Brazil LGPD Checklist

First confirm that Article 3 applies and whether Article 4 excludes the operation. Then document the controller, each operator, the specific purpose, the personal-data categories, the Article 7 basis for ordinary data or Article 11 basis for sensitive data, and any best-interest analysis required for children or adolescents.

Before collection or reuse, make the Article 9 information available in clear language, limit the data to what is necessary, define retention and deletion rules, and connect the operation to the channel that handles Articles 18-20 rights.

Each row should name the requirement and affected processing activity, not merely cite a policy. Record the accountable control owner, reviewer, implementation state, exception, due date, evidence location, and event that will trigger reassessment.

Evidence should show operation: a current data-flow map, processing record, notice as displayed, consent event where applicable, completed basis assessment, rights log, retention rule, vendor instruction, access review, security test, executed transfer mechanism, incident exercise, or filed communication.

For confirmation or access requests, distinguish an immediate simplified response from the complete Article 19 declaration due within 15 days. Eligible small processing agents have specific doubled or simplified periods under Resolution 2/2022; the regulation does not excuse them from the rest of the LGPD.

For a confirmed security incident that may cause relevant risk or damage, the controller generally has three business days to notify the ANPD and affected people, subject to a shorter sector-specific rule. Keep records of security incidents involving personal data for at least five years.

For international transfers, document both an Article 7 or 11 processing basis and a valid Article 33 transfer mechanism. ANPD standard clauses must be used in full when that mechanism is selected; adequacy must come from an ANPD decision.