Brazil LGPD Applicability Test

Apply Article 3 separately to collection, access, storage, analysis, disclosure, deletion, and other operations in the data flow. One covered operation is enough for the LGPD to govern that operation, regardless of the organisation's headquarters or the medium used.

For the collection link, data is collected in Brazil when the data subject is in Brazil at the time of collection. For the targeting link, record the facts showing that the activity concerns offering goods or services to individuals in Brazil or processing their data; a globally accessible website alone does not answer that fact-specific question.

End with one of three outcomes for each operation: outside Article 3 on the recorded facts, within Article 3 but covered by a specific Article 4 exclusion, or subject to the LGPD. A mixed data flow can produce different outcomes for different operations.

The controller should approve the scope conclusion. Product, data, procurement, security, and local business teams supply the facts; privacy or legal should review exclusions and unresolved territorial questions.

Keep the data-flow map, the Article 3 analysis for each operation, any Article 4 exclusion, controller and operator allocation, source version, assumptions, reviewer, approval date, and change trigger.

Article 4 excludes processing by a natural person for exclusively private, non-economic purposes; exclusively journalistic or artistic processing; specified public-security, national-defence, state-security, and criminal-investigation processing; and a narrow foreign-origin data case. Academic processing remains subject to Articles 7 and 11.

Do not treat pseudonymised or potentially re-identifiable data as automatically anonymous. Anonymised data falls outside the personal-data rules only when reversal is not reasonably possible using the controller's own means or reasonable available efforts. Record the facts supporting an exclusion and reopen the decision if the data is shared, enriched, reused, or made available to a Brazilian processing agent.

Use a per-operation intake. A company-level yes or no cannot capture different products, collection points, purposes, recipients, or Article 4 exclusions.

The output should name the covered operation and Article 3 link, or the precise Article 4 exclusion and its facts. It should also identify the controller and operators, unresolved assumptions, downstream LGPD work, approver, decision date, source version, and reassessment trigger.