Limitada or sociedade anônima: how to choose the corporate form in Brazil

Choosing between the limited liability company (limitada) and the privately held corporation (sociedade anônima, or S.A.) is one of the first decisions faced by anyone structuring a business or an investment in Brazil, and one of the most lasting: it defines the stability of the ownership base, the degree of formality of the governance and, to some extent, even the cost of running the company. Both types ensure limited liability for their equity holders, but under distinct logics. The first is centered on the relationship between persons; the second, on capital.

As to the governing legislation, the limitada is ruled by a concise chapter of the Brazilian Civil Code (arts. 1.052 to 1.087), with broad contractual freedom and the option of electing the Corporations Law as its supplementary regime. The corporation is governed in full by Law No. 6.404/1976 (the Brazilian Corporations Law, or LSA), a comprehensive and largely mandatory framework.

Recent reforms have brought the two regimes closer together, especially for privately held corporations with annual gross revenues of up to BRL 78 million (Complementary Law No. 182/2021 and Law No. 14.195/2021). The structural differences, however, remain, and they are what should drive the choice.

Stability and transfer of equity interests

The most sensitive difference lies in the exit of an equity holder. In a limitada organized for an indefinite term, any quotaholder may withdraw at any time, without cause, upon 60 days' prior notice (Civil Code, art. 1.029). The Superior Court of Justice (STJ) has confirmed that this right subsists even where the articles of association elect the LSA as the supplementary regime (REsp 1.839.078/SP, 2021): no contractual arrangement can definitively lock in the ownership base of a limitada. In the corporation, statutory withdrawal rights are limited to an exhaustive list of events (LSA, art. 137), which does not necessarily mean trapping the shareholder: a well-structured shareholders' agreement can secure a voluntary exit, for instance through call and put options at pre-set price and terms, with the advantage that the exit occurs only when and as the shareholders themselves have agreed, and with specific performance assured (LSA, art. 118, §3). In any scenario, however, disputes tend to concentrate on value. The statutory default criteria are generic (in the limitada, the appraisal of the withdrawing quotaholder's interest, or apuração de haveres, based on a special-purpose balance sheet; in the S.A., reimbursement at net book value, unless the by-laws provide otherwise) and rarely reflect what the equity holders actually expect, so tailor-made valuation criteria and payment terms, set out in the articles of association, the by-laws or the shareholders' agreement, remain what prevents litigation

As to the transfer of equity, an assignment of quotas requires an amendment to the articles of association filed with the Board of Trade (Junta Comercial), which makes both the transaction and the identity of the quotaholders a matter of public record; the assignor also remains jointly and severally liable with the assignee, for two years, for the obligations it had as a quotaholder (Civil Code, art. 1.003, sole paragraph). In the S.A., shares are transferred by an entry in the company's own transfer book, with no public filing, and changes in the shareholder base remain private.

A practical point for foreign groups: the limitada may have a single quotaholder since 2019, while the incorporation of an S.A. requires, as a rule, at least two shareholders (the wholly owned subsidiary, or subsidiária integral, admits a sole shareholder, but only a Brazilian company). For a subsidiary wholly controlled by a foreign investor, the single-member limitada is the natural gateway.

Governance and liability

Until the corporate capital is fully paid in, all quotaholders of a limitada are jointly and severally liable for its payment (Civil Code, art. 1.052), including those who have already paid in their own share. In the S.A., each shareholder is liable only for its own subscription; one shareholder's default does not contaminate the others.

In day-to-day operation, the limitada runs on a minimal structure, with no mandatory bodies beyond its management, and, since Law No. 14.451/2022, the most relevant matters, including amendments to the articles of association, are resolved by holders of more than half of the capital. The S.A. requires an annual shareholders' meeting, filed minutes, statutorily codified duties of managers (LSA, arts. 153 to 157) and a specific corporate liability action (art. 159). This formality has been eased in recent years: any corporation may now operate with a single officer (art. 143, as amended by Complementary Law No. 182/2021) and with officers resident abroad, provided a representative is appointed in Brazil (art. 146).

