EXIN LGPD Essentials common mistakes
EXIN LGPD Essentials · Understand the traps and how to avoid them.
Treating the LGPD's territorial scope as applying only to organisations established in Brazil, and answering that a foreign company with no Brazilian establishment falls outside the law.
Candidates carry over a mental model from establishment-based regimes and overlook that Lei 13.709/2018 Art. 3 applies whenever personal data is processed in Brazil, the processing aims at offering goods or services to individuals located in Brazil, or the data was collected in Brazil. The 'offer of goods or services' and 'data collected in Brazil' triggers are the ones most often forgotten.
What to do instead
Memorise the three independent Art. 3 triggers and test each fact pattern against all three separately. For any hypothetical involving a foreign entity, ask explicitly: was data collected in Brazil, and is the processing aimed at people in Brazil? If either is yes, the LGPD applies regardless of establishment.
Confusing the LGPD's legal bases with the GDPR's, for example citing 'legitimate interest' for sensitive data or treating 'consent' as the default basis that must be used whenever no other basis is obvious.
The two laws share vocabulary but differ in structure: the LGPD has ten legal bases in Art. 7 and a separate, narrower list for sensitive data in Art. 11, and none of them is ranked as a default. Candidates who learned GDPR categories first often import the wrong list or assume a hierarchy.
What to do instead
Write out the Art. 7 list and the Art. 11 list side by side until you can state which bases are unavailable for sensitive data (in particular, legitimate interest is not among the Art. 11 bases). Practise classifying scenarios by asking 'which specific basis authorises this exact processing?' rather than defaulting to consent.
Answering that a data subject can always demand immediate erasure of any data held about them, without distinguishing the rights in Art. 18 from the situations where retention is legally required or the request must be handled through a different mechanism.
Rights questions are usually written as absolutes, and candidates answer from general intuition about privacy rights rather than the enumerated Art. 18 rights and their limits, such as legal or regulatory retention obligations and the possibility of anonymisation or blocking instead of deletion.
What to do instead
Learn the Art. 18 list as a set of distinct rights (confirmation, access, correction, anonymisation/blocking/elimination, portability, deletion of consented data, information about sharing, information about the right to refuse consent, revocation). For each, note the condition attached to it, especially that elimination of consented data is subject to legal retention duties.
Treating the controller and the operator (processor) as interchangeable, or saying the operator bears the same direct obligations toward data subjects as the controller.
In day-to-day speech both are 'the company handling data', and candidates skim the Art. 5 definitions. The exam tests the distinction because liability, the duty to respond to data subjects, and the duty to follow instructions all hinge on it.
What to do instead
Anchor the definitions: the controller makes the decisions about the processing; the operator processes on behalf of the controller and must follow the controller's instructions. Then, for any obligation question, first decide which role the entity in the scenario occupies and check whether the obligation attaches to that role specifically.
Assuming the DPO (encarregado) must always be a lawyer, must be an employee of the organisation, or must be a natural person physically located in Brazil.
Candidates generalise from local practice or from other jurisdictions' rules. The LGPD requires the controller to appoint an encarregado and to publish the identity and contact details, but the role can be filled by a natural or legal person and there is no statutory requirement of a legal qualification or local residency.
What to do instead
Separate what the law actually requires (appointment, publication of identity and contact, channel for communication with data subjects and the ANPD, guidance and training of staff, execution of other duties set by the controller) from common practice. When an answer option adds a qualification or location requirement, treat that addition as a red flag unless you can point to the statutory text.
Describing security obligations as a fixed checklist of specific technologies (for example, mandating encryption or a particular certification) rather than an outcome-based duty of appropriate technical and administrative measures.
Security chapters in other frameworks are often prescriptive, and vendors market specific controls, so candidates remember products rather than the legal standard. The LGPD sets a proportionality standard tied to the nature of the data and the risk, and the ANPD can require proof that measures are in place.
What to do instead
Frame the obligation as 'appropriate measures to protect data from unauthorised access, loss, alteration, or any form of inappropriate treatment', assessed against the sensitivity of the data and the risk. Remember the regulator can request documentation of the measures adopted, so the practical answer is governance and evidence, not a named product.
Getting the breach notification timing wrong, for example saying notification is required only if the ANPD asks, or giving a timeframe that does not match the rule, or omitting notification to data subjects.
Breach rules are the most detail-heavy part of the exam and candidates rely on vague memory of 'reasonable time' or conflate the ANPD notification with the duty to inform affected data subjects. The distinction between notifying the regulator and notifying individuals is easily lost.
What to do instead
Learn the structure: the controller must communicate a security incident that may cause relevant risk or damage to the ANPD and to the data subject, within the period defined by the regulator (currently three working days in the ANPD regulation), counted from knowledge of the incident. Also learn the required content of the communication and the criteria the ANPD uses to decide whether public disclosure is warranted.
Confusing the ANPD's sanctioning powers with criminal penalties, or assuming the maximum administrative fine is a flat amount regardless of the infringer's revenue.
The LGPD's sanctions are administrative and listed in Art. 52; criminal provisions come from separate legislation. Candidates also remember a headline figure without the calculation rule, so they miss that the fine is per infraction, capped by a percentage of revenue in the last fiscal year with an absolute ceiling.
What to do instead
List the Art. 52 sanctions (warning, simple fine, daily fine, publicising the infraction, blocking of the personal data, deletion, suspension of the database operation, partial or total suspension of processing activities, and prohibition of processing-related activities) and memorise the fine formula: up to 2% of the revenue in Brazil in the last fiscal year, excluding taxes, capped at R$50 million per infraction.
Answering that data subjects must always give consent before any processing, or that consent, once given, cannot be revoked or must be in writing.
Consent is the most familiar legal basis, so candidates over-apply it. The LGPD permits processing on any of the ten bases and treats consent as revocable at any time by the data subject, with specific requirements for how it must be obtained and evidenced.
What to do instead
Treat consent as one basis among several and check whether the scenario fits another basis better. For consent itself, remember it must be free, informed, and unambiguous, provided in writing or by another means that demonstrates the manifestation of will, and that it can be revoked at any time, with the controller required to demonstrate that it was obtained in compliance with the law.
Treating the data protection impact report (RIPD) as a document required for every processing operation, or as something the ANPD must approve before processing begins.
Impact assessment requirements are often generalised from other regimes, and candidates remember that an assessment exists but not its trigger. The LGPD ties it to processing that may generate relevant risk to data subjects' fundamental rights, and the ANPD may require it.
What to do instead
State the trigger precisely: the controller or operator may be required to prepare an impact report on data protection when the ANPD requests it, for processing that may generate relevant risk to the fundamental rights of data subjects, and the report must describe the processing and the measures to mitigate risk. Do not claim universal mandatory preparation or prior approval.