LGPD Compliance for Social Apps: What Operators Must Do

LGPD compliance for social apps is the set of duties Brazil's general data protection law places on whoever decides why and how members' personal data is used. A short video app collects a lot of it: phone numbers, emails, contacts used for invites, faces in clips, location, device identifiers, what each member watches, and for a rewards app, payout details. The law is written in Portuguese, but it reaches operators well beyond Brazil.

This guide reads the statute itself, Lei 13.709 of 2018, plus one regulation of the national authority, the ANPD, and translates the duties into product and operations decisions. It is general information, not legal advice; the statute has amendments and the authority issues new rules, so have a Brazilian lawyer review your plan. If you are building a white-label rewards video app for Brazil, treat this as the checklist you bring to that lawyer.

What does LGPD compliance for social apps cover?

Start with scope. Article 3 says the law applies to any processing operation by a person or company, whatever its country of origin or the country where the data sits, if one of three things is true: the processing happens in Brazil, the processing aims to offer goods or services to individuals located in Brazil, or it processes data of individuals located in Brazil. An app published in Brazilian stores and aimed at Brazilian members meets the second test without difficulty.

Then roles. The controller decides the purposes and means of processing; the operator processes on the controller's instructions. You, the company running the app, are the controller. Your cloud host, SMS provider and analytics tool are likely operators, and you need to be able to tell members who receives their data. The authority that enforces the law is the ANPD, the Autoridade Nacional de Protecao de Dados. The statute also makes both controllers and operators liable to repair damage caused by processing that breaks the law, and an operator who ignores the controller's lawful instructions is treated like the controller.

The principles behind every rule

Article 6 sets principles that run through everything below: use data for legitimate, specific and stated purposes; keep the processing compatible with what you told the member; collect only the minimum needed; give members easy and free access; keep data accurate; be transparent; secure it; prevent harm; do not discriminate; and be able to show you are accountable. When in doubt about a feature, ask whether it is a stated purpose, whether you need all the data, and whether a member would be surprised.

Which legal basis covers which use of member data?

Article 7 allows processing of personal data only on one of ten bases. They are consent; compliance with a legal or regulatory duty; public-administration policy uses; research by a research body; performance of a contract, or preliminary steps to one, at the member's request; the regular exercise of rights in judicial, administrative or arbitral proceedings; protection of life or physical safety; protection of health by health professionals or authorities; the legitimate interests of the controller or a third party, unless the member's fundamental rights and freedoms outweigh them; and credit protection. For a social app, four do most of the work.

The right column is a starting hypothesis, not an answer. A lawyer who sees your actual data flows may place an item under a different basis.

When you use consent

Article 8 sets the conditions. Consent must be given in writing or by another means that shows the member's will; if it sits inside a written contract it must be in a highlighted clause; the controller carries the burden of proving it was obtained properly; it must relate to specific purposes, and generic authorizations are void; and the member may revoke it at any time through a free and simple procedure. Sensitive data, which Article 5 defines to include racial or ethnic origin, religious belief, political opinion, health or sex-life data, and genetic or biometric data linked to a person, has a narrower set of bases under Article 11, with specific and prominent consent as the first. If your app uses face filters or any face-based feature, ask your lawyer whether the processing involves biometric data and where the images go.

Which member rights must the product be able to answer?

Article 18 gives the data subject rights that can be exercised at any time on request. Each one implies something in your app, your admin panel or your support process.

Timing is in Article 19: confirmation of processing or access must be provided immediately in a simplified format, or by a full declaration within 15 days of the request, and the authority may set different periods for specific sectors. Members may also complain to the ANPD about the controller. Article 16 lets you keep data after processing ends for a legal duty, for anonymized research, for transfer to a third party within the law, or for your exclusive use if anonymized, so write a retention table and not a blanket promise.

Our platform provides consent prompts, deletion of accounts, a data export and adjustable retention, and Apple's guideline 5.1.1 expects an easily reachable privacy policy that says what is collected, how it is used, how long it is kept and how a member can revoke consent or request deletion. Staff handle requests in the admin panel under role-based access, and a second sign-in step is optional for them.

