A privacy policy for law firms: what to include

A contact form on the website, a newsletter, service via WhatsApp: all these channels collect personal data. Brazil's data protection law establishes the principle of transparency, and the privacy policy is the document that fulfills that role towards the public.

Essential items

1. Who the controller is: the firm's name and contact details;
2. What data is collected: name, e-mail, phone, information about the case;
3. What it's used for: client service, provision of services, communication;
4. The legal basis for each purpose;
5. Who it's shared with: software providers, accounting, courts when necessary;
6. How long it's kept;
7. Data subjects' rights and how to exercise them;
8. A contact channel for privacy matters;
9. Cookies and website analytics tools, when used.

Plain language

A policy written in legalese meets the form but not the purpose. Short sentences, examples and clear topics make the reader actually understand.

Keep it up to date

Whenever the firm starts using a new tool or a new service channel, review the policy. State the date of the last update.

The policy is the beginning, not the end

The document is only true if internal practices match it: access control, security, retention periods and responses to data subjects.

How IntegraLegal solves this

IntegraLegal helps make your policy true in practice: data isolated per firm, per-user permissions, change history, backups and WhatsApp service recorded in the system — not on someone's phone.

Organize your firm's data handling: try it free for 7 days.

Read also

• Data protection (LGPD) in a law firm: a practical roadmap
• Professional secrecy in the digital age: precautions every lawyer should take
• Backing up legal documents: the insurance you only value afterwards

Notice: this content is for information only. It does not replace a lawyer's analysis of the specific case. Always check the legislation, case law and rules in force on the date of your consultation.