Responsibilities and good practice
A transparent relationship between business and accountant
Knowing each party's responsibilities protects the company, the business owner and the accountant.
Under Brazilian law, the liability of the accountant and of the company is divided into civil, tax and criminal spheres, distinguishing negligent acts from wilful ones. The accountant is personally liable to the client for negligent acts (negligence, lack of skill or recklessness), and jointly liable with the company for wilful acts (fraud or bad faith) that harm third parties.
In the tax sphere, the business owner is the principal debtor of tax obligations and of accounting failures. However, the accountant is also jointly liable for falsehood in documents they sign or for bookkeeping irregularities aimed at tax fraud, under Decree-Law No. 5,844/1943.
Criminal liability may lead to up to five years' imprisonment and severe fines in cases of crimes against the tax order.
To avoid liability, collaboration between the entrepreneur and the accounting professional is essential. The business owner must provide truthful data and review the information sent to the tax authorities, while the accountant must ensure the technical and legal compliance of books and returns. The owner's ignorance or omission does not exempt them from penalties, just as negligent or fraudulent conduct by the accountant creates personal liability.
- Civil
- Negligence, lack of skill or recklessness: the accountant is personally liable to the client. Wilful misconduct: jointly liable with the company towards third parties.
- Tax
- The business owner is the principal debtor. The accountant is jointly liable for falsehood or irregular bookkeeping aimed at tax fraud.
- Criminal
- Crimes against the tax order may lead to up to five years' imprisonment, plus severe fines.
The company's part
- Provide truthful, complete documents and data on time
- Review and approve the information sent to the tax authorities
- Report changes in the business: partners, activities, branches and employees
- Keep tax and labour records for the legal retention period
The accountant's part
- Ensure the technical and legal compliance of books and returns
- Advise clearly on deadlines, risks and lawful alternatives
- Meet the compliance calendar and flag anything pending
- Protect client data with professional secrecy and the LGPD
Informational, educational content. It does not replace the analysis of each specific case by a licensed professional.
Compliance and security
Your accounting data handled with rigour
Our operation is built on Brazil's data protection law (LGPD, Law No. 13,709/2018) and Consumer Protection Code (Law No. 8,078/1990).
LGPD
A legal basis for every processing activity, clear cookie consent and a direct channel for data-subject rights.
Consumer rights
Clear contracts, transparent pricing, adequate information and accessible support for every service.
Information security
HTTPS across the site, encrypted sensitive data, access control and an audit trail.
Brazilian General Data Protection Law (LGPD)
The text of Law No. 13,709/2018 that guides our compliance program, organized by chapter. Tap a chapter to open it.
THE PRESIDENT OF THE REPUBLIC: I hereby make known that the National Congress decrees and I sanction the following Law:
CHAPTER I — PRELIMINARY PROVISIONS
Art. 1. This Law provides for the processing of personal data, including by digital means, by a natural person or by a legal entity of public or private law, with the purpose of protecting the fundamental rights of freedom and privacy and the free development of the personality of the natural person. Sole paragraph. The general rules in this Law are of national interest and must be observed by the Union, the States, the Federal District and the Municipalities.
Art. 2. The discipline of the protection of personal data is grounded on: respect for privacy; informational self-determination; freedom of expression, information, communication and opinion; the inviolability of intimacy, honor and image; economic and technological development and innovation; free enterprise, free competition and consumer protection; and human rights, the free development of personality, dignity and the exercise of citizenship by natural persons.
Art. 3. This Law applies to any processing operation carried out by a natural person or legal entity of public or private law, regardless of the means, the country of its headquarters or the country where the data is located, provided that: (I) the processing is carried out in the national territory; (II) the activity aims to offer or supply goods or services to, or process the data of, individuals located in the national territory; or (III) the personal data was collected in the national territory.
Art. 4. This Law does not apply to the processing of personal data carried out: by a natural person for exclusively private and non-economic purposes; for exclusively journalistic, artistic or academic purposes; for the exclusive purposes of public safety, national defense, State security, or activities of investigation and repression of criminal offenses; or originating outside the national territory that is not subject to communication, shared use or international transfer with Brazilian processing agents, provided the country of origin affords an adequate level of protection.
