Brazil LGPD DSAR Workflow

First confirm that the request concerns personal data processed by the receiving controller. Record the request date, channel, requester, represented person if applicable, requested right, relevant product or process, and the systems or operators likely to hold the data. Use a proportionate identity check and do not disclose personal data until the requester or authorized representative is sufficiently verified.

Article 18 covers confirmation of processing; access; correction; anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data; portability subject to ANPD regulation; deletion of data processed on consent, subject to Article 16 retention exceptions; information about public and private entities with which data was shared; information about the option and consequences of refusing consent; and revocation of consent. Objection to processing carried out on a legal basis other than consent is available when the LGPD has been breached. Article 20 separately addresses review of decisions based solely on automated processing that affect the data subject.

For confirmation and access, Article 19 allows an immediate simplified response or a clear and complete declaration within 15 days. The complete declaration must indicate the data's origin, absence of a record where applicable, processing criteria, and purpose, while protecting commercial and industrial secrets. It must be supplied electronically in a secure form or as a printed copy, according to the data subject's choice.

Do not apply the 15-day period to every Article 18 right without a specific rule. Track a reasonable internal due date for correction, deletion, objection, portability, consent, and sharing-information requests, and state any dependency or lawful limitation. Small processing agents have differentiated rules under Resolution 2/2022, including double time for the clear and complete Article 19 declaration and up to 15 days for the simplified declaration.

Before delivery, confirm that the response answers each item, uses clear language, reaches the verified requester through a secure channel, and does not expose another person's data. When correction, anonymization, blocking, or deletion is carried out, Article 18(6) requires the controller to inform agents with which it shared the data so they can repeat the action, unless that communication is proven impossible or involves disproportionate effort.

Keep the request, verification result, searches, legal analysis, copies of the response and disclosed data, operator communications, delivery proof, and any exception. A data subject petition to the ANPD generally requires evidence that the person first tried to exercise the right with the controller, so give the requester a usable protocol or reference number.