If your business sells to people in Brazil, your website falls under the LGPD, Brazil’s general data protection law. Almost every business site has a contact form, and it was not always designed with the LGPD in mind. For a simple form, what the law asks is reasonable.
This article is for information only and is not legal advice. For specific cases, talk to a lawyer who works with data protection.
Ask only for what you will use
Article 6 of the LGPD lists the principles for processing personal data. One of them, necessity, limits processing “to the minimum necessary” for the purpose, with data that is “pertinent, proportional and not excessive” (Law 13,709/2018, in Portuguese).
For a form, that means: if you will only reply, you need a name, a way to reply (email or phone) and the message. Tax ID, date of birth and full address on a “contact us” form are hard to justify.
The form on this site asks for exactly three things: name, email or WhatsApp, and the message.
Say why you are asking
The law relies on the principles of purpose and transparency. In practice, one short line near the button does it: “We use this data only to reply to you.” Plus a link to a privacy policy that explains the rest.
Which legal basis applies
Article 7 lists when processing is allowed. For contact forms, the usual ones are:
- Item V: when needed for “preliminary procedures related to a contract” the data subject is part of, at the data subject’s request. That covers someone asking for a quote.
- Item I: consent. The safest basis if you want to use the same contact for newsletters or promotions later. Legitimate interest can also work in some cases, but it needs a documented assessment.
- Item IX: legitimate interest, which requires checking that the person’s rights do not prevail.
The classic mistake is turning the quote form into a doorway to your marketing list without asking. If you want that, add a separate checkbox, unticked by default.
Rights people can exercise
Article 18 gives data subjects, among others, the right to confirmation that you process their data, access, correction, deletion of unnecessary data and information about who the data was shared with.
You do not need a complex system for this. You need a channel that works and someone who answers it.
A lighter rule for small businesses
Article 41 of the LGPD requires appointing a data protection officer. But ANPD Resolution No. 2/2022 created a lighter regime for small-scale processing agents, such as micro and small companies and startups. Article 11 of the resolution says these agents are not required to appoint a DPO, but those who do not must provide a communication channel for data subjects (ANPD, in Portuguese). The exemption does not apply to high-risk processing or to agents above the revenue limits set in the resolution itself (article 3).
An email address published in your privacy policy, one that someone actually reads, does the job.
Basic security
- HTTPS on every page.
- The form should not store messages anywhere unprotected. If you do not need to keep them, don’t.
- Spam protection that does not collect extra data for no reason.
- Decide how long contacts are kept and delete what is no longer useful.
If things go wrong
Article 52 sets penalties from a warning up to a fine of up to 2% of the company’s revenue in Brazil in its last fiscal year, capped at R$ 50 million per violation. That is the ceiling. The amount applied depends on severity, good faith, the offender’s economic condition and the other criteria in paragraph 1 of the same article. Since fixing a form is simple, it is not worth putting off.
Quick checklist
- The form asks only for name, contact method and message.
- A short line explaining the purpose, next to the button.
- A link to the privacy policy.
- Newsletter only with its own unticked checkbox.
- A published, monitored channel for data requests.
- HTTPS, and nothing stored without a reason.
Sources
- Lei nº 13.709, de 14 de agosto de 2018 (LGPD), consolidated text. Planalto (Brazilian Presidency). accessed October 2026.
- Resolução CD/ANPD nº 2, de 27 de janeiro de 2022 (regulation for small-scale processing agents). Diário Oficial da União, published 2022-01-28. accessed October 2026.