Política de Descarte de Dados Pessoais Template for Brasil

Uma Política de Descarte de Dados Pessoais é um documento fundamental que estabelece procedimentos seguros e legalmente conformes para a eliminação definitiva de dados pessoais quando estes não são mais necessários para os fins que justificaram sua coleta. No Brasil, este documento tornou-se essencial com a vigência da Lei Geral de Proteção de Dados (LGPD), que exige que organizações implementem medidas técnicas e administrativas adequadas para proteger dados pessoais durante todo seu ciclo de vida, incluindo o momento do descarte.

When do you need this document?

You need this policy whenever your organization processes personal data and must establish clear procedures for data disposal. This is particularly crucial when your data retention periods expire, when data subjects exercise their right to deletion under LGPD Article 18, or when personal data becomes irrelevant for the original processing purposes. The policy becomes essential during system migrations, employee departures, contract terminations with third parties, and when disposing of physical storage devices. Additionally, you need this document to demonstrate compliance during ANPD (National Data Protection Authority) audits and to ensure your organization meets the accountability principle required by LGPD.

Key legal considerations

Your policy must address several critical legal requirements under Brazilian data protection law. The LGPD requires that personal data be kept only for the minimum period necessary to achieve processing purposes, making secure disposal mandatory when this period expires. Your policy should define clear retention schedules, specify approved disposal methods that ensure data cannot be recovered, and establish verification procedures to confirm complete deletion. Key considerations include ensuring the policy covers both digital and physical data formats, establishing different disposal methods based on data sensitivity levels, defining responsibilities for data disposal across your organization, and maintaining records of disposal activities for accountability purposes. The policy must also address disposal of data processed by third parties and ensure compliance with sector-specific regulations.

Legal requirements in Brasil

Under Brazilian law, your Personal Data Disposal Policy must comply with multiple legal frameworks. The LGPD mandates that controllers implement appropriate technical and administrative measures to protect personal data, including during disposal (Article 46). The policy must respect data subjects' rights, particularly the right to deletion (Article 18) and the right to portability before disposal. The Marco Civil da Internet reinforces privacy protection requirements, while the Consumer Defense Code adds specific obligations when dealing with consumer data. Your policy must establish procedures that ensure irreversible data destruction, maintain audit trails of disposal activities, and provide mechanisms for data subjects to verify deletion upon request. Additionally, the policy should address cross-border data transfer considerations, as disposal of data previously transferred internationally may require coordination with foreign jurisdictions and compliance with their disposal requirements.