assuming that you already understand that every time you visit a website or take an online action, both your browser will record signals and the website will receive information about you. Let's reinforce that this cannot happen indiscriminately, right? That is precisely what the General Data Protection Law addresses. It ensures limitations on the use of personal data, whether on websites or any other environments.

(If you haven't grasped that we are talking about Internet Cookies, read about them here before proceeding.)

With this, the law aims to protect users' privacy and intimacy. It also ensures that they have a better understanding of how their data is used and the security measures taken by the company that has access to that information.

But it doesn't stop there. LGPD also introduces data classification concepts and specific safeguards regarding data breaches and handling.

Ultimately, this law aims to promote transparency between websites and users. It imposes measures that can ensure their security. Therefore, in summary, it establishes four crucial points regarding data protection:

- Appropriate handling and use of personal data.
- Request for authorization and/or revocation regarding data collection.
- Penalties for companies that fail to comply with the aforementioned measures.
- Freedom for all citizens to access their own data.

##Tic Tac: There's no more time to ignore LGPD, see the consequences of doing so
It should be clear to you by now that LGPD has brought forth a series of important issues that completely impact the way companies operate.

Now, bringing it into the digital environment we are currently in, it becomes even more crucial for companies to demonstrate transparency to their visitors and strictly adhere to authorizations and policies.

Although the law granted a transition period for companies until August 2021, that deadline has already passed. In other words, the application of penalties and fines under the General Data Protection Law is now possible for websites that fail to comply with its guidelines.

Therefore, if your website still doesn't have clear privacy policies, in the case of cookie usage, or a [cookie banner](https://goadopt.io/blog/en/cookie-banner/) that respects personalized authorizations, it is at risk.

The penalties under LGPD are quite severe and include warnings (less severe) and [fines](https://goadopt.io/blog/en/fines-in-lgpd/). For non-compliance, the [fine](https://goadopt.io/blog/en/fines-in-lgpd/) can be up to 2% of the company's annual revenue (with a maximum calculation base of R$ 50 million). Additionally, there are possibilities of sanctions that can block a company's database until they regularize their operations.

In this sense, continuing to ignore the law that regulates data security and protection is shooting yourself in the foot for your company.

By doing so, you put your website and your company at risk. Even in the best-case scenario of receiving only a warning, persisting in the error will affect your finances and the image of your website, as well as access to data that is crucial for your activities.

##How to adapt to LGPD and avoid problems with the law?
Ignoring LGPD is no longer an option since the deadline for compliance with the law has passed.

As we are currently in the digital environment, let's focus on how to help you in this process. After all, many companies nowadays have a significant portion of their processes and operations in the digital realm. Such as e-commerce, digital agencies, product launches, info product creators, startups, and more.

All the examples mentioned above rely on the use of personal data for marketing automation, landing pages, various tracking pixels with remarketing cookies, media campaigns, and so on.

In short, it is impossible to continue ignoring this law. But how can you put it into practice? Don't worry, we have prepared a basic step-by-step guide with some essential principles.

>Remember, LGPD is not just a checkbox on your website; it involves a change in processes and a culture focused on privacy. So, below are some tips. If you take them seriously, you will find some valuable further guidance at the end. (Some people are charging a lot for the information we provide here for free - you're welcome!)

>#Important _LGPD is not just a checkbox on your website; it involves a change in processes and a culture focused on privacy!_

##Plan your Compliance, "Know Your Mess."

First and foremost, it's impossible to talk about LGPD compliance without a plan. What does that mean? Understand that you'll never feel confident in what you're doing if you don't know where the data is, where it comes from, where it goes, who processes and uses it. Therefore, you need a [Data Mapping, here's an article ](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/)that will help you understand what it is and how to create one.

You know when you're at the grocery store and you see a product out of place? It's kind of bizarre, right? It gives us an uncomfortable feeling, as they would say in the South of Brazil. So, seriously, dedicate some time to this, and you'll see that all the other steps will be simplified. You don't want to find a toothbrush in your sock drawer when the Regulatory Agency comes knocking at your door.

