LGPD Document Generator

Last verified against official sources: 2026-07-10

When to Use

• Generating a privacy policy for a web/mobile application
• Creating terms of use compliant with Brazilian legislation
• Building consent forms (especially for children's data)
• Creating a ROPA (Record of Processing Activities / Registro de Operações de Tratamento)
• Drafting a cookie policy
• Notifying a security incident to ANPD and affected data subjects (Res. CD/ANPD 15/2024)
• Writing a RIPD (Relatório de Impacto à Proteção de Dados / DPIA) for high-risk processing
• Drafting a DPA (controller-operator data processing agreement, Art. 39)
• Updating existing compliance documents after feature changes
• Mapping data types to legal bases and retention periods

How to Respond

General Rules

Language

• All generated documents MUST be in Brazilian Portuguese (pt-BR) with correct accentuation
• Use plain language accessible to non-lawyers (avoid legal jargon when possible)
• When legal terms are unavoidable, include a brief explanation in parentheses
• Reference specific LGPD articles (e.g., "conforme Art. 18 da Lei 13.709/2018")

Mandatory Disclaimer

Every generated document MUST include this header:

RASCUNHO — Este documento foi gerado automaticamente e necessita revisão jurídica por advogado(a) habilitado(a) pela OAB antes de publicação ou uso.

Placeholders

Use [PLACEHOLDER] syntax for project-specific information the user must fill in:

• [NOME_DA_EMPRESA] — Company/organization name
• [CNPJ] — Company tax ID
• [ENDERECO] — Address
• [EMAIL_CONTATO] — Contact email
• [EMAIL_DPO] — DPO contact email
• [NOME_DPO] — DPO name
• [NOME_DO_SERVICO] — Service/application name
• [URL_DO_SERVICO] — Service URL
• [DATA_VIGENCIA] — Effective date

Ask the user for these values before generating. If not provided, keep as placeholders.

Data Mapping Table

Before generating any document, build a data mapping table with the user. This table drives the content of all documents:

Adapt this table to the user's specific application. Remove rows that don't apply, add rows for data types specific to their service.

Legal Bases Reference

Personal Data (Art. 7)

Sensitive Data (Art. 11)

Template: Privacy Policy (Política de Privacidade)

Structure — every privacy policy MUST contain these sections:

1. Identificação do controlador — Name, CNPJ, address, contact, DPO info (Art. 41)
2. Dados coletados — Table with: data type, purpose, legal base (Art. 7 or 11)
3. Dados sensíveis — Separate section if applicable (Art. 11), with explicit consent mechanism
4. Dados de crianças e adolescentes — If applicable, full Art. 14 section (see Children's Data below)
5. Finalidades do tratamento — Data mapping: data -> purpose -> legal base (Art. 6, I — finalidade)
6. Compartilhamento de dados — With whom, why, which data, safeguards
7. Transferência internacional — If data leaves Brazil (Art. 33), legal basis for transfer
8. Armazenamento e segurança — Technical and organizational measures (Arts. 46-49)
9. Período de retenção — How long each data type is kept and what happens after (Arts. 15-16)
10. Direitos do titular — All 9 rights from Art. 18, with instructions on how to exercise them
11. Cookies e tecnologias de rastreamento — What is used, purposes, how to disable (link to cookie policy)
12. Alterações desta política — How the user will be notified of changes
13. Encarregado (DPO) — Name and contact info (Art. 41, §1)
14. Contato e canal para exercício de direitos — Clear channel for data subject requests

Data Subject Rights (Art. 18) — Include All Nine

The privacy policy must list these rights and explain how to exercise each one:

Template: Terms of Use (Termos de Uso)

Structure:

