LGPD Live Chat: What Brazilian Businesses Must Know

LGPD and live chat meet the moment a Brazilian visitor types a name, an e-mail address or an order number into your website widget. That message is personal data, and Brazil’s general data protection law applies to how you collect it, why you keep it, who sees it and how long it stays. A chat window is easy to add and easy to forget, which is exactly why it deserves a short review.

This guide explains, in plain language, what the LGPD means for a business that uses live chat and an AI assistant, which questions to answer before you go live and how to describe the chat in your privacy notice. It is general information, not legal advice. Confirm the details that matter to your company with a lawyer or your data protection officer.

What the LGPD Is and Who It Covers

The Lei Geral de Proteção de Dados Pessoais, Law 13.709 of 2018, is Brazil’s general data protection law. It came into force in 2020, and its fines became enforceable in 2021. The national authority is the ANPD, the Autoridade Nacional de Proteção de Dados. You can read the statute on the official government site, and a short English overview of the General Personal Data Protection Law is available on Wikipedia.

The law reaches further than company location. In broad terms, it applies when data is processed in Brazil, when the purpose is to offer goods or services to people in Brazil, or when the data was collected in Brazil. A company in Lisbon, Vilnius or Miami that sells to Brazilian customers through a website should assume that the LGPD is relevant. The same logic exists in the European GDPR, and our guide to GDPR and live chat will feel familiar, with some differences in vocabulary and detail.

The vocabulary

Titular: the person the data is about, here the website visitor.
Controlador: the controller, which decides why and how the data is used. That is normally your business.
Operador: the operator, which processes data on the controller’s behalf. A live chat vendor is typically an operator.
Encarregado: the person who acts as the contact point between the company, data subjects and the ANPD, similar to a data protection officer.
Tratamento: any handling of data, from collecting to deleting.

What Personal Data Does a Live Chat Collect?

Before you can describe your chat honestly, list what it holds. This inventory is the first step of any LGPD live chat review. A typical widget and inbox record:

The text of every message the visitor writes and every reply.
Anything the visitor volunteers: name, e-mail, phone, order numbers, addresses, complaints.
Technical context such as country, page, device and browser, which Talkmio uses to show context in the Inbox.
Contact records and history, so returning visitors are recognised.
Files and screenshots that people attach.

The LGPD also defines sensitive personal data, which includes health information, racial or ethnic origin, religious belief and biometric data. A chat can receive such data by accident, for example a customer describing an illness to explain a refund request. Your instructions to the team, and to the AI, should say: do not ask for sensitive data, and move such conversations to a secure channel when possible.

Choose and Document a Legal Basis

The LGPD lists the legal bases on which personal data may be processed. For a business chat, three are most common:

Performance of a contract or pre-contractual steps, for example answering a customer about an order or a quote.
Legitimate interest, for example offering support and keeping a record to improve it, balanced against the visitor’s rights.
Consent, which must be free, informed and for a specific purpose, and is needed where no other basis fits, such as marketing messages.

Write down which basis applies to which use. A support answer rests on a different basis from a newsletter sign-up inside the chat. Do not bundle them. If a visitor asks a question, you can answer it without making them accept marketing.

Transparency: What to Tell Visitors

The law expects clear, easy information about the purpose, form and duration of processing, who the controller is, with whom data is shared and the rights of the data subject. For a chat, put these points in your privacy notice, written in Portuguese for a Brazilian audience, and consider a short line in the chat welcome text, such as “Este chat guarda sua conversa para ajudar no atendimento. Veja nossa política de privacidade.” Talkmio lets you edit the welcome and offline texts in Websites → your site, so the notice can sit where visitors see it. Our article on the live chat privacy policy includes sections you can adapt, and you should add an explicit mention of the AI assistant and of data transfers abroad.

Data Subject Rights in the Inbox

The LGPD gives people rights over their data, including confirmation that you process it, access, correction, anonymisation or deletion in certain cases, portability, information about sharing and the ability to withdraw consent. In practice, you need a simple route for the request and a person who handles it. Our guide on data subject access requests and live chat walks through verification and response steps, and the same method works for Brazilian requests.

With Talkmio, conversations belong to you, and you can export or delete data at any time. To remove data held by the platform, write to [email protected]. Inside the product, contact records keep conversation history, so a deletion request should cover both the conversation and the contact. Verify the identity of the requester before you share anything, and never accept a request that you cannot link to the right person. Do not ask for a full national identity number to do so, because that creates more data to protect.

International Transfers: Brazil, the EU and the AI Provider

Many Brazilian businesses use chat software hosted abroad. The LGPD allows international transfers only under specified conditions, such as to countries with adequate protection, with standard contractual clauses or in other mechanisms the law and the ANPD recognise. Check the current ANPD regulation, because the rules for transfer tools have been developing.

The facts about Talkmio are simple: data is stored on servers in the EU, in Germany. Only the conversation text and relevant knowledge-base excerpts go to the AI model provider, and visitors’ IP, country and device data are used to show context in the Inbox. For the contractual side, request Talkmio’s current data processing terms through support before you move to a paid plan, as you would with any vendor. Our article on data processing agreements for live chat lists what to check, including subprocessors and transfer clauses.