In arrangements among equity holders, the advantage lies with the S.A. The shareholders' agreement enjoys a solid statutory regime (art. 118), is enforceable against the company and is subject to specific performance. The quotaholders' agreement, in turn, is accepted in practice, but has no statutory framework of its own, and its enforcement is less certain.

Distribution of profits

In the limitada, the Civil Code imposes no minimum dividend: distributions follow whatever the articles of association provide, and the supplementary application of the LSA's mandatory dividend is a debated issue, which recommends express contractual treatment. The limitada also allows disproportionate profit distributions, provided they are authorized in the articles (Civil Code, art. 1.007), a useful tool where the partners contribute in different ways.

In the S.A., if the by-laws are silent, half of the adjusted net income must be distributed (art. 202); if the mandatory dividend is later introduced by an amendment to the by-laws, the floor is 25%. Privately held corporations may retain profits if no shareholder present at the meeting objects (art. 202, §3), and those with revenues of up to BRL 78 million and silent by-laws may freely set the distribution at the shareholders' meeting (art. 294, §4). Equal treatment of shares of the same class remains the rule: differentiated economic rights require distinct classes of shares, and the reach of art. 294, §4 for disproportionate distributions still divides legal scholars, with no ruling from the STJ or from the CVM (the Brazilian securities regulator).

Fundraising and publication requirements

The S.A.'s fundraising toolkit is well established: common and preferred shares in different classes, debentures and subscription warrants. The limitada, historically restricted to quotas, has been expanding its own: preferred quotas are accepted by the DREI (the federal business registration authority) where the articles elect the LSA as supplementary regime; commercial notes (notas comerciais) may be issued since 2021, including with a clause providing for conversion into equity in private offerings; and, since February 2026, the DREI has instructed the Boards of Trade to register debenture issuances by limitadas subject to the LSA's supplementary regime. This latest development, however, is a recent administrative guideline, not yet endorsed by the CVM or by the courts: for sizeable fundraisings or those involving institutional investors, the S.A. remains the safe vehicle and, in practice, the most widely used.

As to the transparency of results, the limitada is not required to publish financial statements, whatever its size: both private-law panels of the STJ have rejected the requirement, including as a condition for filing corporate acts with the Board of Trade (REsp 1.824.891/RJ, 3rd Panel, 2023; REsp 2.002.734/SP, 4th Panel, 2026). The S.A., by contrast, publishes its corporate acts: electronically, if annual revenues do not exceed BRL 78 million; above that threshold, in a widely circulated newspaper, with a printed summary and the full version available online (art. 289), a regime upheld by the STF, Brazil's Federal Supreme Court (ADI 7.194, 2024).

Comparative table

How to decide

There is no best type in the abstract; there is the right type for each operation. The limitada favors concentrated control structures, subsidiaries of foreign groups and ventures that prize simplicity, confidentiality of results and flexibility in profit distribution. The privately held S.A. makes sense where equity holders with different profiles coexist, where stability of the ownership base and a fully enforceable shareholders' agreement are sought, or where the plan includes structured fundraising, the entry of investment funds or an M&A transaction on the horizon.

Nor is the decision final: converting from one type into the other is a common step in the life of companies, often the natural move between set-up and expansion. GT Lawyers assists investors, notably French and European, in structuring their operations in Brazil, from the choice of the corporate form to its implementation, and even its later change and adjustment to each client's current stage.

This article is for information purposes only and does not constitute legal advice. Published in July 2026, based on the legislation then in force.

By Tamy Tanzilli — GT Lawyers

Since the provisional entry into force of the partnership agreement between the European Union and Mercosur on 1 May 2026, the question of how European companies — particularly SMEs — can establish themselves in South America, and in Brazil specifically, has become one of the most strategic issues of the year. At a time when economic blocs are being reconfigured, the Brazilian market is crystallizing investors' ambitions as they search for new growth drivers. But is it truly an eldorado for mergers and acquisitions (M&A)? Answering that question requires examining the legal foundations of the treaty, the realities of the market, and the operational constraints that remain.

