Is there an ideal and _foolproof_ Privacy Policy?

This is one of the most difficult questions to answer nowadays. Especially considering all the jurisprudence already established in Europe with the GDPR, the extensive history of cases, and the numerous tips we see in the market. Not to mention the judicial decisions that are already emerging in Brazil with the LGPD.

I'll answer you promptly: No. And I'll help you understand why.

I believe it is possible to develop a line of reasoning that can assist each one of us entrepreneurs, DPOs, lawyers, third-party consultants, etc. Ultimately, everyone can have a clear understanding of how the game works to avoid being caught off guard.

Below is the logic behind a privacy policy and some principles to help you understand the game. Perhaps even assist you in adapting your company and addressing any doubts that may arise along the way.

What makes a privacy policy better or worse?

To be as straightforward as possible: Does it accurately reflect the reality of data usage and flow within the company?

Here is the key to understanding any privacy policy: It must truthfully reflect the motivations and data flow in the company's routines.

Therefore, before we evaluate the quality of a privacy policy, it is essential to understand why it exists and its purpose. Is it becoming clearer?

In a simple and direct manner, I would highlight that a company's privacy policy is:

A public declaration of the objectives, interests, and responsibilities that companies have regarding the use and application of data, especially personal data, for the execution of their business model.

In other words, the guidelines provided in the privacy policy give us a real understanding of how that business operates regarding data usage and the actual commercial and/or legal purposes for which the data is used.

What do I need to know and map out to create my Privacy Policy?

In essence, it is not possible to structure a privacy policy without understanding the foundations of the business. Don't worry, I'm not complicating things for the sake of it, but rather showing you that without this knowledge, even a lawyer charging thousands of dollars per hour won't be able to assist you.

By the way, a good piece of information for you is that the privacy policy does not necessarily need to be written by a lawyer or in "legalese." According to the LGPD, before anything else, it must be clear, educational, and easily readable for the data subject. So, whether it's you, your lawyer, or anyone who understands the processes, purposes, or legislation of your market, it's all good. Prioritize readability, clarity, and the ability for any visitor or customer accessing your platforms to understand and interpret the information.

However, it is worth noting that we recommend at least seeking advice from a lawyer. There are certain criteria and potential complexities in the market that they can assist you with more adeptly. For example, the healthcare industry has specific legislation that already treats patient data differently, and therefore, it may sometimes supersede LGPD requirements.

We are in Brazil, my friend, so, as usual, everything depends on the specific circumstances.

Anyway, let's go through the essential points you need to know to create any privacy policy. Points such as:

1. ### Corporate structure;

2. ### Market sector;

3.### Relevant laws governing the activities of players in the market;

4.### Product and/or service portfolio;

5.### Revenue streams and distribution channels;

6.### Basic understanding of the company's organizational structure;
(Headquarters and branches, size, number of departments involved, decision-making hierarchy, etc.)

7.### Supply chain;

8.### Sales and after-sales service;

9.### Communication channels;
...

Without this initial detailed understanding, the privacy policy will be incomplete and consequently flawed.

For example, what good does it do if I state that I use data on Facebook, collect addresses, emails, and CPF (Brazilian individual taxpayer registry number) for signing up for my plan and for email marketing, with data disposal in case of opt-out, if there is a legislation in my market that requires me to store this data beyond the data subject's requests?

I believe it is clear now how much information we need to consider. However, this should not discourage you! In fact, it is precisely the knowledge of these processes, or in other words, the understanding of the entire operation, that will give you greater confidence to determine whether the privacy policy is "good" or not. Again, it must reflect the reality and day-to-day operations of the company.

One of the tools/processes that can help you confidently structure the privacy policy is Data Mapping. If you don't have one yet or haven't considered implementing it, I'll summarize it for you in the link below.

Data Mapping: The Life Jacket for LGPD

What is the ideal privacy policy for your company?

João Bruno Soares

While it's not exactly breaking news, discussions about privacy policies have been popping up more frequently since the start of GDPR in Europe. And despite it seeming coincidental, it's not!

After all, this term is directly linked to the [LGPD or General Data Protection Law](https://goadopt.io/blog/lgpd-lei-geral-de-protecao-de-dados/) that came into effect in August 2020. However, if you're not familiar with it, don't worry because we're here to help you.