How does the law treat children and teenagers?

Article 14 says processing of children's and adolescents' personal data must be done in their best interest. For children, processing must rest on specific, prominent consent given by at least one parent or legal guardian, and controllers must keep public the types of data collected, how they are used and how to exercise the Article 18 rights. Collection without that consent is allowed in narrow cases, such as contacting the parents once without storing the data, or protecting the child, and the data may not be passed on without that consent.

For a video app, this changes design. A sign-up that asks for date of birth, a block on rewards and cash withdrawals for minors, a limit on who can message them, and a firm line on contact uploads are all easier to build early. Sign-up can ask for age and region as options, and tighter age checks fitted to your market can be built as tailored work once scope is agreed. The options and trade-offs are laid out in age verification for social media apps, and Brazilian creators and viewers who are young deserve extra attention in the moderation plan described in our Brazil launch plan.

Do you need a data protection officer?

Article 41 says the controller must appoint an encarregado for the processing of personal data, publish the officer's identity and contact details clearly, preferably on the controller's website, and give the officer four tasks: accept complaints and communications from members and respond, receive communications from the ANPD and act, advise employees and contractors on data protection practice, and perform other duties the controller or later rules assign. The authority may set further rules on the role, including exemptions.

It did so for small operators. ANPD Resolution 2 of 27 January 2022 says small processing agents are not required to appoint an encarregado, but must provide a communication channel for members to meet the Article 41 task of receiving their requests, and says appointing one anyway counts as good practice and governance when sanctions are weighed. The same resolution lists who cannot use its relief: agents that perform high-risk processing, that exceed the revenue limit it references, or that belong to a group over that limit. It treats processing as high risk when it meets at least one general criterion, such as large-scale processing or processing that may significantly affect fundamental rights, together with at least one specific criterion, such as use of emerging or innovative technology.

A social app with a recommendation feed, growth in a large market and children among its members may well land on the wrong side of that test. Decide with counsel, and if in doubt appoint an officer; it costs less than arguing the exemption after a complaint.

What records, impact reports and security does the law ask for?

Three duties sit behind the member-facing rights. Article 37 requires controllers and operators to keep a record of their processing operations, especially where legitimate interest is the basis. Article 38 lets the authority order a data protection impact report, covering the types of data collected, the method of collection and security, and the controller's analysis of safeguards and risk mitigation. Article 46 requires technical and administrative security measures that protect personal data from unauthorized access and from accidental or unlawful destruction, loss, alteration or disclosure, from the design stage of the service through its execution.

• Keep a one-page data map: each data type, where it comes from, the purpose, the basis, who receives it and how long you keep it.
• Write a short balancing note for every use that rests on legitimate interest, such as fraud checks.
• List your processors and keep their contracts and security descriptions at hand.
• Limit staff access by role; wallet and payout screens belong to a few people.

Our admin panel has roles with only the screens each staff member needs, secure APIs with hooks for payment, analytics, email and SMS providers, and the stack runs in a cloud account that you own, so you decide the provider and region and keep the records of who has access. Check the full control list in the Kwai clone features page.

What happens after a security incident, and what do fines look like?

Article 48 requires the controller to notify both the ANPD and the member when a security incident may cause relevant risk or damage to members. The statute leaves the deadline to the authority, saying the notice must be within a reasonable time as defined by it, and lists what the notice must say: the nature of the data affected, the members involved, the technical and security measures used, the risks, the reasons for any delay, and the measures taken or planned to reverse or mitigate the harm. Check the authority's current rules for the exact period, since that is where the number lives.

Sanctions are in Article 52. The authority may issue a warning with a deadline for corrective measures; a simple fine of up to 2 percent of the company's, group's or conglomerate's revenue in Brazil in its last financial year, excluding taxes, limited to R$50 million per infraction; a daily fine within the same total cap; publicization of the infraction after it is confirmed; blocking of the personal data concerned until regularization; and deletion of that data. Good-practice and governance programs weigh in the decision, which is one reason to document what you do.

Where does the data go, and who else sees it?

