lgpd-compliance — privacy & data protection (LGPD)
Help a web app/SaaS comply with the LGPD (Lei 13.709/2018) — audit what's missing, implement
the controls, and draft the documents. Grounded in the law (art. 7/11 legal bases, art. 18 data
subject rights, art. 52 sanctions) and the ANPD cookie guidance (out/2022).
⚠️ Not legal advice. This is technical guidance to build compliant software. Legal
sign-off (the privacy policy's legal bases, the DPA, retention periods) is the DPO/lawyer's
call. Flag legal decisions as "(confirmar com DPO/jurídico)".
Modes (detect intent, then route)
| The user wants… |
Run |
Primary references |
| to audit the app for LGPD gaps (default) |
gap analysis vs the checklist |
references/audit-checklist.md + all |
| to implement a specific control |
guided implementation |
the matching reference |
| to draft a document (privacy policy / DPA) |
scaffold from a template |
assets/templates/ |
References (load only what the step needs)
| Open when you need to… |
Read |
| run the compliance gap-analysis checklist (audit mode) |
references/audit-checklist.md |
| place roles, legal bases, data-subject rights, sanctions correctly |
references/roles-bases-rights.md |
| write/inventory the privacy policy (data map, retention/TTL, DPO) |
references/privacy-policy.md |
| do cookie consent + analytics right (real opt-in, IP anonymization, Sentry PII) |
references/cookies-and-analytics.md |
| implement data-subject rights (deletion cascade, export, consent revocation) |
references/data-subject-rights.md |
| apply security & privacy-by-design controls (MFA, crypto, logs, SAST/DAST) |
references/security-by-design.md |
| handle third parties (DPA, controller/operator, subprocessors) |
references/dpa-third-parties.md |
Workflow
Step 1 — Ground in the actual app (read before advising)
Find what personal data the app touches and how. Grep/Glob for: user/auth models, analytics
(GA4/gtag/Facebook Pixel), error tracking (Sentry sendDefaultPii), logging of IP/headers,
cookie handling, deletion/export endpoints, password hashing, and third-party SDKs. Build a quick
data map (what's collected, where it flows, who it's shared with). Don't advise in the
abstract — cite the real files.
Step 2 — Run the mode
- Audit: walk
references/audit-checklist.md, marking each item ✅ / ⚠️ partial / ❌ missing,
each with the file evidence and the remediation. Prioritize by risk (an active PII leak >
a missing retention clause). Output a gap report.
- Implement: open the matching reference and apply the control to the real code (or hand the
fix to the dev). Read-only by default; only
Write app code when the user asks.
- Docs: scaffold the privacy policy / DPA from
assets/templates/, filled from the data map.
Mark every legal/retention value "(confirmar com DPO/jurídico)".
Step 3 — Report
Summarize: the data map, the gaps by priority (P0 = active PII leak / illegal tracking; P1 =
missing right/control; P2 = doc/clause), what was implemented/drafted, and the legal items that
need DPO/lawyer sign-off. Chain to review-security for the broader security pass and to
tech-discovery if privacy-by-design needs to reshape the architecture.
Cross-cutting gotchas (the ones apps get wrong)
- Cookie banner that only "avisa" is illegal — GA4/Pixel must load only after "Aceitar";
"Recusar" as easy as "Aceitar"; non-essential cookies off by default (ANPD guide).
- IP and browser data are personal data — anonymize/truncate/hash IPs; don't log them raw.
- Sentry
sendDefaultPii: true exports PII (headers, cookies, session) to a third party
without consent → set false.
- Deletion must cascade — a "delete account" that leaves orphaned rows isn't deletion.
- Never log secrets/PII — no passwords, session ids, or raw PII in logs.
- Consent is revocable and granular — and you must record which base legal applies per data.
