Brazil LGPD Data Subject Rights

For confirmation or access, Article 19 allows an immediate simplified response or a clear and complete declaration within 15 days. The complete declaration identifies the data's origin, lack of a record where applicable, criteria used, and processing purpose, subject to commercial and industrial secrets.

The controller must not promise every requested deletion. Article 18(IV) applies to unnecessary, excessive, or unlawful data; Article 18(VI) applies to consent-based data, subject to Article 16 conservation grounds. Those grounds are compliance with a legal or regulatory obligation, research by a research body with anonymisation where possible, transfer to a third party that meets the LGPD, or the controller's exclusive use with access by third parties prohibited and data anonymised. Portability is subject to ANPD regulation and commercial and industrial secrets and excludes data already anonymised.

The data subject exercises these rights by express request and without charge. Use the 15-day period only for Article 19's complete confirmation or access declaration; do not invent the same deadline for correction, deletion, objection, portability, consent, or automated-decision requests.

The controller owns the response. The encarregado or published privacy channel coordinates intake; system owners locate and act on data; operators assist under the controller's instructions; privacy or legal reviews limitations, secrets, competing rights, and Article 16 conservation grounds.

When data has been shared, the responsible agent must immediately inform the other processing agents of a correction, deletion, anonymisation, or blocking so they repeat the action, unless communication is proven impossible or requires disproportionate effort.

Revoking consent stops future reliance on that consent; it does not make earlier lawful processing retroactively unlawful. If another legal basis is proposed for continued processing, verify that it genuinely fits the purpose and explain the resulting processing transparently.

A person may object to processing based on a consent exemption when the processing violates the LGPD. Article 20 review applies only to decisions made solely through automated processing that affect the person's interests; the controller must also provide clear and adequate information about the criteria and procedures when requested, subject to protected secrets.

Log the request, acknowledge the channel, verify identity proportionately, classify the right, locate the controller and systems, assign actions, apply the correct period, review the response, deliver it securely, and preserve closure evidence.

For correction, deletion, anonymisation, or blocking, verify execution in active systems and downstream recipients. For a refusal or limitation, give the factual or legal reason in plain language and preserve the decision record.