LGPD in practice for small businesses: what the law requires from the website
The LGPD requires technical data protection measures. See what this means for a clinic, store, or office website, without legalese.
What the law actually requires
Article 46 of the LGPD is direct: the controller must adopt security measures, both technical and administrative, capable of protecting personal data against unauthorized access and accidental situations of destruction, loss, or alteration. It's not just a written policy — it's server configuration, access control, and logging of what was done.
Where the website fits into this story
Contact forms, checkouts, customer areas, and blogs with comments collect personal data. If this website is on HTTP, with an open database, or with an exposed .env file, the company has a leak waiting to happen — and an incident that could have been avoided.
Proof of diligence is worth more than a promise
Em caso de incidente, a autoridade olha o que a empresa fez antes. One relatório datado mostrando os achados, a correção aplicada e a nova verificação é a diferença entre "não sabia" e "identifiquei e tratei". Isso não elimina a multa, mas muda completamente a conversa.
Minimum checklist for the website
HTTPS válido e forçado; headers de segurança actives; nenhum arquivo de configuração acessível; banco fora da internet; painel administractive com autenticação forte e segundo fator; backup testado (backup que nunca foi restaurado não é backup); log de acesso guardado.
When you need to go further
Sensitive data (health, biometrics, financial), large volume of data subjects, or integration with third-party systems require a full compliance audit: data mapping, legal basis per purpose, defined retention, appointed DPO, and incident response plan.
Comece pelo que é barato e resolve a maior parte do risco: o site. Onea avaliação de superfície mostra em minutos se você está expondo dados que a lei manda proteger.