Below, you'll find everything about this type of policy, how it works, and its importance. Also, take the opportunity to learn how to develop one for your company and thus, comply with the legislation that's already in effect in the country.

## **Understand everything about privacy policies**

It's time for you to understand once and for all what these terms are and why you shouldn't ignore them when visiting a website! After all, your security and your data's security are at stake. Want to understand how? Read on!

Privacy policies mainly apply to the online environment and concern the protection of your data. In general terms, they correspond to a company's statement regarding how it handles your information, and now, with LGPD specifically, your personal data.

But how is that so?
Well, your online activities leave traces. That is, data that websites and social networks store, generating information about you. Similarly, these are recorded by your browser. However, this can't happen inadvertently because merely "browsing these environments" already generates data and, consequently, personalized data collection.

In other words, the legislation protects us citizens from websites simply collecting information and using it as they see fit.
This, in fact, is the focus of LGPD. This makes it even more evident that a website should have an easily accessible privacy policy that formally organizes this information.

First and foremost, data collection can only occur with the user's explicit authorization. Whether through express consent or other [Legal Bases of LGPD](https://goadopt.io/blog/en/legal-bases-of-lgpd/) that support data collection by the company. Therefore, you are a key player in determining what information can be collected, stored, and eventually used.

> Here's a significant gain provided by LGPD for all citizens - **the power to exercise their rights of access or restriction to anything related to their personal data. Citizens can now actively participate in the decision, freely and protected by the law.**

However, it doesn't stop there!

According to the law, companies are not only responsible for collecting data within the visitors' will when they visit their websites or networks.

They must also clearly demonstrate how they store and for what purposes they use such data. After all, they belong to someone! And their use must align precisely with their intended purpose, as well as ensure that the information doesn't leak out and cause serious problems.

## Cookies vs. Privacy Policy

Before we dive into how this policy affects you and how to develop a quality one, let's clarify something. Many people confuse cookies and such policies. Although they are closely related, they are not synonyms.

Remember the data we mentioned earlier, the focus of the privacy policy? Well, some of it is collected through [cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/)! After all, the website needs to know which data you've given permission to access. Similarly, it needs to know what "marks" it can leave in your browser.

These data are usually collected for commercial or digital marketing purposes, i.e., for promoting products and services online. However, they also often contribute to navigation and the visitor's experience.

But how does this work? You've probably visited websites where you're already registered, and when you do, you see your login and password automatically filled in. This is nothing more than the action of these "marks" on your browser.

The same thing happens when you looked at a product, thought about it, and left it in your cart. It probably kept following you after that, right? Whether through advertisements on social networks or on websites, it surely didn't stop appearing.

Again, we have the action of cookies, which provide access information to web pages. Therefore, they are related to data and the care that LGPD reinforces about them.

> [**_Learn more about: Cookies and LGPD_**](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/)

So, where does the privacy policy come in?
Well, it's precisely the information that the website provides to the visitor about how it handles data, how it stores it, how it ensures its security, and its intended use. Both for data that enables direct identification - i.e., data that directly identifies the individual (Name, Email, CPF, RG, etc.), and indirect data that, when combined, can lead to an individual (IP, Address, Position, Profession, etc.).

In other words, the policy acts as a code of conduct for the company.

It's important because it's a public commitment by the website to the visitor. By having it, the site assumes a responsibility that must be strictly followed.

## **How to create a privacy policy according to LGPD?**

Now that we know more about privacy policies, data collection, cookies, and how LGPD has made them so important, the question arises: how to create a high-quality policy? This is a crucial issue if you have a website, regardless of its purpose.

### Use simple and clear terms

First and foremost, it's essential that the terms are clear. Leave legal jargon behind and use simple terms. This ensures they won't be ignored and, at the same time, provides a clear understanding of how the website handles user data.

Leaving no room for doubts or suspicions is crucial and also helps in building the page's image. So, remember to adopt a simple and very clear language.

### Provide complete and informative information

Another essential aspect when developing a privacy policy is to provide complete information. In other words, don't leave anything out and provide a full understanding of what's being done with the data and how it's being handled.