1---2name: lgpd-compliance3description: Guide LGPD (Brazilian data-protection) compliance for a web app/SaaS — audit the codebase for gaps, implement the required features, and scaffold the legal docs. Use for "LGPD", "adequação LGPD", "privacidade / proteção de dados", "política de privacidade", "banner de cookies / consentimento", "opt-in de analytics", "direitos do titular", "exclusão / portabilidade de dados", "DPO", "DPA", or "GDPR". Audits against the ANPD checklist (privacy policy, real cookie opt-in, data-subject rights, security by design, DPA), guides implementation (consent gating for GA4/Pixel, account-deletion cascade, data-export endpoint, MFA/crypto/log hygiene, Sentry sendDefaultPii:false), and drafts a privacy-policy / DPA. Technical guidance, NOT legal advice — a DPO/lawyer signs off. Do not use for general security review unrelated to privacy (use review-security) or for app features that don't touch personal data.4license: MIT5---67# lgpd-compliance — privacy & data protection (LGPD)89Help a web app/SaaS comply with the **LGPD** (Lei 13.709/2018) — audit what's missing, implement10the controls, and draft the documents. Grounded in the law (art. 7/11 legal bases, art. 18 data11subject rights, art. 52 sanctions) and the **ANPD cookie guidance** (out/2022).1213> ⚠️ **Not legal advice.** This is *technical* guidance to build compliant software. Legal14> sign-off (the privacy policy's legal bases, the DPA, retention periods) is the **DPO/lawyer's**15> call. Flag legal decisions as "(confirmar com DPO/jurídico)".1617## Modes (detect intent, then route)1819| The user wants… | Run | Primary references |20|---|---|---|21| to **audit** the app for LGPD gaps (default) | gap analysis vs the checklist | `references/audit-checklist.md` + all |22| to **implement** a specific control | guided implementation | the matching reference |23| to **draft a document** (privacy policy / DPA) | scaffold from a template | `assets/templates/` |2425## References (load only what the step needs)2627| Open when you need to… | Read |28|---|---|29| run the compliance gap-analysis checklist (audit mode) | `references/audit-checklist.md` |30| place roles, legal bases, data-subject rights, sanctions correctly | `references/roles-bases-rights.md` |31| write/inventory the privacy policy (data map, retention/TTL, DPO) | `references/privacy-policy.md` |32| do cookie consent + analytics right (real opt-in, IP anonymization, Sentry PII) | `references/cookies-and-analytics.md` |33| implement data-subject rights (deletion cascade, export, consent revocation) | `references/data-subject-rights.md` |34| apply security & privacy-by-design controls (MFA, crypto, logs, SAST/DAST) | `references/security-by-design.md` |35| handle third parties (DPA, controller/operator, subprocessors) | `references/dpa-third-parties.md` |3637## Workflow3839### Step 1 — Ground in the actual app (read before advising)40Find what personal data the app touches and how. `Grep`/`Glob` for: user/auth models, analytics41(GA4/`gtag`/Facebook Pixel), error tracking (Sentry `sendDefaultPii`), logging of IP/headers,42cookie handling, deletion/export endpoints, password hashing, and third-party SDKs. Build a quick43**data map** (what's collected, where it flows, who it's shared with). Don't advise in the44abstract — cite the real files.4546### Step 2 — Run the mode47- **Audit:** walk `references/audit-checklist.md`, marking each item ✅ / ⚠️ partial / ❌ missing,48 each with the file evidence and the remediation. Prioritize by risk (an active PII leak >49 a missing retention clause). Output a gap report.50- **Implement:** open the matching reference and apply the control to the real code (or hand the51 fix to the dev). Read-only by default; only `Write` app code when the user asks.52- **Docs:** scaffold the privacy policy / DPA from `assets/templates/`, filled from the data map.53 Mark every legal/retention value "(confirmar com DPO/jurídico)".5455### Step 3 — Report56Summarize: the data map, the gaps by priority (P0 = active PII leak / illegal tracking; P1 =57missing right/control; P2 = doc/clause), what was implemented/drafted, and the **legal items that58need DPO/lawyer sign-off**. Chain to `review-security` for the broader security pass and to59`tech-discovery` if privacy-by-design needs to reshape the architecture.6061## Cross-cutting gotchas (the ones apps get wrong)62- **Cookie banner that only "avisa" is illegal** — GA4/Pixel must load **only after** "Aceitar";63 "Recusar" as easy as "Aceitar"; non-essential cookies **off by default** (ANPD guide).64- **IP and browser data are personal data** — anonymize/truncate/hash IPs; don't log them raw.65- **Sentry `sendDefaultPii: true` exports PII** (headers, cookies, session) to a third party66 without consent → set **`false`**.67- **Deletion must cascade** — a "delete account" that leaves orphaned rows isn't deletion.68- **Never log secrets/PII** — no passwords, session ids, or raw PII in logs.69- **Consent is revocable and granular** — and you must record *which* base legal applies per data.
gabriel-f-santos