Run rights operations around the actual LGPD response structure.
The law expects free requests, immediate simplified confirmation or access when possible, a full declaration within 15 days, and a defensible workflow for denials and automated decision review.
Structured answer sets in this page tree.
Cited legal and guidance references.
Articles 18 to 20 create the core rights stack. Controllers need to support confirmation of processing, access, correction, anonymization, blocking, deletion, portability, information on sharing, information about consent consequences, consent revocation, and review of decisions made solely by automated processing.
Rights quality fails when the same request is handled differently across channels or business units. Build one taxonomy and one routing model for confirmation, access, correction, anonymization, blocking, deletion, portability, sharing information, consent information, and consent revocation.
Keep special handling rules for requests involving processors, archived records, or legal retention constraints.
For confirmation of existence or access, Article 19 gives two formats. The controller can provide a simplified response immediately, or a clear and complete declaration within 15 days that explains origin of the data, existence or absence of records, criteria used, and processing purpose, subject to commercial and industrial secrecy.
The right is exercised without cost to the data subject, and the information can be provided electronically or in printed form at the data subject choice.
Deletion under Article 18 is not automatic in every case. Data processed under consent can be deleted subject to the Article 16 retention exceptions, and portability does not include data already anonymized by the controller.
Consent revocation must be supported by a free and easy procedure, and changes should be communicated to other agents with whom the data was shared unless impossible or disproportionate.
Article 20 gives the data subject the right to request review of decisions taken solely on automated processing that affect the data subject interests. The controller must also provide clear and adequate information on the criteria and procedures used, subject to commercial and industrial secrecy.
If secrecy is invoked, ANPD can audit the system for discriminatory aspects. That makes model governance and review evidence essential.
Research Copilot can take Brazil LGPD Data Subject Rights from clarifying scope and applicability with cited answers to a reusable workflow inside Sorena. Teams working on Brazil LGPD can keep owners, evidence, and next steps aligned without copying this guide into separate documents.
Start from Brazil LGPD Data Subject Rights and answer scope, timing, and interpretation questions with cited outputs.
Review your current process, evidence gaps, and next steps for Brazil LGPD Data Subject Rights.