1. Aceitação dos termos — How acceptance works (click-wrap, browsing)
2. Descrição do serviço — What the service does
3. Requisitos de uso — Minimum age, registration requirements
4. Conta de usuário — Responsibilities, security, account deletion
5. Uso adequado e proibições — Acceptable use policy, prohibited conduct
6. Conteúdo gerado por usuários — If applicable, moderation rules
7. Conteúdo gerado por IA — If applicable, disclaimers and limitations
8. Propriedade intelectual — IP rights, user content licensing
9. Disponibilidade do serviço — SLA, maintenance windows, no guarantee of uptime
10. Privacidade — Reference to the privacy policy
11. Limitação de responsabilidade — Within Brazilian Consumer Protection Code (CDC) limits
12. Alterações dos termos — How and when users will be notified
13. Legislação aplicável e foro — Brazilian law, competent forum
14. Contato — Support and legal contact

Notes for Terms of Use

• If the service processes children's data, terms must require parental consent for users under 18 (or under 12/16 per ECA Digital)
• Must comply with Marco Civil da Internet (Lei 12.965/2014) for internet services
• Consumer relations must respect CDC (Lei 8.078/1990) — abusive clauses are void

Template: Consent Form (Termo de Consentimento)

Structure:

1. Identificação do controlador — Name, CNPJ, contact
2. Dados objeto do consentimento — Specific list of data being consented to
3. Finalidade específica — Exact purpose for each data type (Art. 8, §4 — blanket consent is void)
4. Duração do tratamento — How long the data will be processed
5. Compartilhamento — If data will be shared, with whom and why
6. Direitos do titular — Summary of Art. 18 rights
7. Como revogar — Simple, free, accessible procedure to withdraw consent (Art. 8, §5)
8. Consequências da recusa — What happens if the user does not consent (Art. 18, VIII)
9. Assinatura / Aceite — Mechanism for recording consent (checkbox, signature, digital)

Consent Rules (Art. 8)

• Must be free, informed, and unambiguous
• Must be for specific purposes — generic or blanket consent is void
• Must be separate from other contractual clauses (prominent, standalone)
• Burden of proof is on the controller
• Revocation must be simple and free, via the same channel used for consent
• Written consent must be in a separate clause from other terms

Template: ROPA (Registro de Operações de Tratamento de Dados)

Based on Art. 37: "O controlador e o operador devem manter registro das operações de tratamento de dados pessoais que realizarem, especialmente quando baseado no legítimo interesse."

Structure — generate as a table/spreadsheet:

ROPA Best Practices (Art. 50)

• Review and update at least annually
• Include all processing activities across all departments
• Integrate with the privacy governance program (Art. 50, §2, I)
• Keep evidence of compliance for ANPD requests

Template: Cookie Policy (Política de Cookies)

Structure:

1. O que são cookies — Plain language explanation
2. Tipos de cookies utilizados — Table:

3. Como gerenciar cookies — Instructions for each major browser + link to opt-out
4. Cookies de terceiros — List third-party services (Google Analytics, Meta Pixel, etc.)
5. Consentimento — Cookie banner requirements: must allow granular opt-in/opt-out per category
6. Contato — DPO contact for questions

Cookie Consent Rules

• Necessary cookies do not require consent (legal base: contract execution)
• All other cookies require prior, informed, granular consent
• Pre-checked boxes do NOT constitute valid consent
• Must provide option to withdraw consent as easily as it was given
• Cookie banner must allow accepting/rejecting each category independently

Template: Incident Notification (Comunicação de Incidente de Segurança)

Based on LGPD Art. 48 + Resolução CD/ANPD nº 15/2024.

When Notification Is Required (Res. 15/2024, Art. 5)

Notify ANPD and affected data subjects when the incident may cause relevant risk or damage — cumulative test:

1. It can significantly affect fundamental interests and rights of data subjects; AND
2. It involves at least one of: sensitive data; data of children, adolescents, or elderly; financial data; authentication credentials; data protected by legal, judicial, or professional secrecy; or large-scale data.

Deadlines

Small-porte agents (Res. CD/ANPD nº 2/2022) have doubled deadlines.