Article 33 restricts international transfers of personal data. It permits them in listed cases: to countries or bodies that provide a protection level adequate to the law; when the controller offers and proves guarantees of compliance, in the form of specific contractual clauses, standard contractual clauses, global corporate rules, or approved seals, certificates and codes of conduct; for international legal cooperation; to protect life; and in further cases the article lists, such as with the member's specific consent. Your cloud region, your video delivery network, your SMS and email services, your ad network and your analytics all count if they handle personal data.

That makes vendor selection a legal choice. A short list works better than a long one. For each vendor record what data it receives, where it processes it, and which Article 33 route covers any transfer. Our platform runs on AWS, GCP or DigitalOcean inside your account, with Cloudflare or Akamai in front, so the hosting location is a choice you make and can document. Third-party services connect through the API layer, and each one you add is another line in the data map.

What does a rewards app add to the data load?

A reward-led app collects data that a plain video app does not. Referral codes link two accounts, so one member's action reveals another's. Withdrawal requests need payout details and, if you verify creators, identity documents. Fraud checks look at device and behavior patterns. Each of these needs a purpose and a basis, and each should collect no more than the purpose needs. Our wallet records purchases, gifts and payouts so finance can reconcile them, and creator verification with KYC is optional, so you can turn it on where payout rules require it and leave it off elsewhere.

The point is to keep reward data apart from the viewing data you use for the feed, and to limit who sees it. Fraud controls that depend on device linking, available as tailored work scoped with your fraud plan, deserve a documented legitimate-interest note. The economics of the reward program itself are in watch to earn app economics.

How do you build the data map your lawyer will ask for?

Almost every other duty in the law starts from one document: a plain list of what personal data the app touches, why, where it sits and who else sees it. A lawyer cannot assign a legal basis to a use that nobody has written down. The map does not need special software; a shared spreadsheet kept by one named person is enough to start.

Fill one row for every item, including the ones that feel minor: device identifiers, IP addresses in logs, push tokens, contact-list matches used for invites, watch history, report records and payout details. Then walk through the app screen by screen and check that nothing the app collects is missing from the sheet. The gaps you find this way are the ones a regulator or a journalist would find later.

Keep the map alive

Treat the map as a release gate. Any feature that collects a new item, such as a new sign-up field, a new analytics tool or a new reward rule that needs an identity document, must add its row before it ships. Review the whole sheet on a calendar, for example every quarter, and after any vendor change. Record the date of each review. A map that was right a year ago and is wrong today is worse than none, because it gives false comfort.

Rehearse the request and the incident

Two drills are worth an hour each before launch. In the first, a test member asks for a copy of their data and then for deletion; time how long each takes end to end, who does which step, and what is left behind in backups and logs. In the second, a staff laptop with admin access is reported lost; decide who disconnects the sessions, who assesses what could be seen, who decides whether the authority and the members must be told, and who writes the message. Both drills turn the legal duties in this guide into steps with names and times beside them, and both usually reveal one step nobody owned.

Keep the output of each drill with the data map: the date, what went wrong, and what changed afterward. That small record shows good faith if anyone later asks how you prepared, and it makes the next drill shorter.

A launch checklist for the lawyer meeting

1. Confirm scope: you offer services to people located in Brazil, so the law applies.
2. Complete the data map and assign a basis to each use.
3. Draft the privacy notice in Portuguese, covering the points Article 9 lists: purpose, form and duration, controller identity and contact, sharing, responsibilities and rights.
4. Decide on an officer or, if you qualify as a small agent, a published contact channel.
5. Build or confirm export, correction, deletion and consent-withdrawal paths and time them against Article 19.
6. Settle the children policy and age gates.
7. Write the incident plan and list vendors with transfer routes.

Take that list to your counsel, then see the product that will carry it. Open the live web demo to look at consent screens, the wallet and the admin roles, read the Kwai clone development company page for who builds and supports the product, and see the published price on pricing. Support covers 60 days of technical help; bug fixes over 6 months are a separate item, and updates run 12 months. For age gates, consent wording or retention rules built as tailored work, write to us through contact with your market, and we will propose a scope for the Kwai clone.