Search every question across sub-FAQs

Article 14 requires every processing activity involving a child or adolescent to serve that person's best interest. A child is a person under 12; an adolescent is a person from 12 through 17 under Brazil's Child and Adolescent Statute. For a child's data, paragraph 1 requires specific and highlighted consent from at least one parent or legal guardian when consent is the basis. ANPD Statement No. 1/2023 interprets Articles 7 and 11 as available alternatives when their conditions are met and the best interest is assessed and prevails.

Choose the legal basis purpose by purpose. If consent supports a child's data, obtain and document parental consent, the disclosed purpose, and reasonable verification efforts. If another Article 7 or 11 basis applies, record every condition and why that basis and the processing serve the child or adolescent's best interest. Consent, contract necessity, legal obligation, life protection, health protection, and legitimate interest are different tests.

Document the user's age range, age-assurance method, purpose, legal basis, necessity, likely benefits and harms, safeguards, and how the design respects development and the ability to understand the processing. A generic statement that the service benefits children is not a best-interest assessment.

Keep the age-assurance rationale, best-interest assessment, purpose and minimum-data analysis, legal-basis decision, parental-consent record and verification effort where applicable, child-accessible notice, rights route, recipients, retention, safeguards, and approval.

The controller should own the Article 14 decision. Product and design should show how the experience limits collection and presents information; security should show access and protection measures; legal or privacy should record the basis and exceptions; and customer support should preserve rights-request and guardian-contact evidence.

Do not collapse children and adolescents into one consent rule: the best-interest standard covers both, while Article 14(1)'s parent-or-guardian consent wording concerns children. Do not condition a game or online activity on personal data beyond what is strictly necessary.

Do not describe the narrow Article 14(3) collection branch as a general emergency exemption. It permits collection without the paragraph 1 consent only when necessary to contact the parent or guardian, with one-time use and no storage, or when necessary to protect the child; third-party disclosure still requires the consent specified by that paragraph.

The binding definitions are in LGPD Article 5, with operational duties in Articles 37 to 42. ANPD guidance explains how the Agency applies those definitions but does not replace the statute. Start with one processing purpose, identify who decides that purpose and the essential elements of the operation, then identify who acts on whose documented instructions.

A controller can be a natural person or a legal entity. More than one party may be a controller when each makes relevant decisions; the ANPD guide treats joint control as a fact-specific situation in which multiple controllers have common, convergent, or complementary decisions and influence the purposes and essential elements. Shared infrastructure or commercial cooperation alone does not settle the result.

An operator must act on behalf of a controller. A payroll provider may be an operator for calculating salaries under the employer's instructions, for example, but may be a controller for a separate purpose it determines itself. Employees, directors, and teams acting under the organization's direct authority are part of that organization rather than separate operators for routine internal work.

The encarregado is a channel and adviser, not the owner of the business purpose or legal-basis decision. LGPD Article 41 assigns the controller the appointment and publication duties, while the current Article 5 definition and ANPD rules frame the role as the channel for the processing agent. Record which entity made the formal appointment and which processing activities and entities the appointment covers.

Keep one role record per purpose. It should connect the factual decision map to contracts, instructions, the suboperator chain, rights and incident cooperation, and the published encarregado channel. Review real system access, approvals, and data reuse against the written allocation; a signature alone does not prove the role.

A contract label is not conclusive. A service provider may be an operator for instructed work and a controller for a separate purpose it determines. Under Article 42, an operator can be jointly liable for damage when it breaches data-protection law or fails to follow lawful controller instructions, in which case it is treated like the controller for that damage, subject to Article 43 defenses.

ANPD's 2022 cookie guide is non-binding guidance on how the binding LGPD principles, legal bases, transparency duties, consent conditions, and rights apply online. Its scope includes cookies and similar tracking technologies on websites, applications, phones, and tablets when personal data is collected.

Start with a technical scan and owner interview. Separate necessary cookies from non-necessary cookies, and classify each item by first or third party, session or persistent duration, and purpose: authentication or requested functionality, preferences, audience measurement, advertising, profiling, or another stated use.

Choose the legal basis only after classification. Legitimate interest may fit a necessary authentication or shopping-cart cookie, or limited audience measurement using aggregate data without third-party sharing, cross-service combination, or user profiles. The test remains fact-specific. ANPD says legitimate interest will generally be difficult to support for third-party advertising, cross-site tracking, preference prediction, or behavioral profiles; consent is usually more appropriate in those examples.

Where consent is the basis, the visitor needs a real and informed choice. Do not infer consent from continued browsing, silence, or preselected settings. Keep consent-based cookies off until an affirmative choice, make rejecting all non-necessary cookies as easy to find as accepting them, permit purpose-level choices, and provide a free, simple withdrawal route comparable to the consent route.

