EXIN LGPD Essentials study guide
EXIN LGPD Essentials · Work through your exam, one topic at a time.
The EXIN LGPD Essentials certification is intended to validate foundational knowledge of Brazil's Lei Geral de Proteção de Dados (LGPD). It is aimed at privacy officers, compliance and legal staff, IT and security teams, HR and marketing professionals, and anyone handling personal data in or with Brazil who needs a working command of the law's core concepts. The EXIN LGPD Essentials study guide has 4 sections and about 2,412 words.
01LGPD fundamentals and scope
The exam here asks a deceptively simple question: does this processing operation fall under Lei nº 13.709/2018 at all? Articles 3 and 4 (scope and exclusions) are tested far more often than the preamble.
501 words, about 3 min02Legal bases and data subject rights
Processing is lawful only if it fits one of: (1) consent; (2) compliance with a legal or regulatory obligation by the controller; (3) public administration executing public policies; (4) research by a research body, anonymised where possible; (5) contract performance or pre-contractual steps at the subject's request; (6) exercise of rights in judicial, administrative or arbitration proceedings; (7) protection of life or physical safety of the subject or a third party; (8) health protection by health professionals, services or authorities; (9) legitimate interest; (10) credit protection. Consent is neither mandatory nor superior - a payroll file rests on legal obligation.
463 words, about 2 min03Controller and processor obligations
Controlador decides the purposes and means of processing; operador processes on the controller's behalf. The label drives liability, so the exam tests borderline cases: a processor that sets its own purposes, or ignores lawful instructions, is equated to a controller for that processing.
475 words, about 2 min04DPO (Encarregado)
The controller must appoint an encarregado and publicly disclose the identity and contact details, preferably on its website (Art. A processor is not obliged to appoint one unless it also acts as a controller.
973 words, about 5 min