Brazil LGPD Legal Bases

Classify the data before selecting from a list. Ordinary personal data may rely on one of Article 7's ten bases: consent; compliance with a legal or regulatory obligation; public-administration processing for laws, regulations, contracts, agreements, or public policies; research by a research body with anonymization where possible; performance of a contract or preliminary procedure requested by the data subject; regular exercise of rights in judicial, administrative, or arbitral proceedings; protection of life or physical integrity; health protection by health professionals, health services, or health authorities; legitimate interest; or credit protection.

Article 11 permits sensitive-data processing with specific and prominent consent for specific purposes, or without consent when the processing is indispensable for one of its stated cases: legal or regulatory compliance; shared processing by public administration for public policies; research with anonymization where possible; regular exercise of rights, including in contracts and proceedings; protection of life or physical integrity; health protection by the authorized health actors; or fraud prevention and data-subject security in electronic identification and authentication, subject to the statutory protections and the data subject's rights prevailing where applicable.

Match the facts to every condition. A contract basis covers performance or a preliminary step requested by the person, not unrelated advertising. Legal obligation requires an identifiable binding duty, not a preference or customer contract. Vital protection is for life or physical integrity, not routine convenience. Credit protection follows applicable law and remains subject to LGPD principles.

Consent is one basis, not a default or a cure. The controller must be able to prove a free, informed, unambiguous, purpose-specific choice; written consent must be prominent; generic authorizations are void; and withdrawal must be free and facilitated. Sensitive-data consent has the additional Article 11 requirement that it be specific, prominent, and for specific purposes.

A lawful basis does not make all subsequent use lawful. Apply purpose adequacy, necessity, transparency, security, data-subject rights, retention limits, and accountability. Data made manifestly public by the person does not remove the LGPD principles or rights, and a cross-border transfer still needs a separate Article 33 mechanism.

Keep a purpose-level decision record, not one legal basis for an entire system or vendor. It should let a reviewer connect the real operation to the selected statutory paragraph, verify necessity and conditions, and confirm that notices, controls, retention, sharing, and rights handling match the decision.

Do not choose a basis from convenience after collection. The facts and data category control the available basis: legitimate interest is not in Article 11, public data remains subject to purpose, good-faith, and public-interest limits, and consent cannot be stretched to a materially different purpose without new information and a valid choice where consent remains the basis.