Use the template after the controller verifies the requester and identifies the specific or right.
Confirmation and access can be answered immediately in simplified form or within 15 days through a . Do not apply that period automatically to every other right.
Use this template to record the LGPD right exercised, requester verification, searches, response form, deadline, decision, action, exception, review, and delivery. For confirmation or access, choose an immediate simplified response or a within the Article 19 period.
Use one response record for the request, but decide each requested right separately. Confirm the controller, requester or representative, verification method, requested processing, systems searched, operators consulted, right exercised, result, legal or factual limitation, response form, due date, reviewer, and delivery channel.
covers confirmation, access, correction, conditional anonymization, blocking or deletion, portability subject to ANPD regulation, consent-based deletion subject to Article 16, sharing information, consent information and revocation, and objection where the LGPD has been breached. separately covers review of decisions based solely on automated processing that affect the data subject.
Sources (2)
Articles 18-20 establish the rights, response outcomes, confirmation and access forms, and automated-decision review.
ANPD's current public explanation of the main rights and confirmation and access timing.
For confirmation and access, the response must choose the Article 19 form: an immediate simplified answer or a within 15 days. The complete declaration should state the data's origin, absence of a record where relevant, processing criteria, and purpose, while protecting commercial and industrial secrets.
For other rights, record the applicable rule and an internal due date rather than presenting the 15-day access period as universal. Qualifying small processing agents have separate timing rules, including double time for the complete declaration and up to 15 days for the simplified declaration.
Sources (2)
Articles 16, 18, and 19 support retention exceptions, decision fields, downstream communication, and confirmation and access content.
Articles 14 and 15 provide differentiated periods for qualifying small processing agents.
Before sending, check that the response answers every requested item, contains only the requester's personal data, protects another person's rights and protected secrets, and explains any partial result. Keep the original request, verification, searches, analysis, response, disclosed copy, action evidence, and delivery proof.
When the controller corrects, anonymizes, blocks, or deletes data, it must inform agents with which it shared the data so they can repeat the action, unless communication is proven impossible or involves disproportionate effort. Record the recipients contacted and the exception analysis.
Use a separate decision row for each requested right and data set. A response may therefore be fulfilled for correction, partially fulfilled for access because another person's data was separated, and refused for deletion because a documented Article 16 conservation ground applies. State the facts and legal reason for each outcome.
Sources (2)
Articles 8(5), 16, 18(4)-(6), and 19 support withdrawal, retention, explanations, downstream actions, and response delivery.
ANPD explains that a petition should include evidence of a prior attempt to exercise the right with the controller.
Assign verification, searches, rights decisions, response delivery, and evidence to named owners.
Turn LGPD DSAR Response Template into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review request scope, response evidence, owners, and next actions.
How ANPD investigates LGPD infringements, classifies severity, selects sanctions, calculates fines, and weighs aggravating and mitigating evidence.
Apply LGPD Articles 3 and 4 to a processing activity, including foreign organisations, Brazil collection, targeting, exclusions, and the evidence to retain.
Apply Brazil's LGPD incident notification test, three-business-day clock, notice content, phased filing, affected-person communication, and five-year records.
An evidence-based Brazil LGPD checklist for scope, roles, legal bases, notices, rights, vendors, security incidents, transfers, retention, and governance.
Build an LGPD compliance program from processing records, legal bases, transparency, rights, security, vendors, transfers, incidents, and accountable evidence.
Classify LGPD controller, operator, sub-operator, and encarregado roles from actual decisions, instructions, processing facts, and Resolution 18 duties.
Brazil LGPD rights guide covering confirmation, access, correction, restriction, deletion, portability, consent, sharing, objection, and automated decisions.
Track Brazil LGPD commencement dates, data-access responses, incident notices, international-transfer clauses, and ANPD fine-payment deadlines.
Run an LGPD data-subject request from intake and identity checks through rights analysis, response timing, evidence, exceptions, and escalation.
Decide whether an LGPD incident is reportable, calculate the ANPD deadline, prepare complete or staged notices, and keep the required five-year record.
Run an LGPD personal-data incident from confirmation and risk assessment through three-business-day notices, supplementation, mitigation, and records.
Compare LGPD international-transfer mechanisms: adequacy, ANPD standard clauses, approved specific clauses, global corporate rules, consent, and other Article 33 routes.
Brazil LGPD international-transfer guide for identifying transfers, selecting Article 33 mechanisms, applying ANPD clauses, EU adequacy, and transparency.
Compare LGPD Article 7 bases for ordinary personal data and Article 11 bases for sensitive data, with consent, necessity, evidence, and edge cases.
Apply LGPD legitimate interest through purpose, necessity, balancing, reasonable expectations, safeguards, children, sensitive-data limits, and records.
Understand every ANPD administrative sanction under LGPD Article 52, the fine ceilings, non-monetary penalties, and public-body limits.
Answers to common Brazil LGPD questions about scope, roles, legal bases, rights, incidents, transfers, impact reports, small agents, and enforcement.
Reference guide to Brazil LGPD scope, principles, legal bases, transparency, rights, roles, security, incidents, transfers, records, and ANPD oversight.
Build an LGPD RIPD evidence file that proves the processing scope, high-risk screen, necessity, safeguards, residual risk, approval, and later review.
Decide when to prepare an LGPD RIPD, apply the ANPD high-risk screen, document required evidence and mitigation, approve residual risk, and review changes.
Check whether an organization qualifies for Brazil's small-processing-agent regime, which flexibilities apply, and which LGPD duties remain unchanged.
Choose and maintain LGPD templates for processing records, data-subject requests, incidents, RIPDs, transfers, and controller-operator role evidence.
Classify an LGPD international transfer, confirm the processing legal basis and transfer mechanism, document onward transfers, and approve the evidence before launch.
Compare Brazil's LGPD and California's CCPA by scope, legal bases, consumer rights, sale and sharing rules, deadlines, transfers, and enforcement.
Compare Brazil's LGPD and the EU GDPR by scope, legal bases, roles, rights deadlines, impact assessments, incidents, transfers, and enforcement.
Apply LGPD Article 14 to children's and adolescents' data: age categories, best interests, legal bases, parental consent, limited collection, notices, and evidence.
Compare actual decision rights with contracts, operator instructions, sub-operator approvals, and the encarregado channel.
Test tracker classification, legal bases, banner choices, stored preferences, and deployed network behavior.
Assign the reportability decision, knowledge timestamp, ANPD filing, affected-person notice, and follow-up evidence.
Match each exporter, importer, onward flow, and processing basis to the selected Article 33 mechanism.
Record each purpose, data category, statutory basis, necessity, notice, retention, and reassessment trigger.
Document the interest, necessity, alternatives, expectations, impacts, effective safeguards, and approval.
Assign the report trigger, processing description, risk assessment, safeguards, controller decision, and mitigation checks.
Organize the infringement facts, classification, revenue inputs, mitigation evidence, and procedural deadlines.
Verify eligibility, group revenue, the two-part high-risk screen, each flexibility used, and continuing duties.