First classify the data, then choose the basis. Article 7 applies to ordinary personal data; contains the narrower conditions for sensitive personal data.
Consent is one option, not the default. Every basis still requires a specific purpose, necessity, transparency, security, and respect for rights.
Choose a for each purpose before collection or reuse. Article 7 lists ten bases for ordinary personal data. , including health, biometric, genetic, racial or ethnic origin, religious belief, political opinion, union or similar affiliation, and sex-life data, needs 's specific consent or one of its indispensable-processing conditions.
Article 7 permits processing for consent; the controller's legal or regulatory obligation; public administration policy; research by a research body with anonymisation where possible; a contract or requested pre-contract steps; regular exercise of rights in judicial, administrative, or arbitral proceedings; protection of life or physical safety; health protection by the specified health actors; legitimate interest; or credit protection.
does not copy Article 7. needs specific, prominent consent for specified purposes or must be indispensable for a listed route: legal or regulatory obligation; public-policy sharing; research with anonymisation where possible; regular exercise of rights; life or physical safety; health protection by specified health actors; or fraud prevention and data-subject security in electronic identification and authentication.
The LGPD is the binding rule. The ANPD legitimate-interest guide is non-binding interpretation and a practical test model. For example, ordinary account data needed to perform a service requested by the person may fit Article 7(V), while biometric data used for electronic authentication must be tested against (II)(g), including whether the processing is indispensable and whether the person's rights and freedoms prevail.
Sources (2)
Binding Articles 5, 7, and 11 for data classification and legal bases, together with Articles 6, 8-10, and 14 for cross-cutting conditions.
ANPD guidance on interpreting legitimate interest and documenting the balancing test.
i) finalidade; ii) necessidade; e iii) balanceamento e salvaguardas
The controller owns the decision. Product or the business owner supplies the purpose and necessity facts; data teams identify fields and inferences; privacy or legal tests the statutory conditions; the notice and rights teams must be able to explain the result.
Keep the purpose, data and sensitive-data analysis, basis and provision, necessity, relevant contract or obligation, notice, consent event where used, legitimate-interest test where relevant, best-interest assessment for children or adolescents, recipients, retention, approval, and review trigger.
Sources (1)
ANPD guidance on interpreting legitimate interest and documenting the balancing test.
i) finalidade; ii) necessidade; e iii) balanceamento e salvaguardas
Consent must be free, informed, unambiguous, tied to a specified purpose, and provable by the controller. Generic authorisation is void. The person can revoke consent through a free and facilitated process; do not choose consent where refusal or withdrawal is not genuine.
Contract necessity covers processing needed to perform a contract with the data subject or requested preliminary steps, not every activity mentioned in terms. Legal obligation requires an applicable obligation on the controller. Health-protection bases are limited to the actors and procedures named in Articles 7 and 11.
Sources (2)
Planalto LGPD text for Article 7 lawful bases and Article 11 sensitive-data lawful bases.
O tratamento de dados pessoais somente poderá ser realizado nas seguintes hipóteses
ANPD guidance on interpreting legitimate interest and documenting the balancing test.
i) finalidade; ii) necessidade; e iii) balanceamento e salvaguardas
Use a purpose-by-purpose decision record. Ask what the organisation is doing, which data is strictly necessary, who benefits, whether the data is sensitive, which statutory elements are present, what the person is told, and how the basis changes rights, retention, and withdrawal or objection handling.
The result should link to the processing record, live notice, security and retention controls, consent evidence or legitimate-interest test where applicable, contracts or obligations relied on, and the rights route. Record the statutory article and item, not only a label such as "contract" or "legal obligation," and identify the contract step or enforceable obligation that makes the processing necessary.
Sources (2)
Planalto LGPD text for Article 7 lawful bases and Article 11 sensitive-data lawful bases.
O tratamento de dados pessoais somente poderá ser realizado nas seguintes hipóteses
ANPD guidance on interpreting legitimate interest and documenting the balancing test.
i) finalidade; ii) necessidade; e iii) balanceamento e salvaguardas
Assign each purpose-specific basis decision, supporting evidence, control, and review trigger.
Turn Lawful Bases into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with operational practice.
"i) finalidade; ii) necessidade; e iii) balanceamento e salvaguardas"
"O tratamento de dados pessoais somente poderá ser realizado nas seguintes hipóteses"
How ANPD investigates LGPD infringements, classifies severity, selects sanctions, calculates fines, and weighs aggravating and mitigating evidence.