I. A Confirmed Structural Attractiveness

Before even discussing the legal mechanisms, it is worth recalling a fundamental economic reality. Together, the European Union and the four Mercosur member states (Argentina, Brazil, Paraguay, Uruguay) represent a market of more than 720 million consumers, according to European Commission data. For a company seeking international growth, this critical mass is in itself a decisive argument.

Brazil holds a leading position within this bloc. According to the Pesquisa Fusões e Aquisições published by KPMG Brasil in February 2025, the Brazilian market recorded 1,582 M&A transactions in 2024, a 5% increase over 2023 (1,505 transactions), ending two consecutive years of decline. Domestic deals accounted for 981 transactions, while 601 involved foreign parties, including 394 acquisitions carried out by majority foreign-owned groups. The United States was the leading foreign investor (259 transactions), followed by Canada (35), the United Kingdom (33), Spain (23), and France (18). Furthermore, Brazil maintains its regional leadership: according to the Aon/TTR Data report of February 2025, it accounted for 1,674 announced and closed transactions in 2024, out of a Latin American total of 2,904, confirming its position as the region's leading market. The leading sectors are technology, renewable energy, financial services, and agribusiness.

On the legal side, the EU–Mercosur agreement establishes a favorable framework for these operations. Article 1.2(f) sets out, among its fundamental objectives, the improvement of conditions for the establishment of businesses, creating a stable, predictable, and non-discriminatory legal framework for economic operators from both blocs. This provision underpins the entire investment chapter of the treaty.

One of the most significant contributions to M&A operations lies in Chapter 10 of the agreement, on services and the establishment of businesses. Article 10.3.1 enshrines the principle of non-discrimination: European companies established in Brazil must be treated comparably to local companies or to investors from other Mercosur countries, provided they meet the applicable establishment criteria. This provision should not, however, be read as full equivalence: Article 10.3.1 does not remove the sectoral reservations listed in the annexes (notably Annexes 10C and 10-E), and several requirements of Brazilian domestic law remain fully applicable, as discussed below.

The treaty also includes a chapter dedicated to SMEs (Article 14.1 et seq.), providing for the creation of an SME coordinator with representation from each party (Article 14.3) and mechanisms for sharing information on marketaccess conditions (Article 14.2). This dimension is all the more relevant given that SMEs represent 98% of Brazilian companies, according to European Commission data.

II. Acquisition: The Ideal Entry Vector to Scale Up Quickly in Brazil?

For a European company seeking to establish itself quickly in Brazil, a merger or acquisition (M&A) is often the most attractive entry vector, since it provides access, in a single operation, to operational assets, an in-place workforce, and an already-established commercial network.

The advantages of acquisition

• Immediate market access: existing customers, teams, contracts, and operations make it possible to skip the often lengthy start-up and visibility-building period.
• Strong acceleration of development: the acquirer immediately benefits from operational, commercial, and human synergies, without waiting for a new structure to organically scale up.
• Immediate strategic positioning: acquiring an established player confers local legitimacy that years of commercial effort would not necessarily have achieved as quickly.
• Business continuity: the target retains its contractual relationships, regulatory authorizations, and customer base, preserving the operation's operational value.

Risks to anticipate

• Latent liabilities: Brazilian law provides for joint and several liability in tax and social security matters. The acquirer can be exposed to the target's tax, social security, and environmental debts predating the transaction, even where these were not apparent at the time of negotiation. Thorough due diligence — tax, social security, environmental, and regulatory — is therefore essential to identify the level of risk before committing. Thorough due diligence — tax, social security, environmental, and regulatory — is therefore essential to identify the level of risk before committing.
• Cross-cultural integration: intercultural management is one of the most underestimated success factors. French companies that neglect this aspect — management style, internal communication, relationship to hierarchy — encounter significant difficulties in their post-acquisition operations.
• High transaction costs: audit, negotiation of definitive agreements, take-over, and legal and tax advisory fees — the total cost of the project can be significant.
• Sometimes rigid governance: certain Brazilian corporate structures maintain consent clauses, shareholders' preemption rights, or blocking mechanisms that complicate the acquirer's takeover and, where applicable, exit.

