--- title: "Brazil LGPD Data Subject Rights" canonical_url: "https://www.sorena.io/artifacts/latam/brazil-lgpd/data-subject-rights" source_url: "https://www.sorena.io/artifacts/latam/brazil-lgpd/data-subject-rights" author: "Sorena AI" description: "Grounded Brazil LGPD rights guide covering Articles 18 to 20, free requests, immediate simplified confirmation, full access declaration within 15 days." published_at: "2026-02-21" updated_at: "2026-02-21" keywords: - "Brazil LGPD data subject rights" - "Article 18 LGPD" - "Article 19 LGPD" - "15 day access rule LGPD" - "Article 20 automated decisions" - "Brazil LGPD rights" - "Article 20 LGPD" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # Brazil LGPD Data Subject Rights Grounded Brazil LGPD rights guide covering Articles 18 to 20, free requests, immediate simplified confirmation, full access declaration within 15 days. *Rights Guide* *Articles 18 to 20* ## Brazil LGPD Data Subject Rights Run rights operations around the actual LGPD response structure. The law expects free requests, immediate simplified confirmation or access when possible, a full declaration within 15 days, and a defensible workflow for denials and automated decision review. Articles 18 to 20 create the core rights stack. Controllers need to support confirmation of processing, access, correction, anonymization, blocking, deletion, portability, information on sharing, information about consent consequences, consent revocation, and review of decisions made solely by automated processing. ## Map every Article 18 right to one operational route Rights quality fails when the same request is handled differently across channels or business units. Build one taxonomy and one routing model for confirmation, access, correction, anonymization, blocking, deletion, portability, sharing information, consent information, and consent revocation. Keep special handling rules for requests involving processors, archived records, or legal retention constraints. - Tag the request with the specific right being exercised - Map the systems, processors, and teams needed for fulfillment - Record any legal basis for refusal, limitation, or deferred action ## Use the Article 19 response format correctly For confirmation of existence or access, Article 19 gives two formats. The controller can provide a simplified response immediately, or a clear and complete declaration within 15 days that explains origin of the data, existence or absence of records, criteria used, and processing purpose, subject to commercial and industrial secrecy. The right is exercised without cost to the data subject, and the information can be provided electronically or in printed form at the data subject choice. - Offer an immediate simplified response path when feasible - Maintain a 15 day full declaration path for complete responses - Store the evidence showing which systems and processors were checked ## Control deletion, portability, and revocation edge cases Deletion under Article 18 is not automatic in every case. Data processed under consent can be deleted subject to the Article 16 retention exceptions, and portability does not include data already anonymized by the controller. Consent revocation must be supported by a free and easy procedure, and changes should be communicated to other agents with whom the data was shared unless impossible or disproportionate. - Check Article 16 retention grounds before deleting data - Exclude already anonymized data from portability exports - Notify shared-use partners about correction, deletion, anonymization, or blocking when required ## Treat automated decision review as a separate workflow Article 20 gives the data subject the right to request review of decisions taken solely on automated processing that affect the data subject interests. The controller must also provide clear and adequate information on the criteria and procedures used, subject to commercial and industrial secrecy. If secrecy is invoked, ANPD can audit the system for discriminatory aspects. That makes model governance and review evidence essential. - Keep a trigger to identify purely automated decisions - Prepare explanation records about criteria and procedures used - Escalate secrecy-based refusals for legal review because ANPD can inspect *Recommended next step* *Placement: after the scope or definition section* ## Use Brazil LGPD Data Subject Rights as a cited research workflow Research Copilot can take Brazil LGPD Data Subject Rights from clarifying scope and applicability with cited answers to a reusable workflow inside Sorena. Teams working on Brazil LGPD can keep owners, evidence, and next steps aligned without copying this guide into separate documents. - [Open Research Copilot for Brazil LGPD Data Subject Rights](/solutions/research-copilot.md): Start from Brazil LGPD Data Subject Rights and answer scope, timing, and interpretation questions