Search every question across sub-FAQs

Classify the data before selecting from a list. Ordinary personal data may rely on one of Article 7's ten bases: consent; compliance with a legal or regulatory obligation; public-administration processing for laws, regulations, contracts, agreements, or public policies; research by a research body with anonymization where possible; performance of a contract or preliminary procedure requested by the data subject; regular exercise of rights in judicial, administrative, or arbitral proceedings; protection of life or physical integrity; health protection by health professionals, health services, or health authorities; legitimate interest; or credit protection.

Article 11 permits sensitive-data processing with specific and prominent consent for specific purposes, or without consent when the processing is indispensable for one of its stated cases: legal or regulatory compliance; shared processing by public administration for public policies; research with anonymization where possible; regular exercise of rights, including in contracts and proceedings; protection of life or physical integrity; health protection by the authorized health actors; or fraud prevention and data-subject security in electronic identification and authentication, subject to the statutory protections and the data subject's rights prevailing where applicable.

Match the facts to every condition. A contract basis covers performance or a preliminary step requested by the person, not unrelated advertising. Legal obligation requires an identifiable binding duty, not a preference or customer contract. Vital protection is for life or physical integrity, not routine convenience. Credit protection follows applicable law and remains subject to LGPD principles.

Consent is one basis, not a default or a cure. The controller must be able to prove a free, informed, unambiguous, purpose-specific choice; written consent must be prominent; generic authorizations are void; and withdrawal must be free and facilitated. Sensitive-data consent has the additional Article 11 requirement that it be specific, prominent, and for specific purposes.

A lawful basis does not make all subsequent use lawful. Apply purpose adequacy, necessity, transparency, security, data-subject rights, retention limits, and accountability. Data made manifestly public by the person does not remove the LGPD principles or rights, and a cross-border transfer still needs a separate Article 33 mechanism.

Keep a purpose-level decision record, not one legal basis for an entire system or vendor. It should let a reviewer connect the real operation to the selected statutory paragraph, verify necessity and conditions, and confirm that notices, controls, retention, sharing, and rights handling match the decision.

Do not choose a basis from convenience after collection. The facts and data category control the available basis: legitimate interest is not in Article 11, public data remains subject to purpose, good-faith, and public-interest limits, and consent cannot be stretched to a materially different purpose without new information and a valid choice where consent remains the basis.

Begin with an eligibility gate. Do not use this basis for sensitive personal data under Article 11. Identify whether the interest belongs to the controller or a third party, confirm that it is lawful, concrete, and linked to a specific purpose, and check whether another basis is more appropriate. A general aim such as improving business, security, or user experience is not specific enough without the actual operation and benefit.

ANPD's non-binding guide then uses three phases. Purpose asks whether the interest is legitimate and the purpose specific. Necessity asks whether the processing can achieve the purpose, whether every data item is strictly necessary, and whether a less intrusive effective alternative exists. Balancing and safeguards compare benefits with the nature of the data, source, relationship, context, legitimate expectations, affected people, likely effects, and the ability to prevent or reduce harm.

Examples remain fact-specific. Limited first-party audience measurement using aggregate results, no cross-service combination, no profiles, short retention, and clear opt-out may be easier to justify than third-party behavioral advertising. Fraud detection may support a concrete interest, but broad indefinite monitoring of every customer or worker still requires proof of necessity and proportionate controls.

Children and adolescents require special caution because Article 14 requires their best interests. Vulnerability, employment or platform power imbalances, systematic observation, profiling, unexpected secondary use, third-party data, denial of a service, or significant effects can shift the balance. Public authorities should not use legitimate interest merely to avoid the public-sector bases and duties that fit their statutory activity.

Keep the completed assessment with evidence for each answer, not a checked box or conclusion alone. The record should connect the planned data flow to the purpose, alternatives, impacts, controls, implementation owners, approval, and review history; Article 10 also allows ANPD to require an impact report.

Legitimate interest is not an Article 11 basis for sensitive data and is not established by a privacy notice, contract clause, common industry practice, or business convenience. Treat children, vulnerable groups, unexpected reuse, systematic monitoring, profiling, and significant effects as heightened cases and record why the balance still passes, if it does.

The controlling law is the LGPD. Article 38 lets ANPD require a controller to prepare an impact report, including for sensitive data, and specifies minimum content; Article 10(3) permits an ANPD request for legitimate-interest processing; and Article 32 addresses public-sector operations. The federal government's RIPD template is practical guidance for federal public bodies, not a regulation that changes those statutory triggers.

Use an intake screen before a new or materially changed activity. Identify the controller, operator and joint decision-makers, purpose, legal basis, people, data and sources, scale, technology, monitoring or profiling, decisions and effects, vulnerable groups, recipients, transfers, retention, security, and applicable ANPD or sector requirement.

Treat high-risk processing as a strong reason for a fuller assessment. Resolution 2/2022's specific small-agent test requires at least one general criterion, such as large scale or significant effects on fundamental interests and rights, plus at least one specific criterion, such as emerging technology, surveillance or control of publicly accessible areas, sensitive data, or data on children, adolescents, or older people. It is not a universal RIPD trigger for every controller.

