Select the basis by purpose, necessity, and risk, not by convenience.
The lawful basis decision affects notices, rights logic, retention, incident analysis, transfer statements, and sanctions exposure.
Structured answer sets in this page tree.
Cited legal and guidance references.
Article 7 contains the legal bases for ordinary personal data, while Article 11 does the same for sensitive personal data. The ANPD legitimate interest guide published in February 2024 adds a practical test for purpose, necessity, balancing, and safeguards, and also warns that legitimate interest is not available for sensitive personal data.
Basis selection starts with the processing purpose and the nature of the data. If the processing involves sensitive personal data, the controller needs to move to Article 11, not Article 7.
The same use case can change basis if the purpose changes. That is why the lawful basis register needs version control and review after product, HR, analytics, or vendor changes.
Where consent is the basis, Article 8 requires written or otherwise provable manifestation of will, and if it is written it must appear in a clause highlighted from the rest of the contract. Generic authorizations are null.
Consent can be revoked at any time by a free and easy procedure, and the controller bears the burden of proving that consent was obtained lawfully.
The ANPD legitimate interest guide treats legitimate interest as a structured analysis, not as a fallback basis. The guide organizes the test around purpose, necessity, balancing, and safeguards.
The same guide confirms that legitimate interest is not a basis for sensitive personal data because it appears only in Article 7 and not in Article 11.
Article 14 requires processing of children and adolescents data to be in their best interest. Article 14 paragraph 1 specifically requires highlighted consent from at least one parent or legal guardian for children data, but ANPD Statement No. 1 of 2023 clarifies that the treatment of children and adolescents data may also rely on the legal bases in Articles 7 or 11 when the best interest requirement is observed in the concrete case.
That means teams should not assume a single automatic basis for every youth-facing product flow. They should, however, expect stricter documentation and safeguards.
Research Copilot can take Brazil LGPD Lawful Bases from getting cited answers and faster research on this topic to a reusable workflow inside Sorena. Teams working on Brazil LGPD can keep owners, evidence, and next steps aligned without copying this guide into separate documents.
Start from Brazil LGPD Lawful Bases and answer scope, timing, and interpretation questions with cited outputs.
Review your current process, evidence gaps, and next steps for Brazil LGPD Lawful Bases.