These risks are real but manageable. Above all, they illustrate the need for rigorous preparation ahead of any M&A operation in Brazil. Sectors subject to certain restrictions on foreign investment — notably energy, infrastructure, and rural land (Annexes 10-C and 10-E of the agreement) — call for specific upfront analysis. Outside these cases, however, the Brazilian market remains broadly open, and the figures bear this out: 601 crossborder transactions in 2024, including 394 led by majority foreign-owned groups (KPMG Brasil, February 2025).

III. Legal and Tax Points of Vigilance

1. The Requirement of Legal Representation

Under Brazilian law, notably under the Civil Code (Article 1,134) and the rules governing corporations (Corporations Law No. 6,404/76), any foreign entity wishing to register or acquire a company must appoint a legal representative residing in Brazil. This power-of-attorney requirement — the mandato — is more than an administrative formality. It carries significant practical consequences: liability of the representative, the need to identify a trustworthy profile with knowledge of local law and practice, and risks in the event the appointed representative defaults. This constraint effectively conditions the validity of many operations and requires securing local legal counsel from the earliest stages of an establishment project.

2. Prior CADE Review

Any merger transaction likely to produce effects within Brazilian territory is subject, under certain conditions, to prior review by the Conselho Administrativo de Defesa Econômica (CADE), Brazil's competition authority. Under Article 88 of Law 12,529/2011, notification is mandatory when at least one of the groups involved has recorded annual gross revenue in Brazil equal to or greater than 750 million reais, and another group has recorded at least 75 million reais. These thresholds are cumulative. The review process can take up to 240 days, extendable by a further 90 days. Completing the transaction before CADE's decision exposes the parties to significant fines (gun-jumping) and to the nullity of acts already carried out. This review period must be anticipated from the earliest stage of structuring the transaction.

3. The Impact of Tax Reform: A Critical New Development for European Investors

The EU–Mercosur agreement does not harmonize direct taxation. Tax rates applicable to companies and to income flows vary across Mercosur countries, and existing bilateral tax treaties between member states and Mercosur countries remain essential to optimizing the structuring of cross-border investments.

Against this backdrop, a far-reaching tax reform entered into force in Brazil on 1 January 2026 and directly affects the expected return calculation of an acquisition. Law No. 15,270/2025, enacted on 26 November 2025, reintroduced a 10% withholding tax (IRRF) on profits and dividends distributed by a legal entity to an individual resident in Brazil, where the monthly amount distributed by a given source exceeds 50,000 reais. For non-residents — including European investors — the 10% withholding applies regardless of the amount distributed, with no exemption threshold. This measure, confirmed by the Receita Federal in its Normative Instruction RFB No. 2299 of 18 December 2025, ends nearly thirty years of full exemption on distributed dividends and materially changes the return-on-investment calculation for any European acquirer.

In addition, the reform of Brazil's VAT system — the creation of the CBS and IBS taxes, being rolled out through 2033 — is reshaping the tax-burden structure across sectors. In an acquisition, a target's valuation can shift significantly depending on its sectoral positioning relative to this reform. Comprehensive tax due diligence, covering both the IRRF regime on dividends and the indirect effects of the reform, is essential before any asset valuation.

Conclusion

Brazil, anchored in the momentum of Mercosur and in the historic agreement concluded with the European Union, stands out as one of the most attractive destinations for M&A operations worldwide. Article 1.2(f) of the treaty lays the foundations for a stable and non-discriminatory establishment framework, and Article 10.3.1 opens new prospects for European investors. Hundreds of foreign companies take this step every year. The market is not inaccessible — it is demanding.

Legal challenges remain: the requirement of local legal representation, prior CADE review, latent liabilities to be identified through due diligence, and the new 10% withholding tax on dividends paid abroad since January 2026. These constraints are real — but they are known, documentable, and manageable with the right support. They are an integral part of the acquisition strategy.

The EU–Mercosur agreement has opened a historic strategic window. Companies that know how to anticipate it — by rigorously structuring their operations, securing specialized legal counsel, and factoring in Brazil's tax and regulatory specifics from the outset — will give themselves the best chance of seizing an opportunity that the numbers, for their part, do not call into question.