Art. 5. Key definitions: personal data — information relating to an identified or identifiable natural person; sensitive personal data — data on racial or ethnic origin, religious conviction, political opinion, trade-union or religious/philosophical/political membership, health or sex life, genetic or biometric data; anonymized data; database; data subject; controller — party responsible for decisions on processing; operator — party that processes on the controller's behalf; DPO (encarregado) — the channel of communication between controller, data subjects and the National Data Protection Authority (ANPD); processing agents; processing; anonymization; consent; blocking; deletion; international data transfer; shared use of data; data protection impact report; research body; and national authority.
Art. 6. Processing activities must observe good faith and the following principles: purpose; adequacy; necessity; free access; data quality; transparency; security; prevention; non-discrimination; and accountability (demonstration of effective measures capable of proving compliance with data-protection rules).
CHAPTER II — PROCESSING OF PERSONAL DATA
Section I — Requirements for Processing Personal Data
Art. 7. Processing may only be carried out under one of the following legal bases: consent of the data subject; compliance with a legal or regulatory obligation; execution of public policy by the public administration; studies by a research body (with anonymization whenever possible); performance of a contract or preliminary procedures at the data subject's request; regular exercise of rights in judicial, administrative or arbitration proceedings; protection of life or physical safety; health protection by health professionals or authorities; legitimate interest of the controller or third party; and credit protection.
Art. 8. Consent under Art. 7(I) must be given in writing or by another means demonstrating the data subject's will; if in writing, it must appear in a clause distinct from other contractual clauses. The controller bears the burden of proving valid consent. Consent must refer to specific purposes (generic authorizations are void) and may be withdrawn at any time by a free and facilitated procedure.
Art. 9. The data subject has the right to facilitated access to clear information about the processing, including: specific purpose; form and duration; identification and contact of the controller; information on shared use and its purpose; responsibilities of the agents; and the data subject's rights (Art. 18).
Art. 10. The controller's legitimate interest may only ground processing for legitimate purposes considered from concrete situations, limited to the data strictly necessary, with transparency measures; the national authority may request a data protection impact report.
Section II — Processing of Sensitive Personal Data
Art. 11. Sensitive personal data may only be processed with specific and prominent consent for specific purposes, or, without consent, where indispensable for: compliance with a legal/regulatory obligation; shared processing needed to execute public policy; studies by a research body (anonymized when possible); regular exercise of rights; protection of life or physical safety; health protection by health professionals/authorities; or fraud prevention and the data subject's security in identification and authentication processes. Sharing sensitive health data to obtain economic advantage is prohibited, save for the exceptions expressly listed.
Art. 12. Anonymized data is not considered personal data, unless the anonymization process can be reversed using reasonable means, or where used to form the behavioral profile of an identifiable natural person.
Art. 13. In public-health studies, research bodies may access personal databases, which must be processed exclusively within the body and strictly for the study, kept in a controlled and secure environment, with anonymization or pseudonymization whenever possible; disclosure of results may in no case reveal personal data.
Section III — Processing of Children's and Adolescents' Personal Data
Art. 14. The processing of children's and adolescents' personal data must be carried out in their best interest. Children's data must be processed with specific and prominent consent from at least one parent or legal guardian; controllers must keep public information about the types of data collected and the procedures for exercising rights, must not condition participation in games or applications on the provision of unnecessary data, and must make reasonable efforts to verify that consent was given by the guardian. Information must be provided in a simple, clear and accessible manner suited to the child's understanding.
Section IV — Termination of Data Processing
Art. 15. Processing terminates when: the purpose is achieved or the data is no longer necessary; the processing period ends; the data subject so communicates, including by withdrawing consent; or the national authority so determines upon a violation.
Art. 16. Personal data must be deleted after the end of processing, retention being authorized only for: compliance with a legal/regulatory obligation; study by a research body (anonymized when possible); transfer to a third party under the Law's requirements; or the controller's exclusive use, with access by third parties prohibited and the data anonymized.
CHAPTER III — RIGHTS OF THE DATA SUBJECT
Art. 17. Every natural person is assured ownership of their personal data, with the fundamental rights of freedom, intimacy and privacy guaranteed.