##Work on a privacy policy.

First and foremost, it's impossible to put LGPD respect into practice without developing a privacy policy. It provides comprehensive information on how the company collects data, how it uses it, with whom it shares it, its usage deadlines, and other details.

Likewise, it clarifies how data is stored and what precautions are taken to ensure security against leaks, for example. So, remember to use clear and accessible language and address all relevant points in detail.

What's the basis for writing a good policy? Guess what! Your Data Mapping from the previous point. So, don't skip the previous step, trust us!

Here's an article to help you with the [privacy policy](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/).

##Use a cookie banner and configuration tool.

Remember that we're talking about digital companies, right? These companies have a very peculiar characteristic: the entry points for data are usually all digital. Therefore, it's much easier for us to control what goes through them! And even better, with the use of technology!

That's why your [Cookie Banner or CMP - Consent Management Platform](https://goadopt.io/blog/en/what-is-a-cmp/), when properly implemented, becomes practically a "Pareto of Compliance," those 20% of effort that solve 80% of the problems.

In other words, make sure your website has an appropriate cookie banner that helps you organize data from the moment of entry. The cookie banner won't be your silver bullet, but it will be an excellent start to keep things in order over time.

[Here's an article for you to better understand how an LGPD cookie banner works.](https://goadopt.io/blog/en/operation-of-cookie-banner/)

For that, rely on Adopt. Our team consists of experienced professionals in the market who provide all the assistance you need. Here, we help you [choose a cookie banner for your website.](https://goadopt.io/blog/en/how-to-choose-cmp-consent-management-platform/)

##Be cautious with information security.

Another important point for adapting your company and website to the Data Protection Law is to increase the focus on information security. Companies have always been responsible for leaked data, but now even more so! Therefore, let's work hard to prevent any leaks or resulting damages that can have serious consequences for companies and the individuals whose data is exposed.

Therefore, highlight the risks of leaks and security in your data mapping. Once again, dedicate time to these security criteria and processes. You won't regret having them mapped and controlled because, in times of chaos, the best feeling is knowing that you are prepared and know what to do!

##Be cautious with marketing actions.

Finally, also apply your care in applying LGPD to your marketing actions. After all, it's necessary to strictly adhere to using communications and campaigns only to those who have authorized their receipt, as well as other flows that are triggered through the use of personal data.

Here's another interesting article for you: [10 Marketing Processes You Need to Reconsider under LGPD](https://goadopt.io/blog/en/10-risky-processes-in-your-marketing/).

As mentioned before, these are just a few steps. If you want to delve deeper into compliance topics, the next article for you is [here](https://goadopt.io/blog/en/lgpd-meaning/).

How long can we ignore LGPD?

Sad, but this story is more real than you think.

It all started with a "**surprise**" fine.

Ever imagined everything crumbling around you?
All because of a fine, **an invoice that came "out of nowhere"**?
Your bank account, clients, your job, your car loan, marriage...

All ruined.
Everyone on the streets, from the doorman to the big shots.
No one was spared.
It was Tuesday when the government email arrived, at 8:30.
I had just grabbed a coffee, and my computer was still booting up.

Our company's name was everywhere.
But, in the worst possible way.

We became the "**Example of what not to do.**"
Man, I felt like a criminal.

Seriously, no one cares about it until it happens to you.
(I think we were reported)

I didn't quite understand, skimmed through it, read it again...
Then I sent it to the lawyer... of course!

He called me - yelling at me!
(I had never seen him yell before.)

_"But aren't you compliant with the Privacy Laws? Didn't we talk about this?"
"I thought everything was in order,"_ he said.

"Yes, Doctor, it was!" I nervously replied.
**"All in the plan, but for next month... We didn't have time, so much to do!**"

You know what he told me?

