Protecting data in a chatbot starts before the first message: the business needs to know what information enters, how it will be used, who has access and which providers participate in support. Automation should reflect these decisions in data collection and conversation routing.
This is an informational guide for evaluating an ecommerce operation. The company's legal and data protection teams must determine the obligations and legal bases for the specific case.
What are the LGPD and ANPD?
Brazil's LGPD regulates personal data processing. The ANPD implements, regulates and enforces the law. Noncompliance can result in sanctions following the applicable procedure; purchasing a chatbot does not automatically transfer these responsibilities. ANPD institutional information.
What data does the chatbot actually need to collect?
The LGPD establishes purpose, necessity and transparency principles for processing. In the store flow, check which task requires each piece of information. LGPD, Article 6.
Build an inventory with one row per data item: source, purpose, access, sharing and retention. To find a public returns policy, for example, asking for a complete identity document is generally unnecessary. To check order data, design identity verification appropriate to the risk without exposing information before confirmation.
Does consent cover every use of data?
Consent is one legal basis for processing. Others are established by law, and sensitive data has specific rules. Public data is not exempt from obligations either. ANPD guidance on legal bases.
Separate purposes in the inventory: completing a purchase, handling a request and sending advertising are not interchangeable descriptions. Record the assessment of the applicable legal basis with the responsible people. Channel permission must also be checked in the official WhatsApp API guide.
How should you inform customers clearly?
The notice should explain data use and provide access to relevant processing information. Where consent is required, generic authorization does not meet the requirement for a specified purpose. LGPD, Articles 8 and 9.
Example wording for review, without certification of compliance:
To locate your request, we need [necessary information]. See how [Store] uses this data in [privacy notice]. To discuss your personal data, contact us through [channel].
Replace the fields with actual information. The text should mention only a working channel and a notice that matches the company's process.
Which security controls should you evaluate?
The ANPD's published guide recommends administrative and technical measures, including access management, training and provider evaluation. Published information security guide.
When evaluating the chatbot, check individual accounts, role-based permissions, available authentication and access removal for people who have left. Also verify activity logs and how data appears in exports. A team that does not need information should not receive it by default.
Discuss with each provider where data is stored, who can access it and how incidents are handled. Document responsibilities in the contract and test the access suspension procedure. These checks do not constitute certification of the tool.
How should you handle retention and data subject requests?
The ANPD explains that retention after processing ends depends on authorized circumstances, and data subjects have rights requiring a support path. ANPD frequently asked questions.
Define who receives requests and how to locate data in the systems involved. Avoid promising immediate, unrestricted deletion without assessing retention obligations. Use a simulation with a fictional record to check whether the team can find it and route the request correctly.
Do small businesses also need to assess these obligations?
Differentiated rules for small entities have criteria and exceptions. They do not remove the principles, legal bases or data subject rights. ANPD Resolution CD No. 2, especially Articles 3 and 6.
Do not assume a store is exempt solely because of team size. Include its classification in the assessment with the responsible people.
What should you review before publishing a flow in ChatFunnel?
Bring the data inventory to check implementation settings and providers. Document access, response sources and request routing. The assessment should consider your company's actual use; this article does not declare ChatFunnel or the operation compliant.
Use the automated support checklist to record tests and owners for each outstanding issue before activation.