By country

Terms & Conditions Generator Brazil

LGPD with ten legal bases, the ANPD as regulator, and the Consumer Defence Code sitting on top.

Generate your terms and conditions Read the terms and conditions guide

Brazilian terms are read against the Consumer Defence Code, which voids abusive clauses outright and reverses the burden of proof in consumer disputes. Clauses that work in the US frequently do not survive here.

The Lei Geral de Proteção de Dados is GDPR-shaped but not GDPR-identical. It offers ten legal bases rather than six, adding credit protection and health protection among others, and it requires an encarregado - a data protection officer equivalent - whose identity must be published.

The ANPD became a fully independent authority and has moved from guidance to enforcement, issuing sanctions and publishing regulations on breach notification, small-business treatment and international transfers, including its own standard contractual clauses.

Brazilian consumer law is unusually protective and applies alongside the LGPD. The Consumer Defence Code gives a seven-day right of regret on distance purchases, reverses the burden of proof in many disputes, and treats abusive contract terms as void.

What a terms and conditions in Brazil has to cover

The seven-day right of regret on distance contracts, stated plainly
No abusive clauses: unilateral variation, excessive limitation of liability and forced venue against the consumer are void
Clear pre-contractual information including total price and delivery terms in Portuguese
Consumer’s right to sue in their own domicile, which cannot be contracted away

How Brazil actually moves personal data

CPF as a universal identifier

The CPF is used across Brazilian commerce, which makes almost any customer record directly identifying and raises the stakes on retention and access control.

Pix and payment data

Instant payment rails involve identifiers that link directly to a person, and the Central Bank imposes its own security expectations on participants.

Log retention under the Marco Civil

Application providers must keep access logs for six months, and connection providers for a year - a mandatory retention duty that has to be reconciled with LGPD minimisation.

Automated decisions

Article 20 gives a right to request review of decisions made solely on automated processing, which affects credit, fraud and pricing systems.

Breach notification to the ANPD

The ANPD regulation sets the deadline and content, and requires communication to affected individuals where risk is relevant.

Third parties the draft will ask you about

Stripe · Pagar.me · Mercado Pago · PagSeguro · Correios · AWS sa-east-1 · RD Station · Totvs

The rules that apply

LGPD (Lei 13.709/2018)

Ten legal bases, data subject rights including review of automated decisions, and sanctions up to 2% of Brazilian turnover capped at R$50 million per infraction.

Encarregado requirement

A data protection officer whose identity and contact must be publicly disclosed, with reduced obligations for small processing agents.

ANPD international transfer rules

Adequacy decisions, Brazilian standard contractual clauses, binding corporate rules or specific derogations.

Consumer Defence Code

Seven-day right of regret on distance sales, mandatory clear pre-contractual information, and voidance of abusive clauses.

Marco Civil da Internet

Rules on connection and application logs, retention periods and the conditions for disclosure to authorities.

What the generated terms and conditions contains

Who the contract is with and how it is formed
Your legal entity, and the exact moment acceptance happens - account creation, checkout, or continued use.
The service, the licence and its limits
What you are actually providing, what the user may do with it, and what they may not.
Price, payment, renewal and cancellation
Billing cycle, auto-renewal, price-change notice, and how either side ends the arrangement.
Acceptable use and enforcement
The behaviour that gets an account suspended, and the process you follow before you suspend it.
User content and intellectual property
Who owns what, the licence you need to run the service, and the takedown route for infringing material.
Warranties, liability and indemnity
Disclaimers that survive local consumer law, and caps that are actually enforceable rather than theatrically broad.
Governing law, jurisdiction and disputes
The law that applies, the courts that hear it, and any pre-litigation steps you require.

LGPD implementation essentials

Appoint and publish an encarregado
Name and contact route, published where a data subject will find it.
Map processing to the ten bases
Including the bases with no GDPR equivalent, where they genuinely fit.
Adopt ANPD standard contractual clauses for transfers
Or document an adequacy or derogation position.
Reconcile Marco Civil log retention with minimisation
Mandatory retention is a lawful reason to keep logs; it is not a reason to keep everything else.
Align terms with the Consumer Defence Code
Seven-day regret, clear pricing, and no abusive clauses.

Where this usually goes wrong

Copying a GDPR basis table

The LGPD has ten bases including credit protection and health protection. A six-basis table both omits options and misstates the law.

No published encarregado

The identity and contact of the encarregado must be publicly disclosed. It is one of the first things a complainant looks for.

Ignoring the seven-day right of regret

It applies to distance purchases regardless of your refund policy and is separate from any faulty-goods remedy.

Assuming EU SCCs cover Brazilian transfers

The ANPD published its own standard contractual clauses. EU clauses alone are not the Brazilian mechanism.

Frequently asked questions

Does the LGPD apply to companies outside Brazil?

Yes, where processing takes place in Brazil, where it relates to offering goods or services to people in Brazil, or where the data was collected in Brazil.

Do I need an encarregado?

Yes as a general rule, and the identity and contact must be published. The ANPD has reduced obligations for small processing agents but does not remove the accountability requirement.

What is the right of regret?

A seven-day right for consumers to cancel a distance purchase without cause under the Consumer Defence Code, independent of the LGPD and of any commercial refund policy.

Are terms and conditions legally binding?

They are when the user had a genuine opportunity to read them and took a positive step to accept. Clickwrap - a ticked box next to a visible link - holds up far more reliably than a "by using this site you agree" line in the footer.

What is the difference between terms of service and terms and conditions?

Nothing substantive. "Terms and conditions" is the more common phrasing in the UK and Commonwealth markets, "terms of service" in the US and in SaaS. The clauses do the same job.

Can I limit my liability to zero?

No. Most consumer regimes void attempts to exclude liability for death, personal injury or fraud, and unfair-terms rules strike out caps a court considers unreasonable. A cap that is drafted to survive review is worth more than one that is struck out entirely.

Do I need terms if I sell nothing?

If users can register, post, comment or upload, yes - the terms are what let you moderate, suspend and remove content without being in breach of contract yourself.