Art. 18. The data subject may obtain from the controller, at any time and upon request: confirmation of the existence of processing; access to the data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary, excessive or non-compliant data; portability to another provider; deletion of data processed with consent (save the exceptions of Art. 16); information on public and private entities with which data was shared; information on the possibility of refusing consent and its consequences; and withdrawal of consent. The data subject may also petition the national authority and consumer-protection bodies.
Art. 19–22. Confirmation of existence or access to data is provided immediately in a simplified format, or within 15 days by a full declaration. The data subject may request review of decisions taken solely on automated processing that affect their interests (including profiling); the controller must provide clear information on the criteria used, subject to trade and industrial secrecy. Data related to the regular exercise of rights may not be used to the data subject's detriment, and their interests may be defended in court, individually or collectively.
CHAPTER IV — PROCESSING OF PERSONAL DATA BY PUBLIC AUTHORITIES
Section I — Rules
Art. 23–27. Public legal entities must process personal data to fulfill their public purpose and legal competences, informing the hypotheses, legal basis and procedures in easily accessible channels (preferably their websites) and appointing a DPO. Public companies and mixed-capital companies operating in competition receive the same treatment as private entities. Data must be kept in an interoperable and structured format for shared use. Shared use by public authorities must serve specific public-policy purposes; transferring data to private entities is prohibited except in the listed hypotheses, and communication or shared use with private parties is reported to the national authority and depends on consent, save the exceptions.
Art. 29–30. Public entities must, at any time, provide specific information on the scope and nature of the data and the processing; the national authority may issue supplementary technical opinions and complementary rules for communication and shared use.
Section II — Liability
Art. 31–32. Where a public body violates this Law, the national authority may issue a notice with appropriate measures to cease the violation, and may request the publication of data protection impact reports and suggest the adoption of standards and best practices.
CHAPTER V — INTERNATIONAL DATA TRANSFER
Art. 33. International transfer of personal data is permitted only: to countries or international organizations affording an adequate level of protection; where the controller offers guarantees (specific contractual clauses, standard contractual clauses, global corporate rules, or seals, certificates and codes of conduct); for international legal cooperation; to protect life or physical safety; where authorized by the national authority; under international cooperation agreements; to execute public policy; with the data subject's specific and prominent consent; or where necessary under the bases of Art. 7 (II, V and VI).
Art. 34–36. The level of protection of the foreign country or organization is assessed by the national authority (considering the legislation, nature of the data, general principles, security measures and judicial/institutional guarantees). The content of standard contractual clauses and the verification of specific clauses, global corporate rules, seals, certificates and codes of conduct are defined by the national authority; changes to the guarantees must be communicated to it.
CHAPTER VI — PROCESSING AGENTS
Section I — Controller and Operator
Art. 37–40. The controller and operator must keep records of processing operations, especially where based on legitimate interest. The national authority may require the controller to prepare a data protection impact report. The operator must process according to the controller's instructions, and the controller verifies compliance. The national authority may provide for interoperability standards for portability, free access and security.
Section II — Data Protection Officer (DPO)
Art. 41. The controller must appoint a Data Protection Officer (encarregado), whose identity and contact details must be publicly and clearly disclosed (preferably on the controller's website). The DPO's duties include: receiving complaints and communications from data subjects, providing clarifications and taking action; receiving communications from the national authority; guiding employees and contractors; and other tasks defined by the controller or in complementary rules.
CHAPTER VII — SECURITY AND BEST PRACTICES
Section I — Security and Secrecy of Data
Art. 46–49. Processing agents must adopt security, technical and administrative measures capable of protecting personal data from unauthorized access and accidental or unlawful situations of destruction, loss, alteration, communication or dissemination. In the event of a security incident that may create risk or relevant damage to data subjects, the controller must notify the national authority and the affected data subjects within a reasonable time, describing the data involved, the risks, the measures taken and mitigating actions. Systems must be structured to meet security requirements, best practices and governance principles.
Section II — Best Practices and Governance
Art. 50–51. Controllers and operators may formulate rules of good practice and governance establishing conditions of organization, operating regime, procedures, security norms, technical standards, obligations, complaint and incident-handling actions, education measures, and internal supervision and risk-mitigation mechanisms — including a privacy governance program. The national authority encourages the adoption of technical standards that facilitate the data subject's control over their personal data.