Among the essential pieces of information are:

- Information about the company behind the website;
- Data collection sources;
- Data usage (purpose);
- Cookie policies;
- Information about visitor's rights;
- Storage duration.

You might wonder, with the list above, how do I identify all this? Where do I start? The simplest answer would be to understand that the Privacy Policy is the result of a series of other readings and data mappings you should go through to write it more securely.

So, below are two articles that can help you with the next steps:

#### [**_Data Mapping or Data Inventory, the DPO's Lifesaver_**](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/)

#### [**_What's the Ideal Privacy Policy for Your Company?_**](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/)

## Rely on an intelligent and automated cookie notice platform

As we saw earlier, cookie collection and privacy policies go hand in hand. Therefore, our final tip couldn't be any different! It corresponds to adopting a cookie notice platform.

With this, your visitors have simultaneous access to cookie customization and authorization and to the policy the website applies to their privacy. And for this, count on [AdOpt](https://goadopt.io/), a reference in the market that is here to help you comply with LGPD and respect all your visitors' rights!

[Learn more about how a cookie notice works!](https://goadopt.io/blog/en/operation-of-cookie-banner/)


What is a privacy policy?

Ignoring Terms of Use and their importance within a website, especially now with the [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/), is a common error that both consumers and website owners often make.

Consumers tend to disregard them, while website owners often simply copy them from other sites and overlook the key points.

After all, who wants to waste time reading these documents or thinking about their development, right? Wrong! Of course, reading them doesn't promise a literary delight, I know that much.

However, it is necessary to ensure the safety of both the user and the page owner. It's not for nothing that they are present in most of those ubiquitous [cookie banners](https://goadopt.io/blog/en/why-the-cookie-banner/) out there...

So, don't waste any more time and read below to learn everything about them and how Terms of Use have become essential in the era of LGPD.

## Terms of Use: What are they?

Terms of Use correspond to a document that provides detailed information about how a website functions, the contracting of services/products offered (or the use of information present), and the limits of responsibilities for both parties.

In essence, it's a textual document containing rules for the operation and use of the website and its services. These services can be commercial, informational, service-oriented, and so on.

