Notary Management, CNJ Standards, and LGPD: Guide

How is the individual liability of notary public officers and registrars characterized?

The liability of notary public officers (tabeliães) and public registrars (registradores) is direct and individual. The heads of extrajudicial offices (serventias extrajudiciais) are liable for damages caused to third parties through fault or willful misconduct in the provision of services. They are also liable for acts performed by their deputies (escreventes) and substitutes (substitutos).

Criminal liability is strictly personal and subjective. Brazilian penal legislation does not allow strict criminal liability nor corporate criminal liability of the notary or registry office, as the office lacks its own legal personality.

In criminal terms, the notary or registrar responds individually only if they commit, contribute to committing, or willfully omit a functional duty regarding an illegal act specified by law.

In the administrative and disciplinary sphere, the office holder responds before the competent Corregedoria-Geral de Justiça (General Internal Affairs Office of Justice). Applicable disciplinary sanctions include warning, fine, suspension, and loss of delegation in the most severe cases provided for in Law No. 8,935/1994 (Lei nº 8.935/1994).

You can check details about official books and liabilities in our text on notary office management and LGPD.

Can a notary or registry office fulfill a certificate request sent via WhatsApp by a judicial advisor?

No. The notary or registry office cannot provide certificates or documents based on informal messaging application requests, such as WhatsApp, even when sent by advisors or employees of the Judiciary Branch.

The transmission of judicial information and certificates between courts and registry offices must follow official and approved channels of institutional communication. Among these channels are official electronic systems such as CRC-Jud, Penhora Online, SISBAJUD, and the interoperability buses of the Sistema Eletrônico dos Registros Públicos (Electronic System of Public Registries — Law No. 14,382/2022, art. 3º).

If a judicial court advisor requests a death certificate or copy of a document via WhatsApp message, the correct procedure requires instructing the requester to formalize the request via an official channel.

Fulfilling requests via informal messaging compromises information security and violates LGPD (Lei Geral de Proteção de Dados Pessoais — Law No. 13,709/2018) controls. It prevents the verification of the identity and authority of the requesting official, creating the risk of improper personal data leakage.

Formalization guarantees request tracking, preserves the chain of custody of information, and ensures proper recording of acts within the scope of the Registro Civil das Pessoas Naturais (Civil Registry of Natural Persons).

What are the governance and outsourcing requirements for quality awards such as PQTA?

Winning quality awards, such as the Prêmio Qualidade Total Anoreg (PQTA), and obtaining certification in ISO standards (such as ISO 9001 and ISO 27001) require structuring a solid corporate governance system within the notary or registry office.

Hiring outsourced companies (IT service providers, cleaning, security, consulting, and document custody) requires a prior supplier approval protocol.

The fundamental steps of this protocol include:

• Legal integrity analysis: Verification of labor, tax, and civil clearance certificates (certidões negativas) of the contracted company.
• Contract with LGPD clauses: Formal requirement of agreement with the role of data processor (operador de dados), stipulating confidentiality duties, incident notification duties, and penalties in case of non-compliance.
• Service Level Agreement (SLA): Clear definition of delivery deadlines, system availability levels, and technical support.
• Information Security Policy: Audit of logical and physical access controls granted to outsourced staff.
• Continuous training: Periodic training sessions on compliance and data protection for internal staff and external service providers.

Find more information in our detailed article on LGPD implementation in notary and registry offices.

How do the principles of notary publicity and personal data protection harmonize in daily registry routines?

Publicity is the fundamental principle of notary and registry services, intended to guarantee effectiveness, authenticity, and legal certainty to performed acts (Law No. 8,935/1994, art. 1º). However, notary and registry publicity is not unrestricted or unlimited.

The LGPD applies to notary and registry offices and requires balancing the fundamental right of access to public information with the protection of the data subject's right to privacy.

The harmonization of both principles occurs as follows:

• **Summary certificates (certidões em breve relatório):** Issued publicly to any applicant, containing the necessary elements to demonstrate the legal status of the act without exposing excessive or unnecessary personal data.
• **Full-text certificates (certidões de inteiro teor):** Require proof of legitimate interest or court authorization in specific legally protected situations (such as court confidentiality, sensitive civil registry data, or adoption).
• Searches by CPF/CNPJ: Governed by provisions of the Corregedoria Nacional de Justiça (National Internal Affairs Office of Justice — CNJ) and SERP, aiming to prevent indiscriminate asset investigation without proper identification of the applicant (Law No. 14,382/2022, art. 3º).

The processing of personal data for issuing certificates is grounded in the fulfillment of a legal duty by the officer, maintaining accounting records and access control for each request.

Notary governance and compliance checklist

• [ ] Data mapping: Identify all collection, processing, storage, and disposal flows of personal data within the office.
• [ ] Data Protection Impact Assessment (DPIA / RIPD): Prepare a risk assessment document for processes involving sensitive or large-scale data processing.
• [ ] Information Security Policy: Define formal rules for passwords, biometric access, user profile controls, and mobile device usage.
• [ ] Third-party control matrix: Require confidentiality commitment agreements and LGPD compliance clauses in all vendor contracts.
• [ ] Data subject service channel: Provide an accessible medium for users and citizens to request information regarding the processing of their data.
• [ ] Incident Response Plan: Maintain a contingency protocol and notification procedure for the Internal Affairs Office and the ANPD in case of a data breach.