CHAPTER VIII — SUPERVISION AND ADMINISTRATIVE SANCTIONS
Art. 52–54. Processing agents that violate this Law are subject, after administrative proceedings, to: a warning with a corrective deadline; a simple fine of up to 2% of revenue in Brazil in the previous fiscal year, capped at BRL 50 million per violation; a daily fine (subject to the same cap); public disclosure of the infraction; blocking of the personal data concerned; deletion of the personal data concerned; and, in the most severe cases, partial or total suspension of database operation and of processing activities. Sanctions are applied after an administrative procedure ensuring the right to a full defense, considering criteria such as the seriousness of the fact, the agent's good faith, the advantage obtained, cooperation, and the adoption of a governance program.
CHAPTER IX — THE ANPD AND THE NATIONAL COUNCIL (CNPD)
Art. 55-A to 58-B. The National Data Protection Authority (ANPD) is created as the body responsible for overseeing, implementing and enforcing compliance with this Law throughout the national territory, with technical and decision-making autonomy. Its duties include ensuring data protection, drawing up guidelines for the National Policy, supervising and applying sanctions, and promoting knowledge of data-protection norms. The National Council for Personal Data Protection and Privacy (CNPD) proposes strategic guidelines and prepares annual reports.
CHAPTER X — FINAL AND TRANSITIONAL PROVISIONS
Art. 59–65. Agents that cause material, moral, individual or collective damage in violation of this Law are obliged to redress it. This Law does not override other applicable protective legislation (e.g., the Consumer Protection Code and the Internet Civil Framework). The rights and principles herein apply to procedures and systems already existing at the time of entry into force. This Law entered into force 24 months after its official publication, with the administrative-sanction provisions (Arts. 52–54) taking effect as of August 1, 2021.
The legally authoritative full text is in Portuguese and is published on the official Brazilian government portal (Planalto).
Access the Original Full Text (Planalto — LGPD)Consumer Protection Code (CDC)
The text of Law No. 8,078/1990, which guides our relationship with every client, organized by title and chapter. Tap a title to open it.
THE PRESIDENT OF THE REPUBLIC: I hereby make known that the National Congress decrees and I sanction the following Law:
TITLE I — CONSUMER RIGHTS
Chapter I — General Provisions (arts. 1–3)
Art. 2. A consumer is any natural person or legal entity that acquires or uses a product or service as an end user; groups of people involved in consumer relations are treated as consumers.
Art. 3. A supplier is any natural person or legal entity, public or private, Brazilian or foreign, that produces, assembles, creates, builds, transforms, imports, exports, distributes or sells products or provides services. A service is any paid activity offered on the consumer market, including banking, financial, credit and insurance services, except those arising from employment relationships.
Chapter II — National Consumer Relations Policy (arts. 4–5)
Art. 4. The policy seeks to meet consumers' needs and respect their dignity, health and safety, based on principles such as the recognition of the consumer's vulnerability, good faith and balance between the parties, education and information, quality control and the repression of market abuses.
Chapter III — Basic Consumer Rights (arts. 6–7)
Art. 6. Basic consumer rights include: protection of life, health and safety; education on proper consumption and freedom of choice; adequate and clear information on products and services, including quantity, characteristics, composition, quality, taxes, price and risks; protection against misleading and abusive advertising and unfair practices and clauses; modification of disproportionate clauses or their review due to supervening events; effective prevention and redress of material and moral damages; access to courts and administrative bodies; easier defense of rights, including reversal of the burden of proof; adequate public services; and, since Law 14,181/2021, responsible credit, prevention of over-indebtedness and preservation of the existential minimum.
Chapter IV — Quality of Products and Services, Prevention and Redress of Damages (arts. 8–28)
Arts. 12 and 14. Manufacturers and service providers are liable, regardless of fault, for damages caused by defects and by insufficient or inadequate information. Art. 14, § 4: the personal liability of self-employed professionals is determined by verifying fault.
Arts. 18 and 20. For defects in products or services, the consumer may demand repair (within 30 days for products), re-performance of the service, a refund of the amount paid, adjusted for inflation, or a proportional price reduction.
Arts. 26 and 27. The right to complain about apparent defects lapses in 30 days for non-durable products and services and in 90 days for durable ones; claims for damages caused by defective products or services are time-barred after five years.