with cited outputs. - [Talk through Brazil LGPD](/contact.md): Review your current process, evidence gaps, and next steps for Brazil LGPD Data Subject Rights. ## Primary sources - [Lei No. 13.709/2018 (LGPD)](https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm?ref=sorena.io) - Primary legal text for Articles 18, 19, 20, and 21. - [ANPD guide for controllers, processors, and DPOs (May 2021)](https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/2021.05.27GuiaAgentesdeTratamento_Final.pdf?ref=sorena.io) - Official ANPD guide for role allocation and DPO contact logic used in rights handling. - [ANPD Statement No. 1/2023](https://www.in.gov.br/web/dou/-/enunciado-cd/anpd-n-1-de-22-de-maio-de-2023-485306934?ref=sorena.io) - Official ANPD interpretation on legal bases for children and adolescents data under Article 14. ## Related Topic Guides - [ANPD Enforcement and Fines | Brazil LGPD Inspection, Procedure, and Sanctions](/artifacts/latam/brazil-lgpd/anpd-enforcement-and-fines.md): Grounded ANPD enforcement guide covering inspection procedure, sanctions progression, Article 52 factors, Resolution CD ANPD No. - [Brazil LGPD Applicability Test | Article 3 Scope, Article 4 Exclusions, Roles](/artifacts/latam/brazil-lgpd/applicability-test.md): Grounded Brazil LGPD applicability test covering Article 3 territorial reach, Article 4 exclusions, controller versus operator allocation. - [Brazil LGPD Checklist | Scope, Rights, Incidents, Transfers, Evidence](/artifacts/latam/brazil-lgpd/checklist.md): Audit-ready Brazil LGPD checklist covering scope, role allocation, lawful bases, rights timing, DPO disclosure, security, incident reporting. - [Brazil LGPD Compliance Program Guide](/artifacts/latam/brazil-lgpd/compliance.md): Build a grounded Brazil LGPD compliance program around scope, lawful bases, rights, records, incident reporting, transfers, DPO, and ANPD-ready evidence. - [Brazil LGPD Deadlines and Compliance Calendar](/artifacts/latam/brazil-lgpd/deadlines-and-compliance-calendar.md): Brazil LGPD compliance calendar covering key legal and ANPD milestones plus recurring duties for rights, incidents, transfers, training. - [Brazil LGPD DSAR Response Template | Immediate and 15 Day Response Logic](/artifacts/latam/brazil-lgpd/lgpd-dsar-response-template.md): Use a Brazil LGPD DSAR response template aligned to Articles 18 and 19, immediate simplified response, full declaration within 15 days, denial rationale. - [Brazil LGPD FAQ | Scope, Rights, Incidents, Transfers, Enforcement](/artifacts/latam/brazil-lgpd/faq.md): Practical Brazil LGPD FAQ answering common scope, lawful basis, rights, incident, transfer, DPO, and enforcement questions using the law and ANPD guidance. - [Brazil LGPD Incident Reporting and Breach Notification](/artifacts/latam/brazil-lgpd/breach-notification.md): Grounded Brazil LGPD incident reporting guide covering Article 48, ANPD Resolution CD ANPD No. - [Brazil LGPD International Transfers | Articles 33 to 35 and ANPD Transfer Mechanisms](/artifacts/latam/brazil-lgpd/international-transfers.md): Grounded Brazil LGPD transfer guide covering Articles 33 to 35, adequacy, ANPD standard contractual clauses, specific clauses, binding corporate rules. - [Brazil LGPD Lawful Bases | Article 7, Article 11, Legitimate Interest](/artifacts/latam/brazil-lgpd/lawful-bases.md): Grounded Brazil LGPD lawful basis guide covering Article 7 and 11 bases, consent rules, ANPD legitimate interest guide, sensitive data. - [Brazil LGPD Penalties and Fines | Article 52 and ANPD Dosimetry](/artifacts/latam/brazil-lgpd/penalties-and-fines.md): Grounded Brazil LGPD penalties guide covering Article 52 sanctions, 2 percent fine cap, R$50 million limit per infraction, publicization, blocking, deletion. - [Brazil LGPD Requirements | Articles, Controls, Evidence, and ANPD Guidance](/artifacts/latam/brazil-lgpd/requirements.md): Operational Brazil LGPD requirements map covering scope, lawful bases, transparency, rights, records, DPO, security, incidents, transfers. - [Brazil LGPD Templates | DSAR, Incident, Basis, Transfer, Governance](/artifacts/latam/brazil-lgpd/templates.md): Practical Brazil LGPD template library priorities covering DSAR responses, incident communications, lawful basis records, transfer assessments. - [Brazil LGPD vs CCPA and CPRA | Structure, Rights, Enforcement, and Reuse](/artifacts/latam/brazil-lgpd/lgpd-vs-ccpa.md): Grounded comparison of Brazil LGPD and CCPA or CPRA covering scope logic, legal basis model, rights timing, cross-border governance, and reusable controls. - [Brazil LGPD vs GDPR | Similarities, Differences, and Control Reuse](/artifacts/latam/brazil-lgpd/lgpd-vs-gdpr.md): Grounded comparison of Brazil LGPD and GDPR covering scope, lawful bases, rights timing, DPO rules, transfer mechanisms, incident reporting. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/latam/brazil-lgpd/data-subject-rights