Terms like Terms of Use, LGPD, [Privacy Policies](https://goadopt.io/blog/en/what-is-privacy-policy/), data collection... there are so many terms that come up in discussions about data protection and website obligations that navigating the internet now requires a dictionary and a degree.

```markdown
Calma, mesmo que você já seja o [Encarregado de Dados](https://goadopt.io/blog/en/responsibilities-of-a-data-protection-officer/) do seu site, por livre espontânea pressão, estamos aqui para te ajudar! :D

Mas você não precisa disso tudo para entender como esses termos conversam e qual é a importância deles. Hoje veremos de forma simples e sem complicações que exijam termos técnicos sobre o assunto.

## And what are Terms of Use for?

Terms of Use serve as a contract!

Can you imagine signing a contract without reading it in advance? Or even copying any contract that concerns rules meant to protect you, without knowing if they apply to your case?

Well, that's why ignoring Terms of Use is no longer an option. In fact, it's a major irresponsibility, let's admit it.

It serves to establish rules for users or customers to use the website or platform. In other words, when you accept the terms, you accept the conditions set by the page. When you make a purchase on an e-commerce site, you're following the rules imposed there.

Of course, this document also follows rules like the Consumer Protection Code, but in general, the contract is imposed by the website. Therefore, it's the website's responsibility to develop it with quality, transparency, and accessibility (easy readability).

Similarly, it's the visitor's responsibility to read the terms, and if they don't agree with them, they should leave the site or stop using it. After all, if they agree, they should adhere to its limits (provided they're not abusive, but that's a legal matter).

In summary, Terms of Use serve to establish the limits of website use, its responsibilities, the correct use of services, the duties and rights of each party, and what is offered there.

It's also worth noting that each type of Terms is different. After all, a news website doesn't offer the same services (nor does it have the same responsibilities) as a page that sells products.

Therefore, thinking about this document is always very important for website owners. Similarly, it's important for you, the reader, as it indicates your rights and duties.

## What's the relationship between Terms of Use and LGPD?

Terms of Use are part of the transparency that websites owe to their visitors and users. They go hand in hand with Privacy Policies. These indicate how the treatment, collection, and security of data that may be collected there are carried out.

And it's precisely these documents that formalize the central themes of the [LGPD, the General Data Protection Law](https://goadopt.io/blog/lgpd-lei-geral-de-protecao-de-dados/). It is recent and came into effect in August 2020.

Therefore, more than ever, it's essential for websites to pay attention to the need to develop these documents that affect the privacy and rights of consumers/visitors in accordance with LGPD. Otherwise, they risk receiving significant penalties. Among these, quite significant fines.

Although many websites choose to present them in a single document, it is of paramount importance that they are available on the website in separate and unique documents. In other words, one for the Terms of Use and another for the Privacy Policy.

While the Terms of Use limit the use of data and services available there, responsibilities of the parties, rights, duties, and intellectual property, Privacy Policies provide information on the treatment and collection of data from users and visitors.

## How to develop the Terms of Use for my website?

When creating the Terms of Use in accordance with LGPD, there are some essential considerations.

Firstly, although the Terms of Use correspond to a contract for the use of the website and its services, it does not require legal language. In fact, the clearer it can be, the better!

After all, it's essential for all visitors to be able to understand the terms presented, as they relate to their rights and duties in using the page. Therefore, remember to keep it simple.

Another issue concerns the specificity of the terms. Remember that we mentioned the (terrible) habit of some websites that simply copy the Terms of Use from others? Well, that's wrong precisely because this document should relate specifically to what each page offers.

For example, an informational website, an e-commerce website, and one that offers online calculation tools will each have specific and different Terms of Use. Even among e-commerce websites, this varies.

Another point to consider is the LGPD's delineations regarding the roles of [Data Controller and Data Processor](https://goadopt.io/blog/en/differences-operator-controller-of-data-lgpd//). This is because these roles can often be confused or even inverted during the provision of services.

After all, they must contain information about the types of products they sell, the data required for purchase, among other issues that are extremely unique to each business.

Finally, remember that the Terms of Use must include, in addition to the delineation of services, limitations of responsibilities and obligations, as well as copyright and industrial property statements.

With all of this, it is possible to ensure LGPD-compliant, secure, clear, and complete Terms of Use! If you want, you can use the [AdOpt Terms of Use](https://goadopt.io/termos-de-uso) as a reference.

## Want to delve deeper into the subject?

We have another article that helps you with [tips for when you need to update your Terms](https://goadopt.io/blog/en/notification-to-users-terms-of-use/).


What are Terms of Use and their importance in the LGPD?

ROPA in LGPD? Get to Know the Records of Processing Activities

The [LGPD - General Data Protection Law](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) brought with it several acronyms and specific terms. Many of them imported from other countries and legislations. One of them is ROPA (Record Of Processing Activities), adapted in Brazil to _Registros das Atividades de Tratamento_. An essential document for any DPO, Data Processor.

If you work in the field or are in the process of adapting your company, this article was made to help you better understand this document.

ROPA (_Record Of Processing Activities_), is nothing more than a document that organizes the company's official records about:
