Brazil LGPD RIPD and DPIA

The controlling law is the LGPD. Article 38 lets ANPD require a controller to prepare an impact report, including for sensitive data, and specifies minimum content; Article 10(3) permits an ANPD request for legitimate-interest processing; and Article 32 addresses public-sector operations. The federal government's RIPD template is practical guidance for federal public bodies, not a regulation that changes those statutory triggers.

Use an intake screen before a new or materially changed activity. Identify the controller, operator and joint decision-makers, purpose, legal basis, people, data and sources, scale, technology, monitoring or profiling, decisions and effects, vulnerable groups, recipients, transfers, retention, security, and applicable ANPD or sector requirement.

Treat high-risk processing as a strong reason for a fuller assessment. Resolution 2/2022's specific small-agent test requires at least one general criterion, such as large scale or significant effects on fundamental interests and rights, plus at least one specific criterion, such as emerging technology, surveillance or control of publicly accessible areas, sensitive data, or data on children, adolescents, or older people. It is not a universal RIPD trigger for every controller.

The controller owns the document and final decision. The encarregado, legal and privacy teams, security, engineering, product, procurement, operators, and business owners can supply evidence. Complete the assessment early enough to change the design; then approve, reject, condition, or escalate the processing and assign every mitigation.

Describe inherent risks to people rather than limiting the assessment to corporate or cybersecurity risk. Evaluate likely harms, existing and planned controls, and residual risk. The LGPD does not prescribe one scoring matrix, so state the method, assumptions, likelihood and severity scales, evidence, risk owner, acceptance authority, and review trigger.

Keep the approved report, its inputs, and proof that required controls were implemented. Preserve version history and the link to the processing record so a reviewer can reproduce the trigger, scope, risk judgments, decisions, owners, and later reassessments. Protect commercial and industrial secrets appropriately if ANPD requests submission.

Do not state that every processing activity has a universal statutory pre-launch RIPD duty. The LGPD gives ANPD express powers to require reports and states minimum content, while organizations often use pre-launch screening as accountable risk practice. Identify any ANPD request, public-sector, legitimate-interest, sector, contractual, or internal trigger and label guidance and internal policy accurately.