Brazil LGPD Data Subject Rights

Start by identifying which Article 18 right is being requested: confirmation of processing, access, correction, anonymization, blocking or deletion, portability, deletion after consent, information about sharing, information about refusing consent, revocation of consent, or a complaint to the ANPD. The response should match the request and the legal basis for the data being processed.

For confirmation or access, Article 19 says the controller must respond immediately in simplified form or within up to 15 days with a clear and complete declaration. For practical handling, capture the request date, identity check, owner, response format, and any legal reason that limits full disclosure.

Ownership should sit with the team that controls the processing purpose and the customer channel that receives the request, with privacy or legal review when the answer depends on an exception or a conflict with another legal duty.

Evidence should show the request log, identity check, the Article 18 right involved, the response sent, the date of response, and any action taken to correct, delete, block, or share the request with other controllers when required.

Most LGPD mistakes happen when teams miss the difference between a full access request and a narrower correction, deletion, or portability request, or when they fail to identify whether another law limits disclosure.

Apply this section before approving a response. If the request involves another controller, a public-body process, a child-data request, or a decision on automated profiling, route it for legal review and keep the request open until the response can be accurate.

Use a simple workflow that logs the request, confirms identity, identifies the Article 18 right, assigns an owner, and records the answer date. For confirmation or access, the reply should be immediate in simplified form or within up to 15 days as a clear and complete declaration.

Where the request requires action, the workflow should also trigger correction, deletion, blocking, anonymization, portability, or sharing of the request with other controllers when the law requires it.