LGPD Implementation in Registry Offices: Mapping & Rules
LGPD implementation in registry offices establishes organizational rules to adapt notarial and registry services to Lei nº 13.709/2018.
Última atualização:
Por Equipe Editorial Notarial — Redação jurídica assistida por IA · 5º Tabelionato de Notas de Recife
Context note: This content describes Brazilian notary and registry law (direito notarial e registral brasileiro).
Implantação da LGPD nos Cartórios: Mapeamento de Dados e Tratamento de Informações
Learn how the LGPD implementation in Brazilian registry offices works, personal data mapping, and balancing public access with data protection.
lgpd-implementation-in-registry-offices-data-mapping-and-information-handling
---
LGPD Implementation in Registry Offices: Data Mapping and Personal Information Handling
---
This article answers
- How does LGPD implementation in registry offices work for handling personal data?
- What data can registry offices collect to execute notarial and registry acts?
- How can public access to public registries be reconciled with the LGPD in registry offices?
- What security routines and data mapping are mandatory when implementing the LGPD in registry offices?
- Who is liable for non-compliance with data protection rules in extrajudicial offices?
---
In summary
- The LGPD implementation in registry offices establishes the set of organizational and information security rules to adapt notarial and registry services to Lei nº 13.709/2018 (Brazilian General Personal Data Protection Law - LGPD).
- Notarial and registry services aim to ensure public notice, authenticity, security, and effectiveness of legal acts Lei nº 8.935/1994, art. 1º, which requires grounding data processing in compliance with a legal obligation.
- Personal data mapping identifies the origin, internal flow, storage, and destination of every piece of information processed in the extrajudicial office (serventia extrajudicial).
- Public registry access remains guaranteed by law; however, the issuance of certificates and inquiries observes regulatory limits to protect confidential and sensitive data.
---
How does LGPD implementation in registry offices work for handling personal data?
The LGPD implementation in registry offices is the institutional procedure for adapting extrajudicial routines to the requirements of Lei Geral de Proteção de Dados Pessoais (Lei nº 13.709/2018 - LGPD). This process ranges from in-person service at the counter to managing digital and physical archives of the notarial or registry establishment.
To structure this adaptation, the head of the extrajudicial office (titular da serventia extrajudicial) establishes a privacy governance plan. This plan defines clear roles for deputies (substitutos) and clerks (prepostos), aligning daily operations with Provimento CNJ nº 149/2023 (National Council of Justice Regulation) Provimento CNJ nº 149/2023, Livro I. The adaptation process does not halt the services provided, as extrajudicial activity has specific legal authorization to collect information.
The focus of the LGPD implementation in registry offices is data minimization and protection against leaks. The office evaluates every requested form and document, retaining in its databases only information strictly necessary for party qualification and the formalization of acts. To delve deeper into the operational bases of this management, read our article on LGPD implementation in registry offices and service rules.
---
What data can registry offices collect to execute notarial and registry acts?
During the LGPD implementation in registry offices, the legal bases justifying the request for personal information from users are mapped out. The primary processing grounds in extrajudicial services is compliance with a legal or regulatory obligation, under the duties assigned to notaries and registrars Lei nº 8.935/1994, art. 6º.
You must present official identification documents such as RG (National Identity Card), CPF (Individual Taxpayer Registry), proof of residence, and marital status certificates. This data is indispensable for ensuring certainty regarding the identity of the parties and the security of the legal transaction. Collecting this information does not require the citizen's consent, as it derives from federal legislation and rules from the Corregedoria-Geral de Justiça (General Internal Affairs Office of Justice).
However, if the registry office requests additional information for partner services or facilities not mandated by law, such collection requires the explicit, highlighted consent of the data subject. The LGPD implementation in registry offices clearly separates strictly regulated acts from accessory and optional routines.
---
How can public access to public registries be reconciled with the LGPD in registry offices?
Reconciling public access (publicidade) and privacy is one of the pillars of the LGPD implementation in registry offices. The public nature of registry and notarial acts is a legal duty intended to grant efficacy and enforceability against third parties Lei nº 8.935/1994, art. 1º. Therefore, the LGPD did not repeal the obligation to issue certificates.