Structure: Communication to ANPD

Generate in pt-BR (submit via the ANPD incident portal). Sections:

1. Identificação do controlador — Name, CNPJ, contact; identify operator if involved
2. Identificação do encarregado (DPO) — Name and contact
3. Descrição do incidente — What happened, root cause (if known), date of occurrence, date of awareness, how it was detected
4. Natureza e categoria dos dados afetados — Data types; highlight sensitive data
5. Titulares afetados — Number (or estimate), categories; highlight children/adolescents/elderly and other vulnerable groups
6. Medidas de segurança — Technical/administrative measures in place before the incident and adopted after
7. Riscos e possíveis impactos — Analysis of risks to affected data subjects
8. Comunicação aos titulares — Whether/how data subjects were or will be informed
9. Medidas de mitigação e reversão — Actions taken to reverse or mitigate the effects
10. Justificativa de eventual atraso — If the 3-business-day deadline was missed

Structure: Communication to Data Subjects

Plain, simple pt-BR — no legal jargon (the audience is the affected user). Sections:

1. O que aconteceu — Brief, honest description of the incident
2. Quais dados foram afetados — Data types involving that data subject
3. O que já fizemos — Containment and mitigation measures adopted
4. Riscos para você — Realistic description of possible impacts
5. O que você deve fazer — Practical recommendations (change password, watch for phishing, monitor statements)
6. Canal de contato — DPO contact for questions and rights requests

Communication must be direct and individualized whenever possible; if not feasible, publish prominently on the service's website/app.

Template: RIPD (Relatório de Impacto à Proteção de Dados Pessoais)

Based on Art. 5, XVII and Art. 38. The RIPD is required for high-risk processing and may be demanded by ANPD at any time.

High-Risk Test (Res. CD/ANPD nº 2/2022, Art. 4)

Processing is high-risk when it meets at least one general criterion AND at least one specific criterion:

Structure

1. Identificação — Controller, operators involved, DPO, person responsible for drafting the RIPD, date
2. Necessidade do RIPD — Result of the high-risk test above (which criteria apply)
3. Descrição do tratamento — Nature, scope, context, and purpose; data types and volume; data subject categories
4. Fluxo de dados — Collection → storage → use → sharing → deletion (diagram or table)
5. Necessidade e proporcionalidade — Legal base, data minimization analysis, less-intrusive alternatives considered
6. Identificação de riscos — Table: risk description | probability (1-5) | impact (1-5) | level (P×I)
7. Medidas de mitigação — For each identified risk: measure adopted, residual risk after mitigation
8. Parecer do encarregado (DPO) — DPO's assessment of the processing and mitigation plan
9. Aprovação — Approver (management), date, scheduled review date (at least annual or on material change)

Template: DPA (Acordo de Tratamento de Dados — Controlador × Operador)

The LGPD does not mandate a specific contract format, but Art. 39 (operator follows controller's instructions) and Arts. 42-44 (liability) make a written DPA essential for accountability. Generate in pt-BR. Clauses:

1. Partes e papéis — Who is controller, who is operator (Art. 5, VI-VII); qualification of both
2. Objeto e duração — Which processing the operator performs, for how long
3. Natureza e finalidade do tratamento — Purpose limitation: operator processes only for the controller's documented purposes
4. Dados e titulares — Data types (flag sensitive/children's data) and data subject categories covered
5. Instruções do controlador — Operator processes only per documented instructions (Art. 39); must inform controller if an instruction violates the law
6. Confidencialidade — Duty of secrecy for operator personnel with data access
7. Medidas de segurança — Technical and administrative measures required (Art. 46); reference to security annex if detailed
8. Suboperadores — Prior authorization (general or specific) for subcontracting; same obligations flow down
9. Transferência internacional — Whether allowed; mechanism used (Art. 33) and destination countries
10. Auxílio ao controlador — Operator assists with data subject rights requests (Art. 18) and RIPD when needed
11. Notificação de incidentes — Operator notifies controller of any security incident within a contractual deadline (recommend 24-48h) so controller can meet the 3-business-day ANPD deadline
12. Auditoria — Controller's right to audit or receive compliance evidence
13. Término — Return or deletion of all personal data at the end of the contract (keep only what legal obligation requires)
14. Responsabilidade — Liability allocation per Arts. 42-44 (operator liable when it violates the LGPD or lawful controller instructions)

