Brazil LGPD Legitimate Interest Balancing

Begin with an eligibility gate. Do not use this basis for sensitive personal data under Article 11. Identify whether the interest belongs to the controller or a third party, confirm that it is lawful, concrete, and linked to a specific purpose, and check whether another basis is more appropriate. A general aim such as improving business, security, or user experience is not specific enough without the actual operation and benefit.

ANPD's non-binding guide then uses three phases. Purpose asks whether the interest is legitimate and the purpose specific. Necessity asks whether the processing can achieve the purpose, whether every data item is strictly necessary, and whether a less intrusive effective alternative exists. Balancing and safeguards compare benefits with the nature of the data, source, relationship, context, legitimate expectations, affected people, likely effects, and the ability to prevent or reduce harm.

Examples remain fact-specific. Limited first-party audience measurement using aggregate results, no cross-service combination, no profiles, short retention, and clear opt-out may be easier to justify than third-party behavioral advertising. Fraud detection may support a concrete interest, but broad indefinite monitoring of every customer or worker still requires proof of necessity and proportionate controls.

Children and adolescents require special caution because Article 14 requires their best interests. Vulnerability, employment or platform power imbalances, systematic observation, profiling, unexpected secondary use, third-party data, denial of a service, or significant effects can shift the balance. Public authorities should not use legitimate interest merely to avoid the public-sector bases and duties that fit their statutory activity.

Keep the completed assessment with evidence for each answer, not a checked box or conclusion alone. The record should connect the planned data flow to the purpose, alternatives, impacts, controls, implementation owners, approval, and review history; Article 10 also allows ANPD to require an impact report.

Legitimate interest is not an Article 11 basis for sensitive data and is not established by a privacy notice, contract clause, common industry practice, or business convenience. Treat children, vulnerable groups, unexpected reuse, systematic monitoring, profiling, and significant effects as heightened cases and record why the balance still passes, if it does.