_"My dear, **the Government couldn't care less about your planning!**"
"Get this done, yesterday!"
"STOP sending emails however you want!"
"STOP with this kind of marketing!"_

_"Man, nowadays, it's all about digital marketing..."
"No way - the law is the law!"_

He kept repeating that.
_"The law is the law!"
"Whether it's a bank, a newspaper, or a small online shop that just started yesterday."
"The law is the law!"_

Suddenly, I found myself shouting back.
"OK, but... how? WHAT'S MISSING?"
"The privacy policy has been on the website since..."

He interrupted me again!

_"Where's the cookie banner I sent you?"_
(To be honest, I've never understood that annoying "accept cookies thing.")

_"Pay attention! Now, that would be our public proof that YOUR COMPANY is doing 'something', you know? That's why there's that 'annoying notice' on every website, man!"_
_
"It works as insurance for YOU. It shows that you're aware, that you care about the law, you know?"_

I almost choked on my now-cold coffee when he said that.

_**"The Government couldn't care less about your good intentions."**_
"Alright, Sir. But, now what?"

_"Now? You tell me! How are you going to prove that a certain person let you use their data? You'll have to work twice as hard... A good cookie banner helps with that proof, providing the details we need, now, got it?"_

_"Or do you think these big companies do it for no reason? ... 
No one knows when, man, no one!"_

By that point, I had already finished my cold coffee. Just before he hung up on me, he said:

_"Everyone thinks the law only catches the big guys…
The fines are getting to the small companies, already. 
Didn't you see the news about the fine?"

"What country do you live in?"
"I'll call you back; let me check something."_

(hung up)
…

How much is your peace worth?
How much have you invested to get where you are?
Can you guarantee that this won't be your story?
As the saying goes: "Better safe than sorry."

That's what [AdOpt](https://goadopt.io) does.
We are the best cookie banner on the market.

Because even if the law changes out of the blue, we'll update everything and be here, 24 hours a day.

Protecting Johns' car shop website in Chicago, and Alice's thrift e-commerce in Boston... even for North Face, GoPro, DIESEL, JanSport…

Because no one wants to take that risk. Or do you want to pay?
When was the last time the government helped you?
Some fines can be up to 2% of your ANNUAL revenue for each violation committed. Can you afford that?

**Don't postpone the protection of YOUR company!**

Mark it done in your to-do, NOW.

In minutes, you secure your sleep and get back to focusing on what matters.

So, are you willing to take the risk?
Will you postpone it again?


Once upon a time, there was a company that got fined. - THE END

Since September 2020, companies' online actions regarding the data of their suppliers, customers, and employees require greater care. This was the milestone since the General Data Protection Law ([LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/)) came into effect. Therefore, LGPD also has an impact on inbound marketing.

And for those who have not yet adapted, time is up! Since August 2021, [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) the a grace period for compliance ended, and now the consequences are in effect!

In other words, currently, those who do not operate in accordance with LGPD's provisions risk facing penalties ranging from warnings to the suspension of their website, databases, and hefty fines. To prevent this from happening to your website, keep reading and learn how to adapt it, along with inbound marketing, to [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/).

## LGPD requires a review of the marketing you promote - Understand why

The [General Data Protection Law](https://goadopt.io/blog/lgpd-lei-geral-de-protecao-de-dados/) was approved back in 2018, although it only came into force last year. This norm imposes a series of obligations that apply to websites, companies, and organizations in general. It actually affects all types of institutions that have access to and use personal data, such as names, addresses, CPF, phone numbers, etc.

Its goal is to ensure transparency and fairness in how a page with its visitors, for example, uses their data! After all, concerning online data, consider that websites capture information about the users who visit them and also those who use their services.

This data capture occurs in various ways. For example, forms, newsletter registrations, downloading of rich content, whether for informative or commercial purposes. Oh, and cookies as well. Also, through digital marketing tools like Google Analytics.

Thus, LGPD requires that marketing actions aimed at collecting data be reviewed. After all, according to the law, users must now be informed about the types of data the website collects, how it uses them, the purposes for which it applies, the usage period, and - no less important - provide a channel for citizens to request the removal of their data whenever possible.