Harmonization occurs by following legal channels and prescribed forms for issuing certificates. In the [Tabelionato de Notas (Notary Public Office)] and the [Registro de Imóveis (Real Estate Registry Office)], public access is provided as prescribed by law, preventing indiscriminate bulk searches of database records without demonstrated legitimate interest, except for searches conducted through electronic registries regulated by the [Conselho Nacional de Justiça (National Council of Justice - CNJ)].
When a record involves data protected by privacy rights or judicial confidentiality, the office issues the certificate only under court authorization or a reasoned request from the data subject. In integrated systems like the [Sistema Eletrônico dos Registros Públicos (Electronic Public Registry System - SERP)], inquiries observe the access levels and controls established by federal regulations Lei nº 14.382/2022, art. 3º. Learn more by reading our article on registry management and CNJ rules.
---
What security routines and data mapping are mandatory when implementing the LGPD in registry offices?
The LGPD implementation in registry offices requires strict execution of a personal data inventory, also known as Data Mapping. This mapping records the lifecycle of information within the office, covering reception, processing, sharing with government bodies, and permanent archiving.
The extrajudicial office adopts essential organizational and technical measures, such as:
- Appointment of the Data Protection Officer (DPO): designating a qualified professional responsible for liaising between the registry office, data subjects, and the Autoridade Nacional de Proteção de Dados (National Data Protection Authority - ANPD).
- Preparation of the Data Inventory: a detailed spreadsheet indicating what data is collected, where it is stored, and who holds access permissions.
- Review of Standard Operating Procedures (SOPs): integrating data protection guidelines into every stage of customer service and act execution.
- Information Security: implementing encrypted backup routines, logical port controls, corporate antivirus software, and audit logs (access logs).
Formalizing internal processes ensures staff operate in compliance with the privacy plan. To understand how to structure these manuals, consult our guide on how to structure SOPs and internal processes in registry offices.
---
Who is liable for non-compliance with data protection rules in extrajudicial offices?
In the LGPD implementation in registry offices, the head of the office (tabelião or registrador) is designated as the controller of personal data processing in the exercise of delegated public activity Provimento CNJ nº 149/2023, Livro II. For this reason, liability for appropriate data management is direct.
If a security incident or data leak occurs due to staff negligence, the head of the office may be held administratively liable before the state Corregedoria-Geral de Justiça and the Conselho Nacional de Justiça. Administrative sanctions include warnings, fines, and even suspension of the delegated authority, according to the category's disciplinary framework.
Beyond administrative consequences, an aggrieved user may seek civil damages for material or moral harm resulting from improper handling of their information. This underlines the necessity of keeping the LGPD implementation in registry offices continuously updated, audited, and documented.
---
LGPD compliance checklist for registry offices
- [ ] Map all entry, processing, and exit flows of personal data in the registry office.
- [ ] Formally appoint the Data Protection Officer (DPO) and publish their contact information on service channels.
- [ ] Prepare the Data Protection Impact Assessment (DPIA) for higher-risk routines.
- [ ] Adapt request forms, employee contract addenda, and third-party contractor agreements.
- [ ] Train all clerks, assistants, and deputies regarding confidentiality obligations.
- [ ] Implement restricted access controls to physical archives and digital work folders.
- [ ] Configure encrypted backup routines off-site equipped with a disaster recovery plan.
---
In practice
Case 1: Request for a copy of a personal document by a user at the counter
A user visits the office requesting a photocopy of the identification document of a third party who participated in a public deed drafted the previous month. The clerk explains that, under the LGPD implementation in registry offices, archived documents held in dedicated files are not open for public access without proving legitimate interest or statutory authorization. The clerk issues the requested certificate of the notarial act but refuses to provide a copy of the third party's personal ID document, preserving the subject's privacy without compromising public notice of the notarial act.
Case 2: Data sharing with mandatory electronic central registries
A citizen questions why their qualification data included in a purchase and sale deed was transmitted to a shared electronic service central. The head of the office clarifies that the data transfer stems from compliance with legal obligations and internal affairs regulations to enable inspection and integration of public services Lei nº 14.382/2022, art. 3º. Because the operation is grounded in a statutory duty, the processing is valid and does not require prior user consent.