Keep a current cookie inventory linked to the deployed configuration. Preserve the purpose and party, data collected, duration, legal basis, banner and notice versions, consent or preference logs, tag-manager tests, vendor recipients and international transfers, retention settings, and change approvals.

Do not call a tracker necessary because marketing or analytics depends on it. Necessity concerns the requested function or service, not the controller's preferred business model. Indefinite or excessive cookie retention is also incompatible with the LGPD's purpose and necessity principles.

LGPD Article 48 creates the binding notification duty, and ANPD Resolution 15/2024 defines the current threshold, content, procedure, and deadlines. A vulnerability without a confirmed event, an incident that does not involve personal data subject to the LGPD, or an incident that cannot cause relevant risk or harm does not meet all three reporting criteria. Keep the assessment even when the outcome is non-reportable.

Assess the nature and sensitivity of the data, the processing context, the number and vulnerability of affected people, possible material or moral effects, and safeguards already effective at the time of the event. For example, the theft of strongly encrypted data may present a different risk from theft of the same readable data, but encryption is evidence to assess rather than an automatic exemption.

The three-business-day period starts when the controller learns that the incident affected personal data, not when the investigation closes or the threshold assessment is complete. The duty to notify still applies only if the incident may cause relevant risk or harm. Record the occurrence, detection, operator notice, controller knowledge, facts available for the threshold decision, and any shorter or different sector-specific deadline.

The controller owns the reportability decision and both required communications. The operator should alert the controller without unjustified delay and provide logs, affected systems and data, containment actions, and other facts required by contract or instruction. The encarregado or a legal representative may submit the ANPD filing, but that does not transfer the controller's accountability.

Keep a decision record for every confirmed incident, including those assessed as non-reportable. It should connect the chronology and technical evidence to each reporting criterion and show who made the controller decision. Resolution 15/2024 requires the controller to keep the incident record for at least five years from the record date, unless another rule requires longer retention; public bodies and entities must also observe the archival periods in the legislation that governs them.

Do not rely on the LGPD's general 'reasonable time' wording without applying Resolution 15/2024. A preliminary communication is not complete compliance: investigate, mitigate, notify affected people, and supply the justified missing information within the complementary period. ANPD may require corrections, broader disclosure, additional mitigation, or other measures after reviewing the case.

Start with scope. Document the exporter, foreign importer, controller and operator roles, countries and remote-access locations, data and people, purpose, frequency, systems, and onward recipients. Direct collection from a person in Brazil by a processing agent abroad may bring the foreign processing within LGPD Article 3, but Resolution 19/2024 classifies it as international collection rather than an international transfer.

Next, choose both layers of authority. An Article 7 or 11 basis permits the processing purpose; it does not permit the cross-border movement by itself. Match the actual flow to one Article 33 case and retain the facts that make that mechanism available.

For contractual safeguards, the standard contractual clauses in Annex II of Resolution 19/2024 may be incorporated without changing their prescribed text. Specific clauses and binding corporate rules require prior ANPD approval. Contractual safeguards remain subject to LGPD principles, data-subject rights, security duties, accountability, and ANPD oversight.

An adequacy decision in ANPD Resolution 32/2026 recognizes transfers within its defined European Union and European Economic Area scope, including EU institutions and the EEA EFTA states Iceland, Liechtenstein, and Norway. The decision excludes processing exclusively for public security, national defense, state security, or criminal investigation and repression. It took effect on publication on 27 January 2026 and must be reassessed within four years, while ANPD continues to monitor the level of protection. Verify the current decision and the importer's coverage before using this route.

Article 33 also permits specified non-contractual cases, including international legal cooperation, protection of life or physical integrity, ANPD authorization, commitments in international cooperation agreements, execution of public policy or legal public-service attribution, specific and prominent consent for the transfer, and the Article 7(II), (V), and (VI) situations expressly incorporated by Article 33(IX). Apply the exact conditions rather than treating these as broad exceptions.

Keep one transfer record that connects the system flow to the legal basis and Article 33 mechanism. The record should let a reviewer identify the exporter and importer, reproduce the scope decision, inspect the executed or approved safeguard, trace onward transfers, and confirm that rights and security controls work across borders.

ANPD standard contractual clauses are not the European Commission's clauses and cannot be replaced by a generic data-processing agreement. The transition for contracts already using clauses ended on 23 August 2025, so verify that the current Brazilian text is incorporated in full, signed by the correct parties, reflected in operations, and supported by the required transparency.