And all of this, of course, must be done with the user's consent and permission, for those who use [Consent as a Legal Basis](https://goadopt.io/blog/en/legal-bases-of-lgpd/), and/or well-founded in other legal bases in your industry, and/or complementary. Thus, such compliance and direction must also be expressed so that the page safeguards its rights to use this data, in accordance with the law.

> It's worth noting - The use of personal data has not been prohibited but regulated. Therefore, its use requires adaptation and compliance with certain requirements set forth in the law.

## And where does inbound marketing fit into this?

LGPD brought requirements regarding transparency and the possibility of using data by everyone, including websites. Therefore, data capture is now under greater control, so that everyone can have an idea of how their data is used and the limits of that use.

That's why it directly affects inbound marketing, i.e., attraction marketing. It encompasses all the actions your company takes to attract the attention of potential customers who, when they become interested in your content, services, or products, sign up or make a purchase. In other words, it's for lead generation.

For example, when you have a landing page for a product or service. Or when you offer exclusive content, such as videos or e-books, in exchange for registration. Similarly, in contact forms.

All of this involves the use of consumer data, right? Therefore, it also requires clarity regarding the use of this information and the precautions taken to maintain the individual's security and privacy.

So, note that everything related to data capture must be explained to the visitor or customer. And this should be done through a [Privacy Policy](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/) that provides all the information on how the data is processed and stored. And if your service is offered in the digital environment, clarity in the Terms of Use is also essential.

## What to do to adapt inbound marketing to the General Data Protection Law

As mentioned earlier, the deadline for adapting pages and their actions regarding user data, according to LGPD, has already ended. Therefore, now all those that are not in compliance with the law are in a risk zone. This risk may not necessarily be completely eliminated, but it can be controlled and well managed.

But how do you adapt your inbound marketing actions according to LGPD to avoid fines and warnings, as well as suspensions? That's what you'll find in the items below, so be sure to check them out and, most importantly, implement these solutions.

### Ensure that only strictly necessary data is collected

First and foremost, your marketing must ensure that it is only collecting data that is truly necessary for the actions to be performed. For example, in a sale, you will need to know card data, CPF, full name, and address.

On the other hand, there is no sense in requesting specific data such as race, sexual orientation, religious or political preferences. All of this is irrelevant for the action you intend to take, so collecting and using data like these is not justified.

When the goal is privacy, less is more - literally.

### Lead capture and specific authorizations for each purpose

Similarly, understand that each specific lead will have specific authorizations. But what does that mean? Consider that a visitor to a page subscribes to receive informative content you produce. In this case, authorization relates solely to this type of sending.

Therefore, in this case, you cannot use the registration data to send advertisements for products and services you have or offers you provide. After all, this goes beyond the reason the consumer gave their data.

So, consider that every time there is a subscription for an action, there will be a specific authorization for that purpose. The consumer must give authorization for each act in which their data is disclosed.

In this way, consider that a subscription for informational purposes has an authorization that demonstrates the specific purposes of use; another one for registering for offers; and another one for registering for a purchase.

Unfortunately, many companies register email addresses delivered for other purposes in their newsletters. This should not be done!

Here we have another article to help you with the adaptation of these [digital marketing processes](https://goadopt.io/blog/en/10-risky-processes-in-your-marketing/) that go beyond inbound marketing; it's worth taking a look if you are new to this.

### Have a clear privacy policy regarding data use

Furthermore, it is essential that your company has a clear and concise privacy policy!

Many companies choose to include it along with the [cookie banner links](https://goadopt.io/blog/en/cookie-banner/), but that's a matter of preference and taste. Avoid legalese, don't create mazes for your readers, and focus primarily on the accuracy of the information. After all, a policy, when accepted, has implications for both parties, so fulfill what is stipulated there.

Here we have some articles to help you review and understand privacy policies. After all, [what is a privacy policy](https://goadopt.io/blog/en/what-is-privacy-policy/) and is there [an ideal policy for your company](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/)?

