We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideBrazilLGPD DSAR Response Template

Brazil LGPD LGPD DSAR Response Template

Use the template after the controller verifies the requester and identifies the specific Article 18 or Article 20 right.

Confirmation and access can be answered immediately in simplified form or within 15 days through a clear and complete declaration. Do not apply that period automatically to every other right.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
Sections
3

Structured answer sets in this page tree.

Primary sources
5

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 24, 2026
Overview

Use this template to record the LGPD right exercised, requester verification, searches, response form, deadline, decision, action, exception, review, and delivery. For confirmation or access, choose an immediate simplified response or a within the Article 19 period.

Section 1

How should an LGPD DSAR Response Template workflow run under the Brazil LGPD?

Use one response record for the request, but decide each requested right separately. Confirm the controller, requester or representative, verification method, requested processing, systems searched, operators consulted, right exercised, result, legal or factual limitation, response form, due date, reviewer, and delivery channel.

covers confirmation, access, correction, conditional anonymization, blocking or deletion, portability subject to ANPD regulation, consent-based deletion subject to Article 16, sharing information, consent information and revocation, and objection where the LGPD has been breached. separately covers review of decisions based solely on automated processing that affect the data subject.

  • Do not disclose personal data until identity or authority is sufficiently verified through a proportionate process.
  • State whether each item is fulfilled, partially fulfilled, refused, redirected, or pending a named dependency.
  • If the recipient is not the responsible processing agent, respond immediately and identify the agent where possible.
  • Use clear language and a secure electronic or printed delivery method appropriate to the request.
Sources for this answer
LEI Nº 13.709, DE 14 DE AGOSTO DE 2018
Articles 18-20 establish the rights, response outcomes, confirmation and access forms, and automated-decision review.
ANPD - Data Subject Rights
ANPD's current public explanation of the main rights and confirmation and access timing.
Section 2

What fields should the LGPD DSAR Response Template capture?

For confirmation and access, the response must choose the Article 19 form: an immediate simplified answer or a within 15 days. The complete declaration should state the data's origin, absence of a record where relevant, processing criteria, and purpose, while protecting commercial and industrial secrets.

For other rights, record the applicable rule and an internal due date rather than presenting the 15-day access period as universal. Qualifying small processing agents have separate timing rules, including double time for the complete declaration and up to 15 days for the simplified declaration.

  • Request block: controller, requester, representative authority, protocol, receipt date, verification, channel, requested rights, processing scope, and preferred format.
  • Search block: systems, archives, operators, data categories, purposes, sources, criteria, sharing, retention, and search owner.
  • Response block: decision for each item, data or action supplied, limitation and reason, Article 16 retention basis where used, response date, reviewer, and contact route.
  • Evidence block: disclosed copy, correction or deletion proof, downstream-agent instruction, consent change, delivery proof, exception approval, and follow-up.
  • Rights-specific block: for correction, identify the field and authoritative replacement; for deletion, distinguish unlawful or excessive data from consent-based deletion and Article 16 conservation; for objection, identify the alleged LGPD breach; for review, identify the solely automated decision, its effect, review result, and explanation supplied.
Sources for this answer
Lei Geral de Protecao de Dados Pessoais (Law No. 13,709/2018)
Articles 16, 18, and 19 support retention exceptions, decision fields, downstream communication, and confirmation and access content.
ANPD Resolution CD/ANPD No. 2 of 27 January 2022
Articles 14 and 15 provide differentiated periods for qualifying small processing agents.
Section 3

How should teams review and improve the LGPD DSAR Response Template workflow?

Before sending, check that the response answers every requested item, contains only the requester's personal data, protects another person's rights and protected secrets, and explains any partial result. Keep the original request, verification, searches, analysis, response, disclosed copy, action evidence, and delivery proof.

When the controller corrects, anonymizes, blocks, or deletes data, it must inform agents with which it shared the data so they can repeat the action, unless communication is proven impossible or involves disproportionate effort. Record the recipients contacted and the exception analysis.

Use a separate decision row for each requested right and data set. A response may therefore be fulfilled for correction, partially fulfilled for access because another person's data was separated, and refused for deletion because a documented Article 16 conservation ground applies. State the facts and legal reason for each outcome.