Sources and References

– EU–Mercosur Partnership Agreement, full text, OJ L 2026/184 of 27 February 2026 — Articles 1.2(f), 10.3.1, 10-C, 10-E, 14.1, 14.2, 14.3

– European Commission, "The EU–Mercosur trade agreement," commission.europa.eu, accessed June 2026

– KPMG Brasil, Pesquisa Fusões e Aquisições – Q4 2024, February 2025 (1,582 transactions, +5% vs. 2023)

– Aon / TTR Data / Datasite, Latin America M&A Report 2024, February 2025 (Brazil: 1,674 transactions, regional leadership)

– Brazilian Civil Code (Law No. 10,406/2002), Article 1,134 — legal representation of foreign companies

– Corporations Law (Law No. 6,404/76) — joint-stock companies

– Law No. 12,529/2011, Article 88 — mandatory notification thresholds for CADE (R$750 million / R$75 million)

– Law No. 15,270/2025, enacted 26 November 2025 — 10% withholding tax on dividends

– Receita Federal, Normative Instruction RFB No. 2299 of 18 December 2025 — implementation of Law 15,270

– Receita Federal, Q&A on dividend taxation, published 16 December 2025

A Lei Complementar nº 224/2025 promoveu a redução linear de 10% em diversos benefícios e incentivos fiscais existentes até então, incluindo diversos casos de desoneração de PIS e COFINS. Com isso, a partir de 1º de abril de 2026, operações que antes gozavam de isenção ou alíquota zero dessas contribuições passaram a ser tributadas ao equivalente a 10% da alíquota do sistema padrão, a depender do regime aplicável (cumulativo ou não cumulativo).

A medida, que poderia parecer razoável dentro de uma lógica de isonomia, trouxe uma estranha quebra de neutralidade em seu art. 4º, § 7º, no qual há a vedação ao aproveitamento de créditos de PIS/COFINS para o adquirente de bens e serviços:

“a aplicação do disposto no inciso I do § 4º [10% da alíquota padrão para os casos de isenção e alíquota 0] deste artigo não permite ao adquirente de bens e serviços a apropriação de créditos que, nos termos da legislação em vigor, seriam vedados em decorrência da isenção ou aplicação da alíquota 0 (zero).”

A despeito da dubiedade dessa redação, a Instrução Normativa RFB 2.305/25 e o “Perguntas e Respostas” da Receita Federal reproduziram os mesmos termos, sem qualquer esclarecimento adicional. 

Como a própria Lei Complementar nº 224/2025 impôs carga tributária mínima (10% das alíquotas padrão) às operações antes beneficiadas com isenção ou alíquota zero, elas deixaram de estar totalmente desoneradas, acabando com as situações de isenção ou alíquota zero. Assim, analisando-se a redação do dispositivo, entendemos que há ao menos duas leituras possíveis:

• Vedação total à apropriação de créditos: a norma manteria a proibição de apropriação de créditos independentemente da tributação efetiva (10% das alíquotas padrão), por remissão à legislação anterior, que vedava a apropriação de créditos em caso de isenção ou alíquota zero;
• Crédito proporcional: a vedação ao crédito se aplicaria apenas à parcela não tributada (90% da alíquota padrão, ainda desonerada), sendo legítimo a apropriação do crédito sobre o montante de 10% efetivamente onerado pelo PIS/COFINS.

A primeira interpretação é absolutamente anômala, violando a regra da isonomia e da não cumulatividade do PIS/COFINS. Afinal, impedir o crédito do PIS/COFINS diante de situação na qual a etapa anterior sofreu incidência tributária, ainda que parcial, acaba por cumular a tributação das contribuições e distorcer a precificação dos bens e serviços, colocando em xeque a própria razão de ser do regime não cumulativo. Ou seja, atenta contra a própria finalidade da não cumulatividade.

A segunda interpretação, embora seja a que melhor se coaduna com a não cumulatividade e a isonomia, exige, do intérprete, maior digressão ao sistema constitucional e, sobretudo, maior ônus argumentativo, na medida em que se distancia da literalidade do texto do § 7º.

