LGPD: how to ask a company for the records of an electronic signature

Whoever signs an electronic contract leaves traces: IP address, time, device, authentication method and envelope history. These records are the signer's personal data, and the General Data Protection Law (LGPD) guarantees the right of access. In practice, the request runs into doubts about who is responsible for the data, what the platform delivers and when the courts need to step in. This guide organizes the path, with deadlines, legal grounds and a model request.

1. Direct answer

The data subject may ask the company that processes the data to confirm the processing and give access to the data (LGPD, art. 18, I and II). A complete answer must be given within 15 days (art. 19, II). If the company does not answer or refuses, the data subject may complain to the National Data Protection Authority (ANPD) and to the courts. Application access records may require a court order when requested by third parties.

2. Legal basis

• LGPD (Law 13.709/2018), art. 5: concept of personal data and data subject.
• LGPD, art. 18: rights of the data subject, among them confirmation of processing, access, correction and information on sharing.
• LGPD, art. 19: response deadlines: immediate, in simplified format, or within 15 days, by a complete declaration, with the origin of the data, criteria and purpose.
• LGPD, art. 41: the controller appoints a data protection officer (DPO) as the communication channel with data subjects and the ANPD.
• LGPD, art. 55-J: the ANPD receives petitions from data subjects against controllers, after the unresolved complaint to the controller is shown.
• Marco Civil da Internet (Law 12.965/2014), art. 10: the retention and availability of connection records and application access records must respect privacy; content and associated data may only be made available by court order.
• Marco Civil, art. 15: an application provider, incorporated as a legal entity, keeps application access records for six months.
• Marco Civil, art. 22: the interested party may ask the judge to order the supply of records, with well-founded indications of wrongdoing and a justification of their usefulness as evidence.
• Law 14.063/2020: types of electronic signature.

3. Who is responsible for the data

1. The signature platform (for example, DocuSign) processes the envelope data and may act as processor or controller, depending on the case.
2. The company that sent the document is, as a rule, the controller of the signing-flow data it configured.
3. The data subject is the signer.

The request may be addressed to both. It is common for the platform to refer the data subject to the sender of the document, and for the sender to refer them to the platform. That is why it helps to make both requests at the same time, mentioning each to the other.

4. What can be requested

• Certificate of Completion and the envelope's event history.
• Date, time and time zone of each event relating to the data subject.
• IP address and device used in the data subject's events.
• The authentication method applied.
• Origin of the data and purpose of processing.
• Information on with whom the data was shared.

The right covers the data subject's own data, not that of other signers.

5. Step by step for the request

1. Identify the document: envelope number, date and e-mail used for signing.
2. Locate the privacy channel (data protection officer) of the platform and of the sending company.
3. Send the request in writing, citing the legal ground.
4. Ask for specific items, not just "my data".
5. Keep the protocol and date; the 15-day period runs from the request.
6. If there is no answer, complain to the ANPD, attaching the request and proof of sending.
7. Consider a lawsuit for specific performance, with a request for an urgent injunction if there is a risk of disposal.

Model request

Subject: Data subject request – LGPD, art. 18, I and II – Envelope [code] I, [full name], CPF [number], data subject of the personal data processed in the signing of the document [title], on [date], through the e-mail [address], request, under arts. 18, I and II, and 19, II, of Law 13.709/2018: (1) confirmation of the existence of processing; (2) access to the Certificate of Completion, the event history and the records of date, time, IP address and authentication method relating to my signatures in the envelope; (3) information on the origin of the data and any sharing. I request an answer within 15 days.

6. When a court order is needed

The Marco Civil protects application access records. Anyone who intends to use these records as evidence, and does not obtain them through the privacy channel, may ask the judge to order their supply (art. 22). In that case:

• state the well-founded indications of wrongdoing;
• justify the usefulness of the records as evidence;
• delimit the period to which the records refer.

The platform may state that delivery to third parties depends on that order. This does not prevent the data subject from asking for their own data under the LGPD.

7. Points of attention

• The company may refuse part of the request for trade secrecy or security, but must justify it.
• The six-month retention in the Marco Civil is a minimum. Many platforms keep records for longer.
• Request as soon as possible, because records may be disposed of.
• The ANPD receives the complaint after a solution has been attempted with the controller.
• A generic request gets a generic answer.

8. Common mistakes

• Addressing the request only to the platform or only to the sender.
• Not stating the envelope number.
• Asking for "all data" without specifying.
• Losing the proof of sending and date.
• Waiting beyond the deadline to go to the ANPD or the courts.

9. In the Pernod Ricard, Michael Page and Page Interim case

The claimant asked DocuSign for the records of Envelope 8B6491BE, of instrument ID c28562b, presented by Pernod Ricard to the labor court as the contract of the temporary regime. That instrument is an RPO contract signed by Michael Page International and Page Personnel, not by Page Interim, the claimant's employer. The evidence sought is the Certificate of Completion, whose function is explained in the post on the DocuSign Certificate of Completion.

In parallel, the 10th Federal Criminal Court of São Paulo converted into a police inquiry, on 24/07/2026, proceeding no. 5005483-74.2026.4.03.6181, whose object is that instrument, and the MPF stated, on 13/10/2026, that it did not oppose the claimant's access to the case file, as a victim.

10. Frequently asked questions

Can I ask for the records of a signature I did not make? Not under the LGPD. Third-party requests depend on a court order.

How long does the platform keep the records? The Marco Civil sets six months as the minimum for application providers.

Can the company charge for access? Access to personal data must be free of charge, under the LGPD.

Does the ANPD resolve the case? The ANPD may order measures from the controller, but does not replace the courts for purposes of evidence in a case.

Know your rights: Labor rights guide