LGPD and Data Protection

Yes. Law 13.709/2018 (the *LGPD*, Brazil's General Data Protection Law) applies from the moment the company collects any personal data — including waitlist emails, data from validation interviews, and usage metrics from beta versions. The relevant criterion is not revenue or company stage, but the processing of personal data belonging to individuals within Brazilian territory. Being pre-revenue does not exempt a company from the law's obligations. ===FAQ_A_1=== The controller company is obligated to notify the ANPD (Brazil's National Data Protection Authority) and affected data subjects when the incident could cause relevant risk or damage (art. 48, Law 13.709/2018). Notification must occur within a reasonable timeframe — the ANPD has been guiding companies toward 2 to 5 business days for initial notification — and must include the nature of the affected data, the measures taken, and the risks generated. Companies without an incident response plan tend to lose critical time during severity analysis, which can worsen the regulatory assessment.Ler artigo completo

The controller company is obligated to notify the ANPD (Brazil's National Data Protection Authority) and affected data subjects when the incident could cause relevant risk or damage (art. 48, Law 13.709/2018). Notification must occur within a reasonable timeframe — the ANPD has been guiding companies toward 2 to 5 business days for initial notification — and must include the nature of the affected data, the measures taken, and the risks generated. Companies without an incident response plan tend to lose critical time during severity analysis, which can worsen the regulatory assessment. ===FAQ_Q_1=== What happens if there's a data breach at my company?Ler artigo completo

Law 13.709/2018 does not set a minimum data volume threshold for the obligation to designate a "Encarregado de Dados" (DPO, Data Protection Officer) — the obligation applies to controllers in general. What varies is the complexity of the privacy program required: a company with low data volume and simple operations still needs a DPO, but the scope of work is smaller. The DPO as a Service model exists precisely to match cost to the size of the operation.