EXIN LGPD Essentials study plan

Map the structure of Lei 13.709/2018 (LGPD): list its chapters and state in one sentence what each chapter governs

Distinguish personal data, sensitive personal data, anonymized data, and pseudonymized data by writing your own examples for each category

Identify who qualifies as data subject, controller, processor, and operator under the LGPD and explain how controller and processor roles differ in practice

Explain the territorial and material scope of the LGPD, including when the law applies to processing performed outside Brazil

Summarize the principles in Article 6 and match each principle to a concrete processing scenario

Compare the LGPD principles with GDPR principles to identify where the LGPD adds or emphasizes requirements

Explain the role and composition of the ANPD and how it relates to other authorities

Describe how the LGPD interacts with sector rules such as the Marco Civil da Internet and the Consumer Protection Code

List all ten legal bases for processing and state the conditions under which each can be relied on

Distinguish legitimate interest from consent, including what a legitimate interest assessment must document

Explain the special rules for sensitive personal data and for processing of children's and adolescents' data

Apply the correct legal basis to five short hypothetical processing activities and justify each choice

Enumerate the data subject rights in Articles 17 to 20 and describe what each right entitles the holder to receive or request

Explain how consent must be obtained, recorded, and revoked, and what happens to processing after revocation

Describe the procedure and deadlines a controller must follow when a data subject submits a request

Analyze when a controller may lawfully refuse or partially fulfill a data subject request

Draft the core elements of a record of processing activities (ROPA) for a fictional organization

Explain the obligations of the controller and the joint controller, and distinguish them from processor duties

Describe what must be included in a data processing agreement between controller and processor

Explain the role, appointment, duties, and position of the DPO (encarregado) under the LGPD and ANPD guidance

Explain the requirements for a data protection impact assessment (RIPD) and identify when the ANPD or the controller must require one

Describe the security and good-practice measures expected under Articles 46 to 49 and how they map to confidentiality, integrity, and availability

Outline the incident response process from detection through containment, assessment, and documentation

Explain the breach notification duty to the ANPD and to data subjects, including timing and content requirements

List the administrative sanctions the ANPD can apply and explain the criteria used to size them

Describe the ANPD's enforcement process from inspection through final decision, including appeal possibilities

Explain the dosimetry and application parameters the ANPD uses when calculating fines

Compare the LGPD sanction regime with the GDPR regime to identify key differences in scale and procedure

Complete a full-length timed practice exam and score it by domain

Re-study the two weakest domains using your own notes and deliverables from earlier weeks

Explain each of your incorrect practice answers aloud in your own words without referring to notes

Review the key definitions, legal bases, DPO duties, and breach timelines in a single consolidated summary