The controller owns the document and final decision. The encarregado, legal and privacy teams, security, engineering, product, procurement, operators, and business owners can supply evidence. Complete the assessment early enough to change the design; then approve, reject, condition, or escalate the processing and assign every mitigation.

Describe inherent risks to people rather than limiting the assessment to corporate or cybersecurity risk. Evaluate likely harms, existing and planned controls, and residual risk. The LGPD does not prescribe one scoring matrix, so state the method, assumptions, likelihood and severity scales, evidence, risk owner, acceptance authority, and review trigger.

Keep the approved report, its inputs, and proof that required controls were implemented. Preserve version history and the link to the processing record so a reviewer can reproduce the trigger, scope, risk judgments, decisions, owners, and later reassessments. Protect commercial and industrial secrets appropriately if ANPD requests submission.

Do not state that every processing activity has a universal statutory pre-launch RIPD duty. The LGPD gives ANPD express powers to require reports and states minimum content, while organizations often use pre-launch screening as accountable risk practice. Identify any ANPD request, public-sector, legitimate-interest, sector, contractual, or internal trigger and label guidance and internal policy accurately.

The binding framework is LGPD Articles 52 and 53, ANPD's inspection and administrative-proceeding rules, and Resolution 4/2023. Sanctions follow an administrative proceeding with due process; an investigation, finding, or maximum statutory number is not itself a final sanction.

ANPD first performs an infringement classification. A medium infringement significantly affects fundamental interests and rights by impeding or limiting rights or access to services or by causing material or moral damage. A serious infringement meets that threshold plus at least one listed factor, including large scale, intent, risk to life or physical integrity, sensitive data or data on children, adolescents, or older people, absence of a legal basis, unlawful or discriminatory effects, systematic unlawful practice, or inspection obstruction. Other infringements are light.

Article 52 sanctions include a warning with a corrective deadline; simple or daily fine; public disclosure after confirmation and investigation; blocking or deletion of affected personal data; partial suspension of the database or processing activity; and partial or total prohibition of personal-data processing. Resolution 4 links the selection to gravity, nature and circumstances, data-subject rights, proportionality, recurrence, cooperation, governance, remediation, harm, advantage, good faith, and economic condition.

For a simple fine, calculate the base amount using the classification and the Resolution's applicable revenue method, then apply its aggravating and mitigating factors and the minimum and maximum limits. The LGPD ceiling for a private legal person is two percent of prior-year revenue in Brazil, excluding taxes, limited to R$50 million per infringement; it is a ceiling, not the starting point.

Build the record as soon as an ANPD inquiry or inspection begins. Preserve the alleged conduct and legal duties, chronology, processing and affected people, scale and harm, advantage sought or obtained, intent and good faith, recurrence, cooperation, governance, remediation, economic condition, and verified Brazilian revenue inputs.

Keep a traceable case file that separates facts established in the proceeding from estimates, legal positions, and disputed points. Connect every classification criterion, adjustment, corrective action, and financial input to dated evidence and the version submitted to ANPD.

The headline simple fine is not automatic. ANPD must apply the administrative framework to the proven facts, and non-monetary sanctions may be more consequential to operations. Civil damages, consumer remedies, criminal questions, contractual consequences, and sector-regulator action remain legally distinct and may proceed separately.

Resolution 2/2022 covers qualifying microenterprises and small businesses under Complementary Law 123/2006, startups that meet Complementary Law 182/2021, and the other private legal persons, natural persons, or unincorporated private entities within its definition when they process personal data as controller or operator. Record the exact statutory category rather than relying on headcount or an informal small-company label.

The differentiated regime is unavailable when the agent performs high-risk processing, has gross revenue above the applicable small-business or startup ceiling, or belongs to an economic group whose global revenue exceeds the applicable ceiling. Determine the legal entity, relevant revenue period and evidence, group perimeter, and any special category condition. Do not divide one operation among related entities to manufacture eligibility.

Apply the risk test to every material activity. It is high risk only when at least one general criterion, large scale or significant effects on fundamental interests and rights, combines with at least one specific criterion: emerging or innovative technology; surveillance or control of publicly accessible areas; decisions based solely on automated processing, including profiling; or sensitive data or data on children, adolescents, or older people.

Where the agent qualifies, identify the exact flexibility used. Resolution 2 permits a simplified processing record and simplified security policy; it does not require appointment of an encarregado if another public communication channel is provided; and it doubles specified response, ANPD-request, and incident-communication periods. The incident period under Resolution 15/2024 is therefore generally six business days for a qualifying small agent unless a specific legal period or exception applies.

ANPD may require the ordinary duty after considering the nature and volume of the processing and risks to people. A high-risk agent generally loses the differentiated treatment but may still use the collective representation arrangement in Article 8 for negotiation, mediation, and conciliation of complaints.

Keep a dated eligibility file for the entity and a separate risk screen for each material processing activity. Link every claimed adaptation to the evidence, control, responsible person, deadline rule, and reassessment event; an entity-level conclusion alone cannot show that a later high-risk activity remains eligible.

Do not assume every small business qualifies or that one eligibility review covers every activity. Resolution 2/2022 grants only specified adaptations, its incident provision now operates with Resolution 15/2024, and ANPD may order a small agent to meet a duty that the regulation otherwise simplified or waived.