Política de Retenção e Descarte de Dados Pessoais Template for Brasil

A Política de Retenção e Descarte de Dados Pessoais é um documento fundamental que você deve implementar para garantir conformidade com a legislação brasileira de proteção de dados. Este instrumento estabelece diretrizes claras sobre como sua organização deve gerenciar o ciclo de vida dos dados pessoais, desde sua coleta até sua eliminação segura, atendendo às exigências da LGPD e demais normas aplicáveis.

When do you need this document?

You need this policy if your organization processes personal data in any capacity within Brazil or involving Brazilian data subjects. Companies that collect customer information, employee data, or visitor details must establish clear retention and disposal guidelines. E-commerce platforms, healthcare providers, educational institutions, and financial services particularly require this policy to comply with sector-specific data retention requirements. Organizations undergoing LGPD compliance audits or implementing data governance frameworks also need this document to demonstrate adherence to legal obligations. Additionally, businesses that handle sensitive personal data or children's information must have robust retention and disposal procedures in place.

Key legal considerations

Your policy must address several critical legal requirements under Brazilian data protection law. The principle of data minimization requires you to retain only data necessary for specific purposes and for the minimum time required. You must establish clear legal bases for data retention, whether based on legitimate interest, legal obligation, or consent. The policy should define specific retention periods for different data categories, considering business needs and legal requirements. You must implement secure disposal methods that ensure data cannot be recovered or reconstructed. Transparency obligations require you to inform data subjects about retention periods and disposal procedures. Additionally, you must establish procedures for responding to data subject requests for deletion and account for litigation holds that may extend retention periods.

Legal requirements in Brasil

Under the LGPD (Lei nº 13.709/2018), your organization must establish clear criteria for data retention and disposal as part of your data governance framework. The law requires that personal data be kept only for the time necessary to fulfill the purposes of processing, after which it must be eliminated. The Marco Civil da Internet (Lei nº 12.965/2014) establishes additional requirements for internet-based services regarding data storage and deletion. For consumer-facing businesses, the Código de Defesa do Consumidor (Lei nº 8.078/1990) imposes specific obligations regarding consumer data protection. E-commerce operations must comply with Decreto nº 7.962/2013, which establishes retention requirements for transaction data. Your policy must also consider CNJ Resolution nº 363/2021 guidelines for LGPD compliance, particularly if you operate in sectors subject to judicial oversight.