Brazil LGPD Lawful Bases

Article 7 permits processing for consent; the controller's legal or regulatory obligation; public administration policy; research by a research body with anonymisation where possible; a contract or requested pre-contract steps; regular exercise of rights in judicial, administrative, or arbitral proceedings; protection of life or physical safety; health protection by the specified health actors; legitimate interest; or credit protection.

Article 11 does not copy Article 7. Sensitive data needs specific, prominent consent for specified purposes or must be indispensable for a listed route: legal or regulatory obligation; public-policy sharing; research with anonymisation where possible; regular exercise of rights; life or physical safety; health protection by specified health actors; or fraud prevention and data-subject security in electronic identification and authentication.

The LGPD is the binding rule. The ANPD legitimate-interest guide is non-binding interpretation and a practical test model. For example, ordinary account data needed to perform a service requested by the person may fit Article 7(V), while biometric data used for electronic authentication must be tested against Article 11(II)(g), including whether the processing is indispensable and whether the person's rights and freedoms prevail.

The controller owns the decision. Product or the business owner supplies the purpose and necessity facts; data teams identify fields and inferences; privacy or legal tests the statutory conditions; the notice and rights teams must be able to explain the result.

Keep the purpose, data and sensitive-data analysis, basis and provision, necessity, relevant contract or obligation, notice, consent event where used, legitimate-interest test where relevant, best-interest assessment for children or adolescents, recipients, retention, approval, and review trigger.

Consent must be free, informed, unambiguous, tied to a specified purpose, and provable by the controller. Generic authorisation is void. The person can revoke consent through a free and facilitated process; do not choose consent where refusal or withdrawal is not genuine.

Contract necessity covers processing needed to perform a contract with the data subject or requested preliminary steps, not every activity mentioned in terms. Legal obligation requires an applicable obligation on the controller. Health-protection bases are limited to the actors and procedures named in Articles 7 and 11.

Use a purpose-by-purpose decision record. Ask what the organisation is doing, which data is strictly necessary, who benefits, whether the data is sensitive, which statutory elements are present, what the person is told, and how the basis changes rights, retention, and withdrawal or objection handling.

The result should link to the processing record, live notice, security and retention controls, consent evidence or legitimate-interest test where applicable, contracts or obligations relied on, and the rights route. Record the statutory article and item, not only a label such as "contract" or "legal obligation," and identify the contract step or enforceable obligation that makes the processing necessary.