Security
LGPD in apps and systems: what you can't leave out
· 5 min read · By IBC
Collect only what you will use
Every field in a form needs a purpose. If the data isn't needed to deliver the service, meet an obligation or another reason set out in the law, it shouldn't be requested.
Recorded consent
When the legal basis is consent, as with marketing emails or advertising cookies, it must be freely given, separate from other agreements and recorded with the date and version of the accepted text.
Users' rights
- See what data the company holds about them.
- Correct wrong data.
- Export their own data.
- Delete their account and data, inside the app or system itself.
In-app account deletion is also required by the App Store and Google Play for apps that let people create an account.
Security in the right place
Hiding a button on screen protects nothing. The rules that stop one company from seeing another's data must live in the database, and the access keys for payments and services must stay on the server only.
Children's data needs extra care
The LGPD requires specific consent from at least one parent or guardian to process children's data, always in the child's best interest. App stores also have their own rules for apps aimed at families.
Quick checklist
- Privacy Policy published, with the data officer's contact.
- Cookie banner with an option to refuse.
- Account deletion working.
- Access rules tested across different companies.
- A simple plan to respond to an incident.