Apesar disso, entendemos que a segunda interpretação é a única que se encontra em consonância com a Constituição Federal, especialmente quando considerada a isonomia, a justiça tributária e a não cumulatividade.

Nesse contexto, algumas liminares têm reconhecido que o § 7º do art. 4º da LC 224/2025 não pode suplantar a não cumulatividade do PIS/COFINS, reconhecendo aos contribuintes o direito ao aproveitamento proporcional dos créditos de PIS/COFINS (10% da alíquota global de 9,25%).

Diante desse cenário, as empresas que adquirem bens e serviços alcançados pela redução linear de benefícios da LC 224/2025 podem considerar as seguintes estratégias:

• Apropriar o crédito proporcional (0,925%) e assumir o risco de eventual questionamento pela Receita Federal, com a possibilidade de se defender posteriormente na esfera administrativa (e suportado em parecer técnico fundamentado na Constituição);
• Ajuizar mandado de segurança buscando decisão judicial que reconheça o direito ao crédito proporcional de PIS/COFINS (0,925%), inclusive com pedido liminar que reconheça esse direito de forma imediata.

A ausência de uma regulamentação clara pela Receita Federal e os primeiros sinais do Judiciário indicam que esse tema tende a se consolidar como um contencioso tributário relevante em 2026.

Para mais informações sobre o tema, nossa equipe tributária permanece à disposição.

We share the guide "Investing in Brazil: An overview of the legal framework," originally presented by GTLawyers at WebSummit Rio and fully updated with information current as of June 2026. 

Authored by Tamy Tanzilli, Estevão Gross, Carolina Moresco, Cécile Verdeaux, and Anne-Catherine Brunschwig, this document sets out, in summary form, the four key steps for a successful market entry: structuring commercial relationships, incorporating a subsidiary, understanding taxation (including the ongoing tax reform transition), and hiring staff.

Click Here to download the complete guide.

Companies accumulate, on a daily basis, large volumes of personal data customer records, employee documents, supplier information, marketing databases, contracts, invoices, access logs, service records and many others. This storage, though often necessary for business operations, cannot be unlimited.

Both the Brazilian General Data Protection Law (LGPD) and the European Union General Data Protection Regulation (GDPR) share a common premise: personal data must be kept only for as long as necessary to fulfil the purpose that justified its collection, unless there is a legal basis permitting its retention for a longer period.

In practice, this is one of the most sensitive aspects of privacy governance. Although the rule is straightforward, its application requires careful assessment, since data protection legislation generally does not establish a single, universal retention period for each type of personal data. In this context, companies are responsible for defining their own criteria, taking into account the purpose of the processing, legal or regulatory obligations, limitation periods, operational needs and risks to data subjects.

Why does data retention matter?

Excessive retention of personal data increases legal, operational and security risks. The longer a company holds personal data without a clear processing need, the greater its exposure in the event of a security incident, unauthorized access, use of outdated information, data subject requests or scrutiny by regulatory authorities.

In this context, retention and disposal rules should not be seen merely as a formal privacy requirement. On the contrary, they form part of sound information governance and help reduce concrete risks for the company.

A well-structured retention policy enables companies to:

- define retention and disposal periods;

- reduce the unnecessary storage of personal data;

- facilitate responses to data subject requests;

- reduce security risks;

- demonstrate legal and regulatory compliance.

LGPD and GDPR: retention, deletion and legal exceptions

The LGPD and the GDPR adopt a similar logic: personal data must be retained only for as long as it is necessary for the purpose that justified the processing. Once that purpose has been fulfilled, the general rule becomes the deletion or anonymisation of the data, unless there is a legal basis authorising its continued retention

In Brazil, the LGPD permits the retention of personal data in specific circumstances, such as compliance with a legal or regulatory obligation, research by a research body, transfer to third parties in accordance with the law, or exclusive use by the controller, provided that the data is anonymised wherever applicable.