Art. 28. Courts may disregard the legal entity when there is abuse of rights, excess of power, violation of law or of the articles of association to the detriment of the consumer.
Chapter V — Commercial Practices (arts. 29–45)
Arts. 30 and 31. Sufficiently precise offers and advertising bind the supplier and form part of the contract; information must be correct, clear, precise, conspicuous and in Portuguese. Arts. 37 and 38: misleading or abusive advertising is prohibited, and the advertiser bears the burden of proving its truthfulness.
Art. 39. Abusive practices are forbidden, such as tying sales, sending products or providing services without request, taking advantage of the consumer's weakness or ignorance, demanding manifestly excessive advantages and performing services without a prior estimate and express authorization. Art. 40: a prior itemized estimate is valid for 10 days unless otherwise agreed.
Arts. 42 and 43. Debt collection may not expose the consumer to ridicule, embarrassment or threats; amounts charged unduly must be refunded in double. Consumers have access to records about them, which may not keep negative information for more than five years.
Chapter VI — Contractual Protection (arts. 46–54-G)
Arts. 46 and 47. Contracts do not bind consumers who were not given prior knowledge of their content, and clauses are interpreted in the consumer's favor. Art. 49: contracts made outside the business premises (by phone, online or at home) may be cancelled within 7 days, with a full refund.
Art. 51. Clauses that exempt the supplier from liability, create unfair obligations or allow unilateral changes to price or terms are null and void. Art. 52: late-payment fines on credit may not exceed 2%. Art. 54: adhesion contracts must use clear terms and a font no smaller than size 12, highlighting clauses that limit rights.
Chapter VII — Administrative Sanctions (arts. 55–60)
Arts. 55–57. The Union, States, Federal District and Municipalities supervise the consumer market; violations may lead to fines graded by severity, advantage obtained and the supplier's economic condition, seizure of products, suspension of activities, license revocation and counter-advertising, among other sanctions.
TITLE II — CRIMINAL OFFENSES (arts. 61–80)
Crimes against consumer relations include omitting warnings about harmful products, making false or misleading statements or omitting relevant information about products and services, promoting misleading or abusive advertising, using threats or coercion in debt collection and hindering the consumer's access to records about them. Directors and managers who allow such conduct are also liable.
TITLE III — CONSUMER DEFENSE IN COURT (arts. 81–104-C)
Arts. 81 and 82. Consumer rights may be defended individually or collectively (diffuse, collective or homogeneous individual rights) by the Public Prosecutor's Office, public entities and associations established for at least one year. Art. 101: a liability claim may be filed in the consumer's domicile. Arts. 104-A to 104-C: debt-renegotiation procedure for over-indebted consumers.
TITLE IV — NATIONAL CONSUMER DEFENSE SYSTEM (arts. 105–106)
The system brings together federal, state, district and municipal bodies (such as the Procons) and private consumer-defense entities, coordinated at federal level today by the National Consumer Secretariat (Senacon).
TITLE V — COLLECTIVE CONSUMER AGREEMENTS (arts. 107–108)
Consumer organizations and supplier associations may set, in writing, conditions on price, quality, quantity, warranty and the handling of consumer complaints.
TITLE VI — FINAL PROVISIONS (arts. 109–119)
Amendments to other laws, notably the Public Civil Action Law (Law 7,347/1985). The Code entered into force 180 days after its publication.
This digital repository reflects the regulatory compilation adapted for systems compliance. The original full text, with all later amendments, is available on the official public portal (in Portuguese).
Access the Original Full Text (Planalto Legislation Portal)Transparency
The Constitutions of the Three Countries
In the spirit of transparency, we provide access to the full and authentic text of the Constitutions of Brazil, the United States and China, on each government's official portal.
Brazil
Read the updated version of Brazil's fundamental law directly on the Planalto Legislation Portal, maintained by the Presidency of the Republic.
1988 Constitution — Planalto(opens in a new tab)United States
The historic 1787 text, along with the full transcript of its 27 amendments, is digitally preserved on the U.S. National Archives website.
U.S. Constitution — National Archives(opens in a new tab)China
The English version of China's fundamental law, revised with the most recent amendments, is on the official portal of the State Council of the People's Republic of China.
Constitution of the PRC — State Council(opens in a new tab)