The public document that explains to the data subject how the organization handles their personal data.
A privacy policy is a document, published in clear language, that informs data subjects what personal data the organization collects, for what purposes, on what legal basis, with whom it shares it, how long it is kept, how it is protected, and how their rights can be exercised.
It fulfills the principle of transparency and is the first document that data subjects, clients, and the ANPD (Brazilian National Data Protection Authority) read. It needs to reflect the actual operation: a beautiful but outdated policy is worth less than none at all, because it creates an expectation that the organization does not meet.
Article 6, VI, of LGPD Article 9 establishes the principle of transparency and lists the information that the data subject has the right to access in a clear, adequate, and conspicuous manner: purpose, form, and duration of processing, identification and contact information of the controller, data sharing, responsibilities of the agents, and rights of the data subject. Article 41, § 1, requires the public disclosure of the contact information of the data protection officer. Article 50 encourages policies of good practices and governance.
A Cookie Management and Policies publishes privacy and cookie policies with versioning and change history; the Privacy Portal It brings together policies, order channels, and the contact information for the person in charge, all in one place.
Person in Charge (DPO) · Cookie · ROPA · Data subject · Back to glossary
Updated .
Request a demo and see how... Privacy Tools It organizes mapping, legal bases, rights holder applications, and evidence all in one place.
