Data protection (LGPD) in a law firm: a practical roadmap

Pleadings, powers of attorney, ID documents, medical reports, bank details: few businesses handle as much sensitive information as a law firm. Brazil’s General Data Protection Law (LGPD, Law 13,709/2018) applies fully to this routine — and combining it with the duty of professional secrecy is the safest path.

1. Know which data you process

Start with a simple inventory:

• Which data enters the firm (clients, opposing parties, witnesses, staff);
• How it enters (e-mail, WhatsApp, website form, in-person meetings);
• Where it is stored (practice management system, cloud, computers, paper);
• Who has access and for how long it is kept.

Without this map, no other measure holds up.

2. Choose the right legal basis

The LGPD lists the cases that authorize processing (art. 7). In legal practice, the most common are performance of a contract, compliance with a legal obligation and the regular exercise of rights in judicial, administrative or arbitration proceedings. Consent is only one of the bases — and not always the most suitable.

For sensitive data (health, racial origin, religious belief, among others), the cases are narrower (art. 11), but they also include the regular exercise of rights in proceedings.

3. Security is both technical and routine

• Individual user access, with strong passwords and, where possible, two-step verification;
• Permissions according to role: the intern does not need to see everything;
• Regular, tested backups;
• Care with documents sent through personal apps;
• Secure disposal of paper and media.

4. Data protection officer and service channel

The law provides for a data protection officer (art. 41), who receives requests from data subjects and communicates with the national authority (ANPD). Regulations simplify the rules for small processing agents, but keeping a clear channel for data subject requests is advisable at any size.

5. Have an incident plan

Data leaks happen. What sets a prepared firm apart is knowing what to do in the first hour: contain the problem, assess the risk and, when the incident may cause relevant risk or harm, notify the ANPD and the data subjects (art. 48) within the regulatory deadlines.

Quick checklist

• [ ] Up-to-date data inventory
• [ ] Legal basis defined for each purpose
• [ ] Privacy policy published
• [ ] Access reviewed whenever someone leaves the team
• [ ] Backup tested
• [ ] Written incident response plan

How IntegraLegal helps

IntegraLegal keeps data isolated per firm, with user permissions, change history and cloud backup of every document. WhatsApp conversations are recorded in the system, not on someone’s phone. See the plans.

Read also

• Professional secrecy in the digital age: precautions every lawyer should take
• Backing up legal documents: the insurance you only value afterwards
• Access control and audit trails: know who did what in your firm

Notice: this content is for information only. It does not replace a lawyer's analysis of the specific case. Always check the legislation, case law and rules in force on the date of your consultation.