### Some metrics will be directly impacted.

One of the main metrics that is impacted by LGPD, specifically by the use of a properly configured Cookie Banner, is Analytics metrics. This happens because the cookie banner, or CMP, must allow the firing of each service's cookies only after the user's consent is given in that specific banner.

> [Understand how a LGPD cookie notice works](https://goadopt.io/blog/en/operation-of-cookie-banner/)

As the vast majority of visitors reject or simply ignore them, not all visitors to your site give consent to Analytics. Therefore, the numbers will drop significantly. It is estimated that only 1 in every 5 visitors gives consent. So, don't despair because this is expected, and there are other solutions for analytics that do not use cookies and/or trackers that are blocked in the banner, respecting privacy. One of them is Cloudflare, which, in addition to its performance services, can also provide analytics estimates.

Of course, it will not be of the same quality and traceability as Google Analytics, but you can create a multiplier based on the difference found to analyze the discounted numbers more accurately.

### Marketing automation must be in compliance

Once the importance of using personal data only for the purpose for which it was actually collected/accessed has been emphasized, it is necessary to highlight that your marketing automation tools must reflect these purposes. Therefore, review your automations and be sure to include them in your Privacy Policy since many of them not only process and store data but also trigger cookies.

Knowing that many companies use their automation tools as CRMs, in fact, with a repository of company data as a whole, avoid storing unnecessary or outdated data. Always seek to clean up useless or "cold" data, which means data that has no consent or has been in the system for a long time.

Remember, having a database with millions of contacts is of no use if it is not engaged and if it has been accessed in a way that is currently illegal. Attention! This number can be a vanity metric, and if its use is not supported by a legal basis, it is wrong.

Therefore, your effort should be to always keep the database active and appropriate. One way to speed this up is to link the consents generated by your site's cookie banner to the registration of personal data of your visitors in your CRM.

Many of our clients already do this, which helps even in responding to customer requests.

With the help of a programmer, access the [AdOpt Call-Backs](https://goadopt.io/en/support/callbacks-api/callbacks/adopt-callbacks-endpoints/) and link the data generated by AdOpt to your site's form submissions. So, every time someone fills out the form, AdOpt will also provide the AdOptID for a hidden and custom field in your form, feeding the CRM with that information associated with the provided data.

Then, with campaigns to encourage visits to linked pages, you can use the AdOpt tool as an additional layer of security, through the generated consent, now attached to that lead.

These were just some points for those looking to start the [adaptation of their marketing to LGPD](https://goadopt.io/blog/en/how-to-adapt-digital-marketing-to-lgpd/). So, if you have any questions or even suggestions for more points that we can list here to help in this process, send them to us!


The impact of privacy regulations, like LGPD, GPDR... on Inbound Marketing

Since the sanction of the [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) in August 2018, through the approval of Provisional Measure No. 869/2018, until the conversion of the MP into law (Law No. 13.853/2019), the Data Protection Officer (DPO) role has gone through some twists and turns, such as the possibility of the DPO being an individual or legal entity, and the requirement of having regulatory legal knowledge.

Therefore, this brief article aims to provide some clarification regarding this crucial role in the context of data protection. Job vacancies have indeed arisen, but along with them, the responsibility and demands of the market!

In the definition of Article 5, item VIII, of the LGPD, the DPO is the "_person appointed by the controller and operator to act as a channel of communication between the controller, data subjects, and the National Data Protection Authority (ANPD)_."

Drawing an analogy from the world of soccer, we can think of the DPO as the "midfielder" of the team, responsible for connecting the defense and the attack. Visually, we have:

![RESPONSABILITIES DPO.png](https://strapi.goadopt.io/uploads/RESPONSABILITIES_DPO_e0c6ad2579.png)

Thus, the DPO is the figure responsible for mediating the dialogue between the controller and the data subject or between the controller and the ANPD, accommodating their needs and interests.

