Estimated reading time: 9 minutes
In recent years, the popularization of mobile devices, like smartphones and tablets, has brought a huge change to our society. As a result, the apps became part of people's daily lives.
These small programs installed on cell phones help simplify tasks, making routine easier and providing entertainment. However, faced with this new digital reality, a concern arises: the privacy and security of personal data.
With the constant collection and sharing of information through applications, users began to wonder about how their personal data was being used, stored and protected.
Therefore, there was a need to regulate the digital environment. In Brazil, the General Data Protection Law – LGPD (no. 13.709/2018) came into force in August 2020 with the purpose of guiding public and private organizations on the correct treatment that should be given to third party personal information.
The LGPD is inspired by the European Union's General Data Protection Regulation (GDPR) and has clear guidelines for the collection, storage and use of personal data.
Any company or app developer that handles personal information needs to adhere to the law's guidelines. The intention is balancing technological innovation with the protection of individual rights of each user.
Therefore, applications must be transparent about their data policy. Users must explicitly consent to the use of this information, which must be protected by those who collect it.
If you are thinking about creating an app, you need to be aware of the LGPD guidelines. It is necessary to know how to adapt the production of the product to the law and follow privacy and security measures.
Next, we will delve deeper into this subject and teach you everything you need to know.
Good reading!
Table of Contents
How does LGPD impact apps?
The changes that the General Data Protection Law introduced in Brazil impacted the entire digital environment, including websites and applications.
The LGPD requires the creation of a Terms of Use and Privacy Policies with clear and detailed information to the user.
The document must inform what data will be requested by the app and the purpose of this collection. All of this must be explained in a transparent and understandable way.
Users need to be aware of how your data will be used before agreeing to collection, either to:
- E-mail marketing
- Personalized Ads
- Sharing
Another requirement is the possibility of users to delete their data at any time.
LGPD for apps: who leads the process?
The LGPD defines three important roles in the data processing process:
Controller
It is the person responsible for making decisions about how personal data will be collected, processed and used.
The controller determines what information will be requested and the usefulness of each of them. It also ensures that data processing complies with the LGPD, including respect for the rights of data subjects.
Operator
It is the person who processes the information, that is, the collection, storage, processing and use of data in accordance with the guidelines established by the controller.
This role can be performed by a third-party company, hired by the controller to process the data on its behalf.
In charge
Also known as Data Protection Officer, is the figure responsible for ensuring compliance with the LGPD within the organization. It acts as a kind of communication channel between the controller, data subjects and the National Data Protection Authority (ANPD).
Companies that handle large volumes of personal data or that carry out high-risk activities in relation to data protection are required to appoint a person in charge.
It is essential to understand these roles as they can vary depending on the situation.
Sanctions for non-compliance with the LGPD
It is also important to highlight that the administrative sanctions provided for by the LGPD came into force effective August 2021.
In case of non-compliance with the rules established by law, the ANPD can apply various penalties, ranging from warnings to fines with amounts that can reach 2% of the company's revenue, with a maximum limit of R$50 million.
Furthermore, other sanctions may be imposed for those who do not comply with the LGPD rules:
- Publication of the infraction
- Blocking or deleting data,
- Partial database suspension
- Partial or total prohibition on carrying out data processing activities
What do I need to do to ensure LGPD in apps?
Now that you understand how LGPD impacts applications, let's talk about what's needed to ensure your product's legal compliance:
Mapping
Data mapping is the starting point for those who want to comply with the LGPD in their applications.
The step involves a detailed process of identification and documentation of all information that the application collects and processes. Here's a step-by-step guide that might help:
- Sort the collected data into categories, such as personally identifiable data (name, address, telephone number), location, user behavior, among others. This helps you understand the nature of the data you handle.
- Determine where the data is obtained from. They can be provided directly by the holders, generated by the application (user activity records) or from external sources, such as integrations with social networks.
- Identify why each category of data is being collected. This will help ensure that all information has a legitimate and justifiable purpose.
- Ensure that each type of data collection complies with a specific legal basis. For example, the information may be necessary to perform a contract, comply with a legal obligation or with the consent of the data subject.
Transparency
After mapping all the data and its purposes, it's time to translate this information into transparent and accessible privacy policies for users.
At this time, avoid using legal and complex language, make a clear, accessible and easy-to-understand communication. To do this, it is important:
- Explain, in a transparent and detailed way, why user data is being collected and how it will be used.
- Include information about any targeted advertising and data sharing with third parties.
- Ensure users can easily access your privacy policies, directly from the app, via links or policy summary on the settings screen.
User consent
The app must explain why the data is needed, and users have the right to withdraw consent for use at any time. For that:
- Be transparent about this option.
- Provide a simple process for anyone who wants to withdraw consent.
- Offer in-app privacy controls, allowing users to adjust their privacy preferences and choose what data they want to share.
Suitable prototype
From the beginning of app development, it is important to consider GDPR compliance. Even when creating a prototype, consider data privacy and security practices.
For example, when creating your app workflow, integrate consent requests and explanations about data collection at relevant points in the user experience. This helps make GDPR compliance a natural part of interacting with the app.
Adding security measures from the beginning of app development is also a great idea. You can use data encryption, authentication, and other secure development practices.
Monitor and update privacy practices
Compliance with the LGPD is not a one-time task, but rather an ongoing process. As your app evolves and new features are added, it's important to keep your privacy and security policies up to date.
To do this, conduct regular assessments to ensure practices remain compliant, even after updates.
Start developing apps now
Don't waste any more time and start developing apps now with the help of No-code Startup!
The FlutterFlow course offers a unique opportunity to learn how to develop apps for iOS and Android without the need for programming. There is no need to have any prior knowledge and, best of all, the classes are completely free.
If you want to acquire skills in developing softwares and web applications, the free bubble course is the ideal choice. It provides the necessary teaching base for those who are taking their first steps in the world of programming.
EN 
PT 
ES