  • Do not treat consent withdrawal as retroactively invalidating earlier processing; assess future processing and deletion separately.
  • Escalate legal holds, another person's data, disputed identity, unclear controller status, protected secrets, and deletion conflicts.
  • Give the requester a protocol or reference that can prove the prior attempt if a later ANPD petition is needed.
  • Review recurring delays, incomplete searches, operator failures, and repeated refusal grounds.
Sources for this answer
LEI Nº 13.709, DE 14 DE AGOSTO DE 2018
Articles 8(5), 16, 18(4)-(6), and 19 support withdrawal, retention, explanations, downstream actions, and response delivery.
ANPD - Complaint or Data Subject Petition under the LGPD
ANPD explains that a petition should include evidence of a prior attempt to exercise the right with the controller.
Recommended next step

Turn Brazil LGPD DSAR Response Template into assigned work

Assign verification, searches, rights decisions, response delivery, and evidence to named owners.

Assessment workflow
Open Assessment Autopilot for Brazil LGPD

Turn LGPD DSAR Response Template into scoped questions, evidence fields, and review tasks.

Explore next step
Research workflow
Review Brazil LGPD source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review request scope, response evidence, owners, and next actions.

Explore next step
Primary sources

References and citations

ANPD - Data Subject Rights
gov.br
Referenced sections
  • ANPD's current public explanation of the main rights and confirmation and access timing.
LEI Nº 13.709, DE 14 DE AGOSTO DE 2018
planalto.gov.br
Referenced sections
  • Articles 8(5), 16, 18(4)-(6), and 19 support withdrawal, retention, explanations, downstream actions, and response delivery.
Related guides

Explore more topics

Brazil LGPD ANPD Enforcement and Fines Guide
How ANPD investigates LGPD infringements, classifies severity, selects sanctions, calculates fines, and weighs aggravating and mitigating evidence.
Brazil LGPD Applicability Test Guide
Apply LGPD Articles 3 and 4 to a processing activity, including foreign organisations, Brazil collection, targeting, exclusions, and the evidence to retain.
Brazil LGPD Breach Notification Guide
Apply Brazil's LGPD incident notification test, three-business-day clock, notice content, phased filing, affected-person communication, and five-year records.
Brazil LGPD Checklist
An evidence-based Brazil LGPD checklist for scope, roles, legal bases, notices, rights, vendors, security incidents, transfers, retention, and governance.
Brazil LGPD Compliance Guide
Build an LGPD compliance program from processing records, legal bases, transparency, rights, security, vendors, transfers, incidents, and accountable evidence.
Brazil LGPD Controller Operator and DPO Roles Guide
Classify LGPD controller, operator, sub-operator, and encarregado roles from actual decisions, instructions, processing facts, and Resolution 18 duties.
Brazil LGPD Data Subject Rights Guide
Brazil LGPD rights guide covering confirmation, access, correction, restriction, deletion, portability, consent, sharing, objection, and automated decisions.
Brazil LGPD Deadlines and Compliance Calendar Guide
Track Brazil LGPD commencement dates, data-access responses, incident notices, international-transfer clauses, and ANPD fine-payment deadlines.
Brazil LGPD DSAR Workflow Guide
Run an LGPD data-subject request from intake and identity checks through rights analysis, response timing, evidence, exceptions, and escalation.
Brazil LGPD Incident Reporting to ANPD Guide
Decide whether an LGPD incident is reportable, calculate the ANPD deadline, prepare complete or staged notices, and keep the required five-year record.
Brazil LGPD Incident Workflow Guide
Run an LGPD personal-data incident from confirmation and risk assessment through three-business-day notices, supplementation, mitigation, and records.
Brazil LGPD International Transfer Mechanisms Guide
Compare LGPD international-transfer mechanisms: adequacy, ANPD standard clauses, approved specific clauses, global corporate rules, consent, and other Article 33 routes.
Brazil LGPD International Transfers Guide
Brazil LGPD international-transfer guide for identifying transfers, selecting Article 33 mechanisms, applying ANPD clauses, EU adequacy, and transparency.
Brazil LGPD Lawful Bases Guide
Compare LGPD Article 7 bases for ordinary personal data and Article 11 bases for sensitive data, with consent, necessity, evidence, and edge cases.
Brazil LGPD Legal Bases and Legitimate Interest Balancing Guide
Apply LGPD legitimate interest through purpose, necessity, balancing, reasonable expectations, safeguards, children, sensitive-data limits, and records.
Brazil LGPD Penalties and Fines Guide
Understand every ANPD administrative sanction under LGPD Article 52, the fine ceilings, non-monetary penalties, and public-body limits.
Brazil LGPD Privacy Law FAQ
Answers to common Brazil LGPD questions about scope, roles, legal bases, rights, incidents, transfers, impact reports, small agents, and enforcement.
Brazil LGPD Requirements Guide
Reference guide to Brazil LGPD scope, principles, legal bases, transparency, rights, roles, security, incidents, transfers, records, and ANPD oversight.
Brazil LGPD RIPD and DPIA Evidence Guide