Use this checklist before launch and after material changes to confirm that each applicable LGPD duty has an owner, an operating control, and dated evidence.
A policy or signed vendor contract is not enough if the related notice, rights path, security measure, or transfer mechanism does not work for the real data flow.
Work from the processing inventory. For each purpose, identify scope, and operator roles, data category, Article 7 or 11 basis, transparency, rights, retention, security, recipients, international transfers, and incident handling. Mark an item complete only when the control operates and the evidence identifies the affected data flow.
First confirm that Article 3 applies and whether Article 4 excludes the operation. Then document the , each operator, the specific purpose, the personal-data categories, the Article 7 basis for ordinary data or Article 11 basis for sensitive data, and any best-interest analysis required for children or adolescents.
Before collection or reuse, make the Article 9 information available in clear language, limit the data to what is necessary, define retention and deletion rules, and connect the operation to the channel that handles Articles 18-20 rights.
Sources (2)
Binding source for scope, principles, legal bases, transparency, children, rights, records, roles, security, incidents, transfers, and accountability.
Binding requirements for formally appointing the encarregado, publishing identity and contact information, and supporting the role.
Each row should name the requirement and affected processing activity, not merely cite a policy. Record the accountable control owner, reviewer, implementation state, exception, due date, evidence location, and event that will trigger reassessment.
Evidence should show operation: a current data-flow map, processing record, notice as displayed, consent event where applicable, completed basis assessment, rights log, retention rule, vendor instruction, access review, security test, executed transfer mechanism, incident exercise, or filed communication.
Sources (2)
Articles 6, 37, 38, 46, and 50 support necessity, accountability records, impact-report content, security measures, and governance evidence.
Binding rule allowing eligible small processing agents to use simplified records and certain proportionate measures while preserving the remaining LGPD duties and data-subject rights.
For confirmation or access requests, distinguish an immediate simplified response from the complete Article 19 declaration due within 15 days. Eligible small processing agents have specific doubled or simplified periods under Resolution 2/2022; the regulation does not excuse them from the rest of the LGPD.
For a confirmed security incident that may cause relevant risk or damage, the generally has three business days to notify the ANPD and affected people, subject to a period set by specific legislation. Keep records of security incidents involving personal data for at least five years from registration, subject to longer duties and the Article 10(2) public-body archival exception.
For international transfers, document both an Article 7 or 11 processing basis and a valid Article 33 transfer mechanism. ANPD standard clauses must be used in full when that mechanism is selected; adequacy must come from an ANPD decision.
Sources (3)
Official ANPD procedure and current explanation of the three-business-day notification clock, reportability test, phased communication, and incident records.
Binding transfer-mechanism, standard-clause, transparency, security, and accountability requirements.
Binding eligibility limits, simplified records, encarregado dispensation, and differentiated deadlines for small processing agents.
Assign each checklist gap, collect operating evidence, and record the review result.
Turn Checklist into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with operational practice.
How ANPD investigates LGPD infringements, classifies severity, selects sanctions, calculates fines, and weighs aggravating and mitigating evidence.
Apply LGPD Articles 3 and 4 to a processing activity, including foreign organisations, Brazil collection, targeting, exclusions, and the evidence to retain.
Apply Brazil's LGPD incident notification test, three-business-day clock, notice content, phased filing, affected-person communication, and five-year records.
Build an LGPD compliance program from processing records, legal bases, transparency, rights, security, vendors, transfers, incidents, and accountable evidence.
Classify LGPD controller, operator, sub-operator, and encarregado roles from actual decisions, instructions, processing facts, and Resolution 18 duties.
Brazil LGPD rights guide covering confirmation, access, correction, restriction, deletion, portability, consent, sharing, objection, and automated decisions.
Track Brazil LGPD commencement dates, data-access responses, incident notices, international-transfer clauses, and ANPD fine-payment deadlines.
Build an LGPD data-subject response that identifies the right, applies the correct timing, records the decision, protects third parties, and proves delivery.
Run an LGPD data-subject request from intake and identity checks through rights analysis, response timing, evidence, exceptions, and escalation.
Decide whether an LGPD incident is reportable, calculate the ANPD deadline, prepare complete or staged notices, and keep the required five-year record.
Run an LGPD personal-data incident from confirmation and risk assessment through three-business-day notices, supplementation, mitigation, and records.
Compare LGPD international-transfer mechanisms: adequacy, ANPD standard clauses, approved specific clauses, global corporate rules, consent, and other Article 33 routes.
Brazil LGPD international-transfer guide for identifying transfers, selecting Article 33 mechanisms, applying ANPD clauses, EU adequacy, and transparency.
Compare LGPD Article 7 bases for ordinary personal data and Article 11 bases for sensitive data, with consent, necessity, evidence, and edge cases.
Apply LGPD legitimate interest through purpose, necessity, balancing, reasonable expectations, safeguards, children, sensitive-data limits, and records.
Understand every ANPD administrative sanction under LGPD Article 52, the fine ceilings, non-monetary penalties, and public-body limits.
Answers to common Brazil LGPD questions about scope, roles, legal bases, rights, incidents, transfers, impact reports, small agents, and enforcement.
Reference guide to Brazil LGPD scope, principles, legal bases, transparency, rights, roles, security, incidents, transfers, records, and ANPD oversight.
Build an LGPD RIPD evidence file that proves the processing scope, high-risk screen, necessity, safeguards, residual risk, approval, and later review.
Decide when to prepare an LGPD RIPD, apply the ANPD high-risk screen, document required evidence and mitigation, approve residual risk, and review changes.
Check whether an organization qualifies for Brazil's small-processing-agent regime, which flexibilities apply, and which LGPD duties remain unchanged.
Choose and maintain LGPD templates for processing records, data-subject requests, incidents, RIPDs, transfers, and controller-operator role evidence.
Classify an LGPD international transfer, confirm the processing legal basis and transfer mechanism, document onward transfers, and approve the evidence before launch.
Compare Brazil's LGPD and California's CCPA by scope, legal bases, consumer rights, sale and sharing rules, deadlines, transfers, and enforcement.
Compare Brazil's LGPD and the EU GDPR by scope, legal bases, roles, rights deadlines, impact assessments, incidents, transfers, and enforcement.
Apply LGPD Article 14 to children's and adolescents' data: age categories, best interests, legal bases, parental consent, limited collection, notices, and evidence.
Compare actual decision rights with contracts, operator instructions, sub-operator approvals, and the encarregado channel.
Test tracker classification, legal bases, banner choices, stored preferences, and deployed network behavior.
Assign the reportability decision, knowledge timestamp, ANPD filing, affected-person notice, and follow-up evidence.
Match each exporter, importer, onward flow, and processing basis to the selected Article 33 mechanism.
Record each purpose, data category, statutory basis, necessity, notice, retention, and reassessment trigger.
Document the interest, necessity, alternatives, expectations, impacts, effective safeguards, and approval.
Assign the report trigger, processing description, risk assessment, safeguards, controller decision, and mitigation checks.
Organize the infringement facts, classification, revenue inputs, mitigation evidence, and procedural deadlines.
Verify eligibility, group revenue, the two-part high-risk screen, each flexibility used, and continuing duties.