---
Common mistakes
- Requesting citizen consent for acts mandated by law: The legal basis for notarial and registry acts is compliance with a statutory obligation. Requiring a signed consent form to draft a public deed creates legal confusion.
- Allowing broad clerk access to all databases: The LGPD implementation in registry offices requires restricting each employee's access strictly to the folders and systems necessary to execute their assigned tasks.
- Ignoring physical file security: Personal data protection is not limited to electronic systems; paper files and filing cabinets must remain locked and protected from unauthorized access.
- Failing to update the data inventory when introducing a new service: Whenever the office implements a new customer service tool or system, the data flow must be mapped and added to the inventory.
---
Legal basis
- Lei nº 8.935/1994, art. 1º Lei nº 8.935/1994, art. 1º — Defines that notarial and registry services are organized to guarantee public notice, authenticity, security, and efficacy of legal acts.
- Lei nº 8.935/1994, art. 6º Lei nº 8.935/1994, art. 6º — Establishes the duties and responsibilities of notary publics in executing acts and managing offices.
- Lei nº 14.382/2022, art. 3º Lei nº 14.382/2022, art. 3º — Regulates the Electronic Public Registry System (SERP) and data exchange between registry offices and public authorities.
- Provimento CNJ nº 149/2023, Livro II Provimento CNJ nº 149/2023, Book II — Consolidates delegate duties regarding personal data protection rules in extrajudicial services.
- Provimento CNJ nº 149/2023, Livro I Provimento CNJ nº 149/2023, Book I — Regulates general organization and administrative management of Brazilian extrajudicial offices.
- Regulatory note — Lei nº 13.709/2018 (LGPD) — Regulates the processing of personal data, including digital media, by natural persons or public/private legal entities.
---
Frequently asked questions
How does LGPD implementation in registry offices work for handling personal data?
The LGPD implementation in registry offices adapts extrajudicial routines to Lei nº 13.709/2018 and National Council of Justice guidelines. The office maps data flows, designates a data protection officer, and implements physical and digital security measures. These actions ensure procedural compliance without interrupting public notary and registry services.
What data can registry offices collect to execute notarial and registry acts?
The office collects data required by law for party qualification, such as full name, CPF, RG, marital status, and address. Collection stems from compliance with legal or regulatory obligations to guarantee the validity and legal certainty of the act. Non-statutory data may only be collected with explicit consent or grounded operational justification.
How can public access to public registries be reconciled with the LGPD in registry offices?
Public registry access stems from a legal duty imposed on extrajudicial offices. The LGPD implementation in registry offices ensures certificates convey only legally authorized information, safeguarding sensitive and confidential data as specified by law. Thus, public transparency operates in harmony with data subjects' fundamental rights.
What security routines and data mapping are mandatory when implementing the LGPD in registry offices?
The office conducts a data inventory, prepares a Data Protection Impact Assessment, formalizes confidentiality agreements with staff, and enforces logical and physical access controls to prevent unauthorized access. Encrypted backup routines and continuous software/antivirus updates across all computers are also mandatory.
Who is liable for non-compliance with data protection rules in extrajudicial offices?
The head of the extrajudicial office (tabelião or registrador) is personally liable for data processing violations, subject to disciplinary administrative sanctions from the General Internal Affairs Office of Justice and civil liability for any damages caused. The DPO and staff operate under the head's supervision to ensure full compliance with privacy directives.
---
Editorial footer
Notarial and Registry Editorial Staff
Date of last legal review: August 25, 2026
Document version: 1.0
Territorial scope: National (Brazil)
Notice: This content is strictly informative and educational, based on current Brazilian legislation and administrative regulations. It does not replace personalized legal advice provided by a qualified professional, nor does it bind the registry qualification of concrete cases submitted for notarial evaluation.
Conteúdos relacionados
Próximos passos
Serviços do Tabelionato · Gestão Cartorária · Ver todos os conteúdos