Retention, Security and Incidents in an LGPD Live Chat Setup

The LGPD follows principles of necessity and security. Keep chats only as long as you need them, restrict access to team members who need it and tell people if something goes wrong. Talkmio plans keep history for 30 days on Free, 365 days on Pro and unlimited on Ultimate and above, so choose a plan, and a deletion routine, that matches your retention rule. See live chat data retention for how to set periods by category.

Other security habits matter as much as the platform in any LGPD live chat project:

Give each team member their own login, and use the Agent role for people who only handle conversations, keeping Admin for those who manage websites and settings.
Remove former employees’ access on the day they leave.
Prepare an incident plan: who decides, whom you notify and by when. The law requires reporting serious incidents to the ANPD and affected people within a short period, so check the current deadline in the ANPD rules rather than relying on memory.

Penalties include warnings, fines of up to 2% of a company’s revenue in Brazil, capped at R$50 million per infraction, and measures such as blocking or deleting data. The best defence is the boring one: a documented basis, a clear notice, a rights process and good security.

Practical Settings in Talkmio for an LGPD Live Chat

Policy only helps if the product is set up to match it. These are the settings and habits that support a careful LGPD live chat in Talkmio:

Pre-chat form. Under Websites → your site the form can be none, optional or required. Ask only for what you need. If you can answer without an e-mail address, leave the form optional or off.
Welcome and offline texts. Add a short privacy line in Portuguese and a link to the policy. When your team is offline, visitors are asked for an e-mail before their first message, so tell them why you ask and how the e-mail will be used.
Business instructions for Mio. Write rules such as “Do not ask for national identity numbers, card numbers or health details. If the visitor shares them, ask them to stop and hand the chat to the team.”
Knowledge base hygiene. Upload only documents that are safe to show customers. Mio answers from that content, so an internal file with personal data should never be added.
Roles. Agents handle conversations; Admins also manage websites, Mio and settings. Give the lowest role that does the job.
Review cadence. Once a quarter, read a sample of chats, delete what you no longer need and update the notice if the use of the chat has changed.

None of this requires special tools. It does require that someone owns it. Name that person, put the checklist in a shared document and treat the chat like any other system that handles customer information.

An LGPD Live Chat Checklist for Your Widget

Item	Question to answer	Done when
Data map	What does the chat collect and where is it stored?	A one-page list exists
Legal basis	Which basis covers support, and which covers marketing?	Each use has a documented basis
Notice	Does the privacy policy name the chat, the AI and transfers abroad?	Published in Portuguese
Rights	Who handles a request and how fast?	A named person and a template reply
Vendor terms	Do you have the processing terms and the list of subprocessors?	Terms requested and filed
Retention	How long do chats stay?	A rule is set and applied
Access	Who can read chats?	Roles reviewed
Incidents	What happens if data leaks?	A plan is written

If you also serve Brazilian customers in Portuguese, our guide to the Brazilian market covers tone, payments and delivery, which pair naturally with this privacy work.

Frequently Asked Questions

Does the LGPD apply to live chat on my website?

Yes, when the chat processes personal data of people in Brazil or you offer goods or services to them. Names, e-mail addresses, order numbers and message text are personal data. Treat the chat like any other data collection point in your privacy review.

Do I need consent to run live chat under the LGPD?

Not always. Answering a customer’s question can rest on contract or legitimate interest, while consent is needed where no other legal basis fits, such as marketing. Document the basis for each use and do not bundle marketing consent into a support chat.

Is a live chat vendor an operator under the LGPD?

Typically yes. The business that decides why and how data is used is the controller, and a chat vendor that processes the data on its behalf is the operator. Ask for the vendor’s processing terms and the list of subprocessors, including any AI provider.

Where does Talkmio store chat data?

Talkmio stores data on servers in the EU, in Germany. Only conversation text and relevant knowledge-base excerpts are sent to the AI model provider. Request the current data processing terms from support, and check which transfer mechanism applies to your situation.

How do I handle a deletion request from a Brazilian visitor?

Verify who the requester is, find the conversation and the contact record, delete them and confirm in writing. Talkmio lets you export or delete data at any time, and [email protected] can help with platform-side removal. Keep a short log of the request and the date.

Can the AI assistant collect sensitive data?

It should not be invited to. Tell visitors not to share health or other sensitive details, instruct your team to move such cases to a secure channel and keep Mio’s instructions clear. Mio answers only from your content and hands sensitive or complicated cases to a person.

The Bottom Line

LGPD and live chat come down to knowing what the widget collects, choosing a legal basis, telling visitors in plain Portuguese, handling rights requests quickly and keeping data only as long as necessary. Review the chat once, write the answers on one page and revisit them when your plan, team or provider changes. Create a free Talkmio account, add your site and use the LGPD live chat checklist above to set up a chat that respects Brazilian visitors’ data.

LGPD and Live Chat: What Brazilian Businesses Must Know