Apply LGPD Articles 3 and 4 to a processing activity, including foreign organisations, Brazil collection, targeting, exclusions, and the evidence to retain.
Apply Brazil's LGPD incident notification test, three-business-day clock, notice content, phased filing, affected-person communication, and five-year records.
An evidence-based Brazil LGPD checklist for scope, roles, legal bases, notices, rights, vendors, security incidents, transfers, retention, and governance.
Build an LGPD compliance program from processing records, legal bases, transparency, rights, security, vendors, transfers, incidents, and accountable evidence.
Classify LGPD controller, operator, sub-operator, and encarregado roles from actual decisions, instructions, processing facts, and Resolution 18 duties.
Brazil LGPD rights guide covering confirmation, access, correction, restriction, deletion, portability, consent, sharing, objection, and automated decisions.
Track Brazil LGPD commencement dates, data-access responses, incident notices, international-transfer clauses, and ANPD fine-payment deadlines.
Build an LGPD data-subject response that identifies the right, applies the correct timing, records the decision, protects third parties, and proves delivery.
Run an LGPD data-subject request from intake and identity checks through rights analysis, response timing, evidence, exceptions, and escalation.
Decide whether an LGPD incident is reportable, calculate the ANPD deadline, prepare complete or staged notices, and keep the required five-year record.
Run an LGPD personal-data incident from confirmation and risk assessment through three-business-day notices, supplementation, mitigation, and records.
Compare LGPD international-transfer mechanisms: adequacy, ANPD standard clauses, approved specific clauses, global corporate rules, consent, and other Article 33 routes.
Brazil LGPD international-transfer guide for identifying transfers, selecting Article 33 mechanisms, applying ANPD clauses, EU adequacy, and transparency.
Apply LGPD legitimate interest through purpose, necessity, balancing, reasonable expectations, safeguards, children, sensitive-data limits, and records.
Understand every ANPD administrative sanction under LGPD Article 52, the fine ceilings, non-monetary penalties, and public-body limits.
Answers to common Brazil LGPD questions about scope, roles, legal bases, rights, incidents, transfers, impact reports, small agents, and enforcement.
Reference guide to Brazil LGPD scope, principles, legal bases, transparency, rights, roles, security, incidents, transfers, records, and ANPD oversight.
Build an LGPD RIPD evidence file that proves the processing scope, high-risk screen, necessity, safeguards, residual risk, approval, and later review.
Decide when to prepare an LGPD RIPD, apply the ANPD high-risk screen, document required evidence and mitigation, approve residual risk, and review changes.
Check whether an organization qualifies for Brazil's small-processing-agent regime, which flexibilities apply, and which LGPD duties remain unchanged.
Choose and maintain LGPD templates for processing records, data-subject requests, incidents, RIPDs, transfers, and controller-operator role evidence.
Classify an LGPD international transfer, confirm the processing legal basis and transfer mechanism, document onward transfers, and approve the evidence before launch.
Compare Brazil's LGPD and California's CCPA by scope, legal bases, consumer rights, sale and sharing rules, deadlines, transfers, and enforcement.
Compare Brazil's LGPD and the EU GDPR by scope, legal bases, roles, rights deadlines, impact assessments, incidents, transfers, and enforcement.
Apply LGPD Article 14 to children's and adolescents' data: age categories, best interests, legal bases, parental consent, limited collection, notices, and evidence.
Compare actual decision rights with contracts, operator instructions, sub-operator approvals, and the encarregado channel.
Test tracker classification, legal bases, banner choices, stored preferences, and deployed network behavior.
Assign the reportability decision, knowledge timestamp, ANPD filing, affected-person notice, and follow-up evidence.
Match each exporter, importer, onward flow, and processing basis to the selected Article 33 mechanism.
Record each purpose, data category, statutory basis, necessity, notice, retention, and reassessment trigger.
Document the interest, necessity, alternatives, expectations, impacts, effective safeguards, and approval.
Assign the report trigger, processing description, risk assessment, safeguards, controller decision, and mitigation checks.
Organize the infringement facts, classification, revenue inputs, mitigation evidence, and procedural deadlines.
Verify eligibility, group revenue, the two-part high-risk screen, each flexibility used, and continuing duties.