Brazil LGPD Legal Bases and Legitimate Interest Balancing

Phase 1, purpose: describe whether the interest belongs to the controller or a third party, the concrete situation supporting it, the benefit sought, and its compatibility with Brazilian law. Confirm that the data is not sensitive. If children or adolescents are involved, document how their best interest is observed and prevails.

Phase 2, necessity: identify the minimum data and operations needed for the purpose. Compare less intrusive reasonable alternatives, narrower populations, shorter retention, lower precision, or processing that avoids identification.

Phase 3, balancing and safeguards: assess the relationship with the person, collection source and context, purpose compatibility, likely expectations, scale, intrusiveness, vulnerability, possible harms, discrimination, and ability to exercise rights. Add safeguards, then decide whether rights and freedoms still prevail.

The controller owns the Article 7(IX) decision. The business or product owner supplies the concrete interest and alternatives; data and engineering identify fields, sources, scale, recipients, and retention; privacy or legal challenges the balance; security and product teams implement safeguards.

Keep one test per specific purpose. Record the interest and beneficiary, data category, people, collection context, purpose, necessity and alternatives, expectations, impacts, vulnerabilities, safeguards, transparency, objection path, retention, recipients, approver, conclusion, and reassessment triggers.

Article 7 legitimate interest is unavailable for sensitive data. Article 11's fraud-prevention and data-subject-security basis is separate and limited to electronic identification and authentication; the ANPD guide applies a similar balancing method to that basis.

Publicly accessible data remains protected. Purpose, good faith, public interest, rights, source, context, and reasonable expectations still matter. A privacy notice does not make disproportionate employee surveillance, unexpected profiling, or broad reuse acceptable.

ANPD examples show why context controls the result. A school may be able to use ordinary student identifiers to authenticate access to its Wi-Fi after a best-interest assessment and suitable safeguards. Child-directed advertising for unhealthy food in an educational app failed the guide's analysis because the purpose was unexpected and did not satisfy the child's best interest. Shopping-centre camera monitoring may support safety, but scale, public-area monitoring, children, retention, access limits, notices, and avoidance of biometric analysis can require a fuller high-risk assessment and RIPD.

The ANPD model is optional, so an organisation may adapt the format. The record must still be detailed enough to demonstrate the actual purpose, interest, necessity, balance, expectations, and safeguards. A short assessment may be proportionate for clearly low-impact processing; high-scale or novel technology may need more detail and a broader RIPD.

Link the result to the Article 37 processing record, live notice, data minimisation, retention, security controls, objection route, vendor instructions, and any RIPD. Approval should be conditional on those safeguards operating.