EXIN LGPD Essentials cheat sheet

Lei 13.709/2018 (LGPD) entered into force on 18 September 2020; administrative sanctions became enforceable from 1 August 2021 via ANPD.

Article 1 scope: processing of personal data by natural persons or legal entities under public or private law, including digital and physical (analog) media.

Personal data = information relating to an identified or identifiable natural person; sensitive personal data adds racial/ethnic origin, religious belief, political opinion, union membership, health, sex life, genetic or biometric data.

The LGPD does not apply to processing by a natural person exclusively for private and non-economic purposes, nor to processing solely for journalistic, artistic, or academic purposes (Arts. 4 and 12).

Anonymized data falls outside the LGPD unless the anonymization process can be reversed with reasonable effort; pseudonymized data remains personal data.

Legal persons are not data subjects under the LGPD; protection covers only natural persons (pessoas naturais).

Territorial reach (Art. 3): processing carried out in Brazil, processing aimed at offering goods/services to individuals located in Brazil, or data collected in Brazil.

Key definitions: controller (controladora) decides on processing; processor (operador) processes on behalf of the controller; DPO (encarregado) is the communication channel.

Fundamental principles (Art. 6): purpose limitation, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, accountability, and best interest of the child.

Ten legal bases (Art. 7): consent, legal/regulatory obligation, public administration policy, research, contract performance, exercise of rights, protection of life, health protection by professionals, legitimate interest, credit protection.

Sensitive data (Art. 11) has a narrower list: consent must be specific and highlighted, plus obligations, public policy, research, exercise of rights, life protection, health protection, and fraud prevention for security purposes.

Consent must be free, informed, and unambiguous, given for specific purposes; written consent is required when sensitive data is involved.

Consent can be revoked at any time by the data subject, and processing based on it must stop, subject to prior processing lawfulness.

Legitimate interest requires a balancing test (legitimate purpose, necessity, transparency, and reasonable expectations of the data subject); ANPD may request a data protection impact assessment.

Rights (Art. 18): confirmation of processing, access, correction, anonymization/blocking/elimination of unnecessary data, portability, deletion of consent-based data, information about sharing, information about the right to refuse consent, and revocation of consent.

Access requests must be answered within 15 days; the controller must provide a clear and adequate response about the data and processing.

Data subjects may petition ANPD against the controller after contacting the controller directly, and may also pursue judicial remedies.

Deletion right does not apply where retention is required by legal or regulatory obligation or for other legal bases such as contract or exercise of rights.

Controller must keep records of processing operations (ROPA), especially when based on legitimate interest, and maintain a privacy governance program.

Controller and processor must adopt technical and administrative security measures appropriate to the risk; the controller is liable for damage caused by processing.

Processor is liable jointly with the controller when it fails to comply with data protection legislation or the controller's lawful instructions, and is directly liable when it acts outside those instructions.

Data processing agreements (DPA) should define purpose, duration, scope, security measures, and sub-processor rules; the controller retains direction over the processing.

International transfers allowed only to countries with adequate protection, or via standard contractual clauses, binding corporate rules, specific consent, contract performance, or other Art. 33 exceptions.

Accountability (Art. 6, X) requires demonstrating compliance, including impact assessments for high-risk processing.

Data protection impact assessment (RIPD) must be requested by ANPD when processing may cause high risk to data subjects and is mandatory in those cases.

Controllers must notify ANPD and the data subject of security incidents that may cause relevant risk or damage.

Records of processing and impact assessments must be kept for at least 5 years, or longer if ANPD requires.

The DPO (encarregado) is appointed by the controller and identified publicly, including on the controller's website, with contact information.

DPO duties (Art. 41): accept complaints and communications from data subjects, provide clarifications, receive ANPD communications, and advise the controller's staff on data protection practices.

The DPO must be a natural person, may be internal or external, and must have autonomy and access to the organization's processing operations.

ANPD Resolution CD/ANPD No. 18/2024 sets rules for DPO appointment, including the possibility of a legal entity or shared DPO arrangements, and requires publication of the DPO's identity and contact.

The DPO's identity and contact must be disclosed clearly and objectively, typically in the privacy notice and on the website.

The DPO is not personally liable for the controller's processing; liability rests with the controller and processor.

DPO plays a key role in responding to data subject requests and in the incident notification workflow.

Security incident notification to ANPD is required when the incident may cause relevant risk or damage to data subjects; the controller must also notify affected data subjects.

ANPD Resolution CD/ANPD No. 15/2024 sets the notification deadline: 3 business days from knowledge of the incident, extendable with justification.

The notification must include the nature of the data, the data subjects involved, technical and security measures used, risks, and mitigation measures.

ANPD sanctions (Art. 52): warning, fine of up to 2% of the company's revenue in Brazil, capped at R$ 50 million per infraction, daily fines, publicizing the infraction, blocking of data, deletion of data, and suspension of processing.

Sanctions are applied after administrative proceedings (processo de fiscalização) and consider good faith, the controller's cooperation, the extent of damage, and the existence of a compliance program.

ANPD is the competent authority for enforcement; it can issue regulations, conduct inspections, and request impact assessments.

Security measures include encryption, access control, incident response plans, and regular audits; the controller must document them.

The controller must keep records of incidents and remediation for accountability and potential ANPD review.