Marco Civil da Internet (Brazilian Civil Rights Framework for the Internet)

Predates the LGPD by four years and still governs internet-specific duties the LGPD does not touch. The provisions with the sharpest operational edge are the mandatory retention rules, which cut against data-minimisation instincts: Art. 13 requires internet connection providers to retain connection logs — date, start and end time, and IP address — for one year, and Art. 15 requires FOR-PROFIT internet application providers to retain application access logs for six months. Art. 15's duty applies without needing the user's consent, and non-profit sites, blogs and applications are outside it. Both articles allow the retention period to be extended in defined circumstances. The framework also carries Brazil's net-neutrality rules and its intermediary-liability regime, under which a provider is generally liable for third-party content only after failing to comply with a specific court order. Marked 'verified' on structure; the primary text is Portuguese-language, so confirm the current wording if a retention period is load-bearing for a design decision.