Practical applications

Case 1: Informal document request via messaging application by a court official

A civil registry office received a WhatsApp message from a court advisor in a family court requesting the urgent issuance of a duplicate death certificate. The office clerk politely informed that the CRC-Jud system or formal postal mail had to be used. The office provided the official channel on the same day and fulfilled the request within the legal timeframe with full audit logging, safeguarding the personal data involved.

Case 2: LGPD compliance audit in management software procurement

During the preparation process for the PQTA audit, a notary public office identified that its contract with the IT software provider lacked a personal data responsibility clause. The notary (tabelião) formalized a contract amendment establishing the vendor's duties as a data processor and requiring bi-annual expert vulnerability testing. This measure raised the office's score in governance and legal certainty criteria.

Common errors

• Fulfilling informal requests from authorities: Sending copies of acts or user data via social media or personal non-institutional emails. Correction: Require formalization via digitally signed official letter (ofício) or through CNJ-approved electronic systems.
• Providing full-text certificates without verifying legal confidentiality rules: Releasing sensitive data information (such as adoption or gender change) without a court order or statutory authorization. Correction: Apply prior verification of the entry's legal nature before issuing the certificate.
• Failing to sign confidentiality agreements with third-party personnel: Allowing IT technicians or third parties to access office databases without express contractual terms regarding the LGPD. Correction: Include specific confidentiality and LGPD compliance annexes in all service agreements.
• Confusing public access with indiscriminate database scraping: Assuming that registry publicity authorizes automated data scraping of office records by private companies. Correction: Restrict automated access and follow CNJ provisions regarding integrated searches.

Legal basis

• Law No. 8,935/1994 (Lei nº 8.935/1994), art. 1º — Establishes that notary and registry services are technically and administratively organized to guarantee publicity, authenticity, security, and effectiveness of legal acts Lei nº 8.935/1994, art. 1º.
• Law No. 8,935/1994 (Lei nº 8.935/1994), art. 6º — Defines the duties and responsibilities of notaries in executing acts and maintaining official books Lei nº 8.935/1994, art. 6º.
• CNJ Provision No. 149/2023 (Provimento CNJ nº 149/2023), Book I — Regulates general provisions of extrajudicial services, supervision, and administrative compliance Provimento CNJ nº 149/2023, Livro I.
• CNJ Provision No. 149/2023 (Provimento CNJ nº 149/2023), Book II — Defines the consolidation of rules governing notary and registry services nationwide Provimento CNJ nº 149/2023, Livro II.
• Law No. 14,382/2022 (Lei nº 14.382/2022), art. 3º — Establishes the Electronic System of Public Registries (SERP) to modernize inter-registry services and information transmission Lei nº 14.382/2022, art. 3º.
• Normative note on Law No. 13,709/2018 (LGPD) — The General Personal Data Protection Law applies to notary and registry offices to ensure that personal data processing occurs for public purposes, transparency, and security.

Frequently asked questions

How does notary office management integrated with CNJ standards and LGPD work?

Integrated notary office management reconciles administrative and technical regulations set by the CNJ with the data protection principles of the LGPD. Internal office routines undergo process mapping, cybersecurity implementation, and continuous clerk training. The goal is to ensure full validity of notary and registry acts with complete integrity and transparency.

How is the individual liability of notary public officers and registrars characterized?

The civil liability of the office holder is subjective and personal for damages caused in the exercise of their public function. In the criminal sphere, liability is strictly individualized and requires proof of willful misconduct or fault by the office holder. The extrajudicial office lacks independent legal personality, so liability falls on the delegate officer, not the office as an institution.

Can a notary or registry office fulfill a certificate request sent via WhatsApp by a judicial advisor?

No. Certificate requests made through informal messaging channels must not be fulfilled. Official communications between the Judiciary Branch and registry offices must be transmitted via CNJ-approved electronic systems (such as CRC-Jud or e-SISP) or through digitally signed official letters. Formalization prevents data leaks and complies with LGPD guidelines.

What are the governance and outsourcing requirements for quality awards such as PQTA?

To meet the criteria of PQTA and ISO standards, the office must establish strict controls in approving third-party suppliers. This includes verifying tax and legal compliance certificates, signing confidentiality agreements, and incorporating express contractual clauses regarding LGPD compliance. Additionally, the office must maintain formal contingency plans and periodic process audits.

How do the principles of notary publicity and personal data protection harmonize in daily registry routines?

Harmonization occurs by defining the form and scope of publicity. Notary and registry acts maintain their legal publicity through the issuance of summary certificates. However, providing full-text certificates containing sensitive data or legally protected information requires validating the applicant's legitimate interest or obtaining judicial authorization, preventing improper data use for purposes unrelated to the act.

Editorial footer

Text prepared by the editorial team of the 5th Notary Public Office of Recife (5º Tabelionato de Notas do Recife).

Date of legal review: October 12, 2026.

Version: 1.0.

Disclaimer: This content is exclusively for informational and institutional purposes, intended to clarify notary office management and compliance. It does not replace direct consultation of official regulatory norms or proper legal counsel for specific cases.

Próximos passos

Serviços do Tabelionato · notary management · Ver todos os conteúdos