- **How data collection is done**, its processes, and activities;
- **What is done with the data**, if there is any processing or sharing;
- **How data is deleted**, if applicable.

In other words, the essential questions and answers in case of consultation by the ANPD - National Data Protection Authority, to your company. Below, we'll discuss each of these points in more detail.

It's worth noting that all documents and processes mapped by the company's Data Processor are "living," constantly being updated and changed. A new process created in department X can change the ROPA, the [Privacy Policy](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/), and many other controls.

So, regardless of the size of your company, documents should always reflect reality and be constantly updated.

Smaller companies may not feel the need or complexity of keeping these "Mapping of flows" updated, after all, everything is smaller and involves fewer people. Now, for a larger company, there are already software solutions that help with this control in a more automated way, such as [LGPDNOW](http://lgpdnow.com.br/), for example.

## What is ROPA?

ROPA (_Record Of Processing Activities_), translated by the Brazilian market to Records of Processing Activities, is an official document of companies, generated by a system or not, that records all flows, processing, and activities involving personal data.

In it, mainly list all the purposes and reasons why the company needs that data(s) for its operation, legal basis ([Legal Basis](https://goadopt.io/blog/en/legal-bases-of-lgpd/)), security criteria, data storage/retention period.

## Is ROPA the Same as Data Mapping?

The easy answer is: _it depends_.

[Data Mapping or Data Inventory](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/) functions as a visual map of the flow of personal data within the Data Controller, bringing much more than ROPA, such as system and international transfer maps, ISO compliance parameters, NIST, among others.

On the other hand, ROPA focuses on activities involving data processing. In a more structured company, it may happen that a Data Mapping contains some ROPAs as part of it.

In any case, recording activities is an essential part of both documents. The perspective and methodology applied in each can be their differential.

## What Should a ROPA Include?

According to the [ICO (Information Commissioner’s Office), a ROPA must include at least:](https://ico.org.uk/for-organisations/accountability-framework/records-of-processing-and-lawful-basis/#requirements)

- Name and contact details of your organization, whether it's a controller or a processor (and where applicable, the joint controller, its representative, and the DPO);
- The purposes of processing;
- A description of the categories of individuals and personal data;
- Categories of recipients of personal data;
- Details of transfers to third countries, including a record of the safeguards in place for the transfer mechanism;
- Retention/storage times;
- A description of the technical and organizational security measures in place.
- If you have an internal record of all processing activities carried out by any processor on behalf of your organization.

**### Questions the ROPA Should Answer:**

- Have you considered the effectiveness of your accountability measures?
- Would staff say you have effective processes to keep the record up-to-date, accurate, and ensure data is minimized?
- Could staff explain their responsibilities and how they carry them out in practice?

## Best Practices for a Good ROPA.

Also, according to the [ICO (Information Commissioner’s Office)](https://ico.org.uk/for-organisations/accountability-framework/records-of-processing-and-lawful-basis/#requirements), ROPA also includes or links to documentation covering:

- Information needed for privacy notices, such as the legal basis for processing and the source of personal data;
- Consent records;
- Controller-processor contracts;
- The location of personal data;
- DPIA reports;
- Records of personal data breaches;
- Information needed for processing special category data or criminal conviction and offense data under the Data Protection Act 2018 (DPA 2018); and
- Retention and deletion policy documents.

**Questioning for the creation of your ROPA:**

- Have you considered the effectiveness of your accountability measures?
- Do staff understand how to access other relevant documents linked to the ROPA?
- Is it easy for staff to access relevant documentation from the ROPA?
- Could staff explain this process and how it impacts their role?

## How to Create a ROPA for LGPD?

A good example for those starting out or with a smaller company is to use spreadsheets for this control and organization.

In addition, on the [gov.br website, there are various guides and templates to help you comply with LGPD.](https://www.gov.br/governodigital/pt-br/seguranca-e-protecao-de-dados/guias-operacionais-para-adequacao-a-lei-geral-de-protecao-de-dados-pessoais-lgpd)

For larger companies that need to structure these processes better, a privacy management and data mapping platform can be very helpful!

That's why we recommend that you schedule a meeting with the [LGPDNOW](http://lgpdnow.com.br/) team for a no-obligation conversation to see how they can help you develop your ROPA for LGPD.

Templates and models imported from other companies can be very helpful. But it's essential that you can clearly and objectively translate the reality of your company.

Every time we are faced with the complexity of justifying and basing the collection of data, we should always prioritize privacy throughout all processes, as taught by [Privacy by Design](https://goadopt.io/blog/en/what-is-privacy-by-design/).

## How Can AdOpt Help with ROPA?

According to the recommendations of the ICO listed above, AdOpt's LGPD Platform helps you map and organize:

- [Cookie Banner](https://goadopt.io/blog/en/cookie-banner/) within ICO, LGPD, GDPR, CCPA standards.
- Records of all written consents; (organized by user with date, time, and details of each consent.)
- API Integration with your other platforms to enrich the collected data with the consent information recorded.
- And more, depending on the size of your company.

We're here to help!

So, in this [link](https://calendly.com/valquiriaadopt), our calendar is open to discuss your business's adaptation challenges.

What is the ideal privacy policy for your company?

What is a privacy policy?

What are Terms of Use and their importance in the LGPD?

ROPA in LGPD? Get to Know the Records of Processing Activities.