Artifact GuideBrazilDSAR Workflow

Brazil LGPD DSAR Workflow

Send each request to the controller that decides the relevant processing, identify the right being exercised, and apply the timing and exceptions for that right.

Confirmation and access have express response forms and deadlines. Other rights still require a documented response, but the LGPD does not impose one universal 15-day deadline on every request.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 24, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 24, 2026

Overview

Use this workflow for requests made under Brazil's Lei Geral de Protecao de Dados Pessoais (LGPD). The controller owns the response. Verify the requester without collecting unnecessary identity data, identify the specific right and processing activity, search the relevant systems and operators, apply any lawful limitation or retention rule, and keep evidence of the decision and delivery.

Section 1

How should an LGPD data-subject request be triaged?

First confirm that the request concerns personal data processed by the receiving controller. Record the request date, channel, requester, represented person if applicable, requested right, relevant product or process, and the systems or operators likely to hold the data. Use a proportionate identity check and do not disclose personal data until the requester or authorized representative is sufficiently verified.

Article 18 covers confirmation of processing; access; correction; anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data; portability subject to ANPD regulation; deletion of data processed on consent, subject to Article 16 retention exceptions; information about public and private entities with which data was shared; information about the option and consequences of refusing consent; and revocation of consent. Objection to processing carried out on a legal basis other than consent is available when the LGPD has been breached. Article 20 separately addresses review of decisions based solely on automated processing that affect the data subject.

Acknowledge receipt and preserve the original wording; do not silently convert an access request into a narrower support ticket.
Identify the controller for each purpose. If the organization is not the responsible processing agent, Article 18(4) requires a response stating that fact and, when possible, identifying the agent.
Send scoped searches to the systems and operators that hold the relevant data, including archives and active records, while preventing alteration or deletion during the search.
Record the legal and factual reason for every fulfilled, partially fulfilled, or refused item.
Branch by right: correct inaccurate data; anonymize, block, or delete data that is unnecessary, excessive, or unlawfully processed; test consent-based deletion against Article 16 conservation; assess an objection against the alleged LGPD breach; and route a qualifying solely automated decision to Article 20 review.

Sources for this answer

Lei Geral de Protecao de Dados Pessoais (Law No. 13,709/2018)

Articles 18-20 establish the rights, the response when the recipient is not the responsible agent, confirmation and access formats, and automated-decision review.

ANPD - Data Subject Rights

ANPD's public explanation of confirmation, access, correction, deletion, portability, objection, consent, and automated-decision rights.

Section 2

Which deadline and response form apply?

For confirmation and access, Article 19 allows an immediate simplified response or a clear and complete declaration within 15 days. The complete declaration must indicate the data's origin, absence of a record where applicable, processing criteria, and purpose, while protecting commercial and industrial secrets. It must be supplied electronically in a secure form or as a printed copy, according to the data subject's choice.

Do not apply the 15-day period to every Article 18 right without a specific rule. Track a reasonable internal due date for correction, deletion, objection, portability, consent, and sharing-information requests, and state any dependency or lawful limitation. Small processing agents have differentiated rules under Resolution 2/2022, including double time for the clear and complete Article 19 declaration and up to 15 days for the simplified declaration.

Response header: controller identity, request reference, date received, verified channel, right requested, response date, and contact route.
Decision: fulfilled, partially fulfilled, refused, redirected, or awaiting a documented dependency, with a separate reason for each requested item.
Access package: personal data about the requester, source, processing criteria, purposes, and relevant sharing information; exclude another person's data and protect commercial and industrial secrets.
Action evidence: corrected field, deletion or blocking record, retention basis and period, consent status, operator instruction, delivery proof, reviewer, and approval date.

Sources for this answer

Lei Geral de Protecao de Dados Pessoais (Law No. 13,709/2018)

Articles 18(3)-(6) and 19 govern cost, response records, immediate explanations, communication of corrections or deletions, and confirmation and access formats.

ANPD Resolution CD/ANPD No. 2 of 27 January 2022

Articles 14 and 15 contain the differentiated response periods for qualifying small processing agents.

Section 3

How should the controller close or escalate the request?

Before delivery, confirm that the response answers each item, uses clear language, reaches the verified requester through a secure channel, and does not expose another person's data. When correction, anonymization, blocking, or deletion is carried out, Article 18(6) requires the controller to inform agents with which it shared the data so they can repeat the action, unless that communication is proven impossible or involves disproportionate effort.

Keep the request, verification result, searches, legal analysis, copies of the response and disclosed data, operator communications, delivery proof, and any exception. A data subject petition to the ANPD generally requires evidence that the person first tried to exercise the right with the controller, so give the requester a usable protocol or reference number.

Escalate identity conflicts, requests involving another person's rights, legal holds, protected secrets, unclear controller status, or a conflict between deletion and an Article 16 retention ground.
Do not treat consent withdrawal as retroactively invalidating processing completed before withdrawal; separately assess whether the data must now be deleted.
Check whether consumer, employment, health, financial, or public-sector rules provide another route or stricter requirement.
Review recurring delays and search failures by system and operator, then update ownership, contracts, and retention maps.

Sources for this answer

Lei Geral de Protecao de Dados Pessoais (Law No. 13,709/2018)

Articles 8(5), 16, 18(6), and 19 support consent withdrawal, permitted retention, downstream communication, and response controls.

ANPD - Complaint or Data Subject Petition under the LGPD

Explains that a petition should include evidence of the data subject's prior attempt to exercise the right with the controller.

Recommended next step