Similarly, the GDPR allows retention where necessary, for example, for compliance with a legal obligation, the establishment, exercise or defence of legal claims, or for certain purposes of public interest, research, statistics or archiving, provided to the applicable safeguards.

In this context, the key point is that companies must not retain personal data indefinitely or merely “as a precaution”. Compliance therefore depends on the ability to define, document and consistently apply clear criteria for retention and disposal, aligned with legitimate legal, regulatory and business needs.

Guidance from data protection authorities

Data protection authorities generally require companies to define retention periods based on necessity and proportionality criteria. In other words, it is not sufficient to retain data because it “might be useful in the future”: it is necessary to objectively justify why that data is still needed.

The Information Commissioner’s Office (ICO), the UK data protection authority, advises organizations to be able to justify how long they retain personal data, to establish standard retention periods wherever possible, to periodically review stored information and to delete or anonymize data that is no longer needed.

Complementarily, the French data protection authority (CNIL) also provides practical parameters on the subject. In the context of commercial management, for example, the CNIL indicates that customer data used for prospecting may be retained during the commercial relationship and, after it ends, generally for up to three years. Data relating to potential customers may generally be retained for three years from the date of collection or from the date of the last contact initiated by the potential customer.

This guidance does not replace a case-by-case analysis, but serves as a relevant reference for companies that are structuring their internal retention schedules.

Carrefour and the risks of excessive retention

The Carrefour case clearly illustrates the risks associated with excessive retention of personal data.

In 2020, the CNIL imposed a fine of EUR 2.25 million on Carrefour France for several GDPR violations, including excessive data retention. Among other findings, the authority determined that the company had retained inactive customers’ data for longer than necessary and had kept copies of identity documents submitted in connection with data subject requests for longer than was justifiable.

This case demonstrates that authorities do not assess retention periods merely in the abstract. In practice, they expect companies to implement effective deletion routines, document their retention criteria and ensure that their internal systems actually reflect the privacy policies and notices made available to the public.

The role of Controllers and Processors in data retention

The obligations relating to retention may vary depending on whether the company acts as a controller or processor of personal data. In this context, Controllers and Processors assume distinct, albeit complementary, responsibilities.

Controllers are generally responsible for defining the purposes of processing and the applicable retention periods. Processors, in turn, must process personal data in accordance with the documented instructions of the controller and, at the end of the service provision, return, delete or otherwise dispose of the data, unless there is a legal obligation justifying its retention.

Indiscriminate retention, in this scenario, may generate risks for both parties. For the Controller, retaining data without criteria makes it difficult to control the information lifecycle and may increase regulatory exposure. For the Processor, on the other hand, retaining data beyond what is necessary may increase security risks, contractual liability and questions regarding adherence to the instructions received.

For this reason, contracts involving personal data processing must clearly set out what will happen to the data at the end of the contractual relationship, including return, deletion, anonymisation, retention due to legal obligation and, where applicable, evidence of disposal.

What companies should do

To manage retention and disposal risks, companies should adopt practical and documented measures, including:

- mapping the main categories of personal data processed;

- identifying the purpose and legal basis for each processing activity;

- defining objective retention periods or criteria;

- linking retention periods to legal obligations, limitation periods and legitimate business needs;

- implementing secure deletion or anonymisation routines;

- reviewing legacy databases and inactive records;

- ensuring that privacy notices and internal policies reflect the practices actually adopted;

- including retention and deletion clauses in contracts involving personal data processing;- documenting exceptions where data must be retained for legal, regulatory or litigation-related reasons.

Data retention, though often underestimated, is one of the central elements of data protection compliance. Retaining data for longer than necessary increases legal, security and reputational risks. On the other hand, deleting data too early may compromise compliance with legal obligations or the company’s ability to defend its rights.

Given this, the solution does not lie in adopting a generic retention period for all data, but in structuring a retention and disposal policy supported by a retention schedule, clear internal responsibilities and practical deletion or anonymisation procedures.

At GTLawyers, our data protection team assists companies in drafting and implementing retention and disposal policies, reviewing data processing contracts, mapping legal retention obligations and aligning internal practices with the LGPD, the GDPR and other international privacy standards.