Skill to support understanding and application of Law No. 13.709/2018 (LGPD) in the context of systems, products and processes that process personal data in Brazil.
Overview
- Law: 13.709/2018 (LGPD). In force since 08/14/2018; amendments by Law 13.853/2019 (ANPD).
- Purpose: To protect the fundamental rights of freedom, privacy and free development of the personality of the natural person.
- Scope: Any personal data processing operation, in any medium, by a natural or legal person (public or private), provided that:
- the operation occurs in national territory; or
- the activity aims to offer goods/services or process data of persons located in Brazil; or
- the data has been collected in national territory (data subject in Brazil at the time of collection).
Exceptions (Art. 4): exclusively private and non-economic use; journalistic/artistic purposes; academic purposes (in compliance with Arts. 7 and 11); public security, national defense, State security, investigation and repression of criminal offenses (specific legislation); data originating from outside Brazil without communication/sharing/international transfer with Brazilian agents (with reservations).
Essential concepts (Art. 5)
| Term | Summary definition |
|---|---|
| Personal data | Information related to an identified or identifiable natural person |
| Sensitive data | Racial/ethnic origin, religious conviction, political opinion, union/religious/philosophical/political affiliation, health, sexual life, genetic or biometric data linked to a natural person |
| Data subject | Natural person to whom the data refers |
| Controller | The one who decides on the processing |
| Operator | The one who processes on behalf of the controller |
| Data Protection Officer (DPO) | Channel between the controller, data subjects and the ANPD |
| Processing | Collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation, control, modification, communication, transfer, dissemination or extraction |
| Consent | Free, informed and unambiguous manifestation for a determined purpose |
Principles (Art. 6)
Every processing activity must observe good faith and:
- Purpose – Legitimate, specific, explicit purposes informed to the data subject; without incompatible subsequent processing.
- Adequacy – Compatibility with the informed purposes and the context.
- Necessity – Minimum necessary; pertinent, proportional and non-excessive data.
- Free access – Facilitated and free consultation regarding the form, duration and completeness of the data.
- Quality – Accuracy, clarity, relevance and updating in accordance with the purpose.
- Transparency – Clear, precise and accessible information about processing and agents (commercial and industrial secrets respected).
- Security – Technical and administrative measures against unauthorized access and unlawful or accidental situations (destruction, loss, alteration, communication, dissemination).
- Prevention – Measures to prevent harm.
- Non-discrimination – No processing for unlawful or abusive discriminatory purposes.
- Accountability and rendering of accounts – Demonstration of effective compliance measures.
Legal bases for processing (Art. 7)
The processing of personal data may only occur when at least one of the following hypotheses applies:
- I – Consent of the data subject
- II – Legal or regulatory obligation of the controller
- III – Execution of public policies by the public administration (in accordance with Chapter IV)
- IV – Studies by a research body (anonymization when possible)
- V – Execution of a contract or preliminary procedures at the request of the data subject
- VI – Regular exercise of rights in judicial, administrative or arbitration proceedings
- VII – Protection of the life or physical safety of the data subject or a third party
- VIII – Protection of health (health professionals/services or health authority)
- IX – Legitimate interests of the controller or a third party, except where the fundamental rights and freedoms of the data subject prevail
- X – Protection of credit
Consent (Art. 8): in writing or by another means demonstrating the will; highlighted clause if in writing; burden of proof on the controller; processing with defective consent prohibited; determined purposes (generic authorizations null); revocation at any time, free of charge and facilitated.
Data manifestly public by the data subject may be processed without consent, respecting rights and principles. Waiver of consent does not waive the other obligations of the law.
Sensitive data (Art. 11)
Processing of sensitive data only:
- With specific and highlighted consent for specific purposes; or
- Without consent when indispensable for: (a) legal/regulatory obligation; (b) public policies; (c) studies by a research body (anonymization when possible); (d) regular exercise of rights (contract/process); (e) protection of life or physical safety; (f) health protection (professionals/services/health authority); (g) fraud prevention and security of the data subject (identification/authentication in systems), respecting the data subject's rights.
Prohibitions: sharing of health data between controllers for the purpose of economic advantage, except in the legal cases (e.g., portability at the request of the data subject, provision of health services). Health plan operators may not use health data for risk selection in contracting or exclusion of beneficiaries.
Children and adolescents (Art. 14)
- Processing in the best interest of the child/adolescent.
- Data of children: consent specific and highlighted from at least one of the parents or legal guardian.
- Controllers must keep public information about the types of data, the manner of use and the exercise of rights (Art. 18).
- Collection without consent only when necessary to contact parents/guardian (single use, without storage) or for protection; do not pass on to third parties without the consent of § 1.
- Do not condition participation in games/applications on the collection of data beyond what is strictly necessary.
Data subject rights (Art. 18)
The data subject has the right to obtain from the controller, at any time, upon request:
- I – Confirmation of the existence of processing
- II – Access to the data
- III – Correction of incomplete, inaccurate or outdated data
- IV – Anonymization, blocking or elimination of unnecessary, excessive or unlawful data
- V – Portability of the data to another provider (in accordance with ANPD regulations, commercial and industrial secrets)
- VI – Elimination of data processed with consent (except for the cases in Art. 16)
- VII – Information about public and private entities with which shared use was made
- VIII – Information about the possibility of not consenting and the consequences of refusal
- IX – Revocation of consent (Art. 8 § 5)
The data subject may petition the ANPD against the controller and object to processing based on a waiver of consent in the event of non-compliance with the law. The request must be met at no cost to the data subject, within the regulatory deadlines.
ANPD (National Data Protection Authority)
- Entity responsible for ensuring, implementing and supervising compliance with the LGPD throughout the national territory.
- It issues regulations, guidelines and may request personal data protection impact report (RIPD) in higher-risk processing (e.g., based on legitimate interest).
- Application of administrative sanctions (fines, warnings, etc.) in accordance with the law.
Termination and deletion (Arts. 15 and 16)
Processing ends when: (I) the purpose has been achieved or the data is no longer necessary; (II) the end of the processing period; (III) communication by the data subject (incl. withdrawal of consent), safeguarded public interest; (IV) determination by the ANPD in case of violation.
After termination, the data must be deleted, except when retention is permitted (e.g., legal/regulatory obligation, study with anonymization, etc.).
Practical checklist for systems and products
When designing or reviewing data processing in Brazil:
- Identify whether the LGPD applies (territory, offering of goods/services, data collected in Brazil).
- Map personal and sensitive data; document purpose and legal basis (Art. 7 or 11).
- Ensure that consent, when required, is specific, highlighted, and revocable free of charge and in a facilitated manner.
- Respect principles: necessity (minimum data), transparency, security, prevention.
- Implement channels for exercising data subject rights (access, correction, deletion, portability, withdrawal, objection).
- Appoint a data protection officer and disclose a contact channel (data subjects and ANPD).
- Assess the need for a DPIA in higher-risk processing.
- For children's data: consent of parents/guardian; do not condition activities on collection beyond what is necessary.
- For sensitive data: check the hypothesis under Art. 11 and prohibitions (e.g., health data for economic advantage, risk selection in health insurance plans).
Official reference
- Law 13.709/2018 (compiled text): planalto.gov.br
- ANPD – guidelines and frequently asked questions: gov.br/anpd
- For consultation by article (law structure and provisions), see reference.md.
Notice: This skill summarizes the LGPD for support in analysis and implementation. For definitive legal decisions or formal compliance, consult the law, ANPD regulations, and specialized legal advice.