Children's Data (Art. 14)

When the application may process data of children (under 12) or adolescents (12-17):

Mandatory Requirements

1. Processing must be in the child's best interest (Art. 14, caput)
2. Requires specific and prominent consent from at least one parent or legal guardian (Art. 14, §1)
3. Controller must make public: types of data collected, how they are used, procedures for exercising rights (Art. 14, §2)
4. Cannot condition participation in games, apps, or activities on providing data beyond what is strictly necessary (Art. 14, §4)
5. Collection without parental consent only to: contact parents (single use, no storage) or for child protection (Art. 14, §3)

Children's Data Section in Documents

All documents (privacy policy, terms, consent forms) must include a dedicated children's section if applicable, covering:

• Age verification mechanism
• Parental consent flow (how parents authorize processing)
• Specific data types collected from children
• Enhanced data minimization (collect absolute minimum)
• No behavioral profiling or targeted advertising to children
• How parents can review, modify, or delete their child's data

Note: For comprehensive children's data protection, also apply the ECA Digital (Lei 15.211/2025) requirements which impose additional obligations on digital platforms.

DPO / Encarregado (Art. 41 + Resolução CD/ANPD nº 18/2024)

Every document should reference the DPO. Art. 41 requirements:

• Controller must appoint a DPO (Art. 41, caput)
• DPO identity and contact info must be published publicly, preferably on the controller's website (Art. 41, §1)
• DPO responsibilities (Art. 41, §2):
  • Accept complaints and communications from data subjects
  • Receive communications from ANPD and adopt measures
  • Guide employees and contractors on data protection practices
  • Execute other tasks assigned by the controller

Resolução CD/ANPD nº 18/2024 (Regulamento do Encarregado) adds:

When generating documents: the privacy policy's DPO section should state name, contact channel, and reference the formal designation. If the client is a small-porte agent without a DPO, replace with the mandatory communication channel.

Good Practices and Governance (Art. 50)

When generating documents, recommend that the organization also implement:

• Privacy governance program (Art. 50, §2, I) with:
  • Internal policies and processes for data protection compliance
  • Applicable to all personal data under their control
  • Adapted to scale and volume of operations
  • Adequate safeguards based on systematic impact assessment
  • Transparency mechanisms for data subjects
  • Internal and external oversight mechanisms
  • Incident response and remediation plans
  • Continuous monitoring and periodic reviews
• Published and regularly updated good practices rules (Art. 50, §3)

Recommended Retention Periods

These are recommendations — adjust based on specific legal requirements for the user's industry.

References

• Lei 13.709/2018 (LGPD)
• ANPD — Perguntas Frequentes
• Lei 12.965/2014 (Marco Civil da Internet)
• Lei 8.078/1990 (CDC)
• Lei 15.211/2025 (ECA Digital)
• Resolução CD/ANPD nº 15/2024 — Comunicação de Incidentes
• Resolução CD/ANPD nº 18/2024 — Atuação do Encarregado
• Resolução CD/ANPD nº 2/2022 — Agentes de Pequeno Porte

See Also

• lgpd-compliance — Use for understanding the legal framework behind the documents: principles, legal bases, data subject rights, security requirements.
• digital-eca-compliance — Use when documents need a dedicated children's data section. ECA Digital requires specific parental consent language and expanded disclosures.
• marco-civil-compliance — Use when Terms of Use need data retention clauses aligned with Marco Civil (connection logs 1 year, application logs 6 months).
• contract-review-br — Use when reviewing generated documents for legal accuracy under Brazilian law (Código Civil, CDC, LGPD).