By country

Refund Policy Generator Brazil

LGPD with ten legal bases, the ANPD as regulator, and the Consumer Defence Code sitting on top.

Generate your refund policy Read the refund policy guide

The Brazilian right of regret gives consumers seven days to cancel a distance purchase for any reason, and the Consumer Defence Code adds warranty periods that run separately: thirty days for non-durable goods and ninety for durable ones.

The Lei Geral de Proteção de Dados is GDPR-shaped but not GDPR-identical. It offers ten legal bases rather than six, adding credit protection and health protection among others, and it requires an encarregado - a data protection officer equivalent - whose identity must be published.

The ANPD became a fully independent authority and has moved from guidance to enforcement, issuing sanctions and publishing regulations on breach notification, small-business treatment and international transfers, including its own standard contractual clauses.

Brazilian consumer law is unusually protective and applies alongside the LGPD. The Consumer Defence Code gives a seven-day right of regret on distance purchases, reverses the burden of proof in many disputes, and treats abusive contract terms as void.

What a refund policy in Brazil has to cover

The seven-day right of regret on distance contracts, counted from receipt
The thirty and ninety-day statutory warranty periods by product type
That the supplier bears return costs when the right of regret is exercised
Refund method and timing, including monetary correction where applicable
The policy published in Portuguese, with clear pre-contractual disclosure

How Brazil actually moves personal data

CPF as a universal identifier

The CPF is used across Brazilian commerce, which makes almost any customer record directly identifying and raises the stakes on retention and access control.

Pix and payment data

Instant payment rails involve identifiers that link directly to a person, and the Central Bank imposes its own security expectations on participants.

Log retention under the Marco Civil

Application providers must keep access logs for six months, and connection providers for a year - a mandatory retention duty that has to be reconciled with LGPD minimisation.

Automated decisions

Article 20 gives a right to request review of decisions made solely on automated processing, which affects credit, fraud and pricing systems.

Breach notification to the ANPD

The ANPD regulation sets the deadline and content, and requires communication to affected individuals where risk is relevant.

Third parties the draft will ask you about

Stripe · Pagar.me · Mercado Pago · PagSeguro · Correios · AWS sa-east-1 · RD Station · Totvs

The rules that apply

LGPD (Lei 13.709/2018)

Ten legal bases, data subject rights including review of automated decisions, and sanctions up to 2% of Brazilian turnover capped at R$50 million per infraction.

Encarregado requirement

A data protection officer whose identity and contact must be publicly disclosed, with reduced obligations for small processing agents.

ANPD international transfer rules

Adequacy decisions, Brazilian standard contractual clauses, binding corporate rules or specific derogations.

Consumer Defence Code

Seven-day right of regret on distance sales, mandatory clear pre-contractual information, and voidance of abusive clauses.

Marco Civil da Internet

Rules on connection and application logs, retention periods and the conditions for disclosure to authorities.

What the generated refund policy contains

The statutory right, stated separately
Consumer cancellation rights exist whatever your policy says, so they are set out first and your goodwill terms second.
Time limits and how they are counted
When the clock starts, whether it runs in calendar or working days, and what stops it.
Condition and evidence requirements
What state goods must come back in, and what proof of purchase you accept.
Who pays return postage
Split between faulty and change-of-mind returns, because the law treats them differently.
Refund method and timing
Original payment method, and the deadline you commit to once goods or notice are received.
Exclusions, stated lawfully
Perishables, personalised goods, unsealed hygiene items and downloaded digital content - the exclusions the law actually permits.

LGPD implementation essentials

Appoint and publish an encarregado
Name and contact route, published where a data subject will find it.
Map processing to the ten bases
Including the bases with no GDPR equivalent, where they genuinely fit.
Adopt ANPD standard contractual clauses for transfers
Or document an adequacy or derogation position.
Reconcile Marco Civil log retention with minimisation
Mandatory retention is a lawful reason to keep logs; it is not a reason to keep everything else.
Align terms with the Consumer Defence Code
Seven-day regret, clear pricing, and no abusive clauses.

Where this usually goes wrong

Copying a GDPR basis table

The LGPD has ten bases including credit protection and health protection. A six-basis table both omits options and misstates the law.

No published encarregado

The identity and contact of the encarregado must be publicly disclosed. It is one of the first things a complainant looks for.

Ignoring the seven-day right of regret

It applies to distance purchases regardless of your refund policy and is separate from any faulty-goods remedy.

Assuming EU SCCs cover Brazilian transfers

The ANPD published its own standard contractual clauses. EU clauses alone are not the Brazilian mechanism.

Frequently asked questions

Does the LGPD apply to companies outside Brazil?

Yes, where processing takes place in Brazil, where it relates to offering goods or services to people in Brazil, or where the data was collected in Brazil.

Do I need an encarregado?

Yes as a general rule, and the identity and contact must be published. The ANPD has reduced obligations for small processing agents but does not remove the accountability requirement.

What is the right of regret?

A seven-day right for consumers to cancel a distance purchase without cause under the Consumer Defence Code, independent of the LGPD and of any commercial refund policy.

Can I run a no-refunds policy?

Not against statutory rights. In the UK and EU a consumer’s cancellation and faulty-goods rights apply regardless of what your policy says, and advertising "no refunds" is itself treated as a misleading practice.

Do digital products have to be refundable?

The cancellation right can be waived for digital content, but only if the customer gave express consent to immediate delivery and acknowledged losing the right. That acknowledgement has to be captured at checkout, not assumed.

How long do I have to issue a refund?

In the UK and EU, within 14 days of receiving the goods back or of the customer proving they returned them. Card scheme rules and marketplace policies often impose something tighter.