## What are the responsibilities of the Data Protection Officer?

Among their various responsibilities, all outlined in Article 41, § 2 of the LGPD, the DPO's activities consist of:

_I - accepting complaints and communications from data subjects, providing explanations, and taking action;

II - receiving communications from the national authority and taking action;

III - guiding employees and contractors of the entity regarding practices to be taken regarding the protection of personal data; and

IV - performing other duties determined by the controller or established in complementary regulations._

To fulfill these responsibilities, the DPO must master data [mapping techniques](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/), identifying all possible sources of collection, as well as controlling the data's lifecycle, i.e., how it will be stored and used, with whom it will be shared, when and how it will be deleted.

Another fundamental aspect for the DPO to truly fulfill the role that the [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) proposes is autonomy in decision-making power and the exercise of oversight of internal company processes. Naturally, as a professional hired by a particular company to act according to its interests, the DPO will have a degree of subjection to the guidelines of their employer. However, this should not compromise their position as an intermediary between the data subject and the ANPD.

In conclusion, it is worth considering that although the current wording of the LGPD no longer requires the DPO to have regulatory legal knowledge, knowledge and, above all, mastery of the LGPD and other applicable regulations in the context of personal data protection are essential for the effective performance of the DPO's functions. This is especially true because the LGPD should not be analyzed in isolation but always within the context of the market and the company's regulations seeking compliance.

Nevertheless, the growing concern of entrepreneurs regarding the LGPD is natural. After all, Brazil is an extremely complex country for entrepreneurship, and every new regulation brings uncertainty and instability to the game.

_**ABOUT THE AUTHOR:**_

_**Dânton Zanetti**_ _is a lawyer, founding partner of_ _Zanetti, Oliveira & Machado Sociedade de Advogados_ _([www.zomadv.com](http://www.zomadv.com)), working in the areas of Business Law, Contract Law, and Digital Law, with a Master's in privacy and data protection._

Responsibilities of a data protection officer.

Have you ever noticed that every time you sign up for a service to access information or register on a website for purchases, you need to give consent? If you're wondering why you have to give consent on every website you visit, you'll find the answer here.

Even though this consent is often "automatic" and happens without you thinking about it (which it shouldn't), it is very important. After all, it is a legal requirement that applies to the website and pertains to the security of your data.

Since data is becoming increasingly important and data breaches can cause significant harm, understanding what you're consenting to and what it means is indispensable. So don't miss the opportunity to learn more about this topic!

## With LGPD, Silence Doesn't Imply Consent

To understand how consent has become so important regarding data collection and use in the online environment, we need to go back to August 2020. That was the month when the [General Data Protection Law (LGPD)](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) came into effect.

It was introduced as a response to the need to protect data shared on websites and collected by web pages, as well as to regulate their processing. Notably, in recent years, massive data breaches of personal information, such as the Facebook breach, have alarmed users.

Therefore, privacy laws like [GDPR, LGPD, CCPA](https://goadopt.io/blog/en/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) have consolidated the notion of consent for data usage. In other words, all websites that use cookies and collect data from their users for any purpose (such as marketing) not only need to inform but also ensure agreement.

This happens when you access a website and need to grant permissions for cookies, for example. Even though cookies are just one form of information collection, they are a good example of consent.

The same thing happens when you access a page where you need to enter personal data. For example, when subscribing to a newsletter and landing pages. Similarly, when registering for a purchase. In these cases, there's always a box that says "I agree to the [terms of use](https://goadopt.io/blog/en/terms-of-use-lgpd/) and [privacy policies](https://goadopt.io/blog/en/what-is-privacy-policy/), " right?

Know that in all these cases, consent is given for the use of your data. It relates to the company's security and information treatment policies, as well as which data is used, when, how, and for how long.

Of course, there are other [legal bases](https://goadopt.io/blog/en/legal-bases-of-lgpd/) that also ensure the correct use of citizens' data. However, for many, consent ends up being the quickest and most accessible option in their business flow.

[**### Discover how to adapt your digital marketing to LGPD.**](https://goadopt.io/blog/en/how-to-adapt-digital-marketing-to-lgpd/)

## What is the importance of the consent policy for the website and the visitor?

The consent that you might be tired of giving - but shouldn't, as it concerns your security - is important for both websites and you, as well as other visitors and users.

Well then, let's start with the visitors because the preference is theirs! For them, consent is important because it's only through it that the companies behind the websites can use their data. They can use it only within the limits stipulated, both in terms of time and application.

So, if you have the habit of giving consent to websites without carefully reading the terms beforehand, it's time to change that approach! The use of your data is important and relates to your security (including financial security!).

Therefore, it's important to be aware of what you're allowing and what the company's policies are for protection purposes.

In this sense, it's necessary to pay attention to two different text documents: the Terms of Use, regarding the rules of service utilization responsibility and limits of duties and rights; also, the Privacy Policy, which concerns the treatment of information and security details.

On the other hand, the consent you give to websites is also important for them, obviously. After all, this is the only way they can really use the data (within the informed and consented limits) in accordance with LGPD.

Learn more about [how the cookie banner work](https://goadopt.io/blog/en/operation-of-cookie-banner/)!

Moreover, LGPD imposes significant [penalties](https://goadopt.io/blog/en/fines-in-lgpd/) on those who violate it. In this regard, it can impose warnings as well as [fines](https://goadopt.io/blog/en/fines-in-lgpd/) that can be quite high! It can also lead to restrictions on data collection and the banning of the page.

## What types of pages need to obtain visitor consent?

The vast majority of websites that collect data in some way and use cookies need to obtain consent from their users. There are various types of data collection, ranging from cookies to voluntary information acquisition through page registrations.

In this sense, all pages that use tools for analyzing results and metrics, such as Google Analytics, already have a duty to obtain consent from their visitors for this.

Similarly, landing pages, contact pages with user information disclosure, and other data registration forms will always need policies of agreement regarding data collection and usage.

Especially when, according to the company's business model, other [legal bases](https://goadopt.io/blog/en/legal-bases-of-lgpd/) are weaker in terms of data usage rationale. Thus, consent ends up being an excellent option.

## Cookie Banner

Firstly, one of the methods for obtaining consent is through the Cookie Banner, right on the page.

In this case, the page's opening must clearly inform the use of cookies and allow the visitor to configure their preferences and give their permission. Only after consent, the cookies can be triggered.

[### **How to configure third-party cookie blocking in AdOpt?**](https://goadopt.io/en/support/essential-setups/3rd-party-cookie-blocking/manual-third-party-tag-blocking/)

For this purpose, your website can rely on AdOpt. With our tool, your cookie usage policies are always clear to the user. In addition, alongside the banner, you can configure the blocking of third-party cookies, multi-languages and legislations, text customization, positioning, colors, and images.

[_Have you heard of the ROPA document in LGPD? 
It's essential and can help you a lot in your compliance!_](https://goadopt.io/blog/en/ropa-for-lgpd/)

## Terms of Use and Privacy Policy Notices

The other method of applying consent policies on a website is precisely on pages dedicated to contact forms, landing pages, and site registration. Using those "I have read and accept" checkboxes.

In this case, it is essential that the user has access to the documents that reveal them and that they must allow the use of such information before continuing their online action.

Therefore, always make sure that these notifications halt the process. This way, only data that truly has the visitor's consent is collected.

If you are an [AdOpt](http://goadopt.io/) customer, our technology allows this online form consent collection to be integrated into the platform as a whole. This means that your CRM has another field fueled by visitor consent.

Want to know how? Just chat with us or schedule a presentation conversation [here](https://calendly.com/valquiriaadopt).

Fines in LGPD - What are they, amounts, and compliance deadlines

LGPD for marketing | A practical guideline.

How long can we ignore LGPD?

Once upon a time, there was a company that got fined. - THE END

The impact of privacy regulations, like LGPD, GPDR... on Inbound Marketing

Responsibilities of a data protection officer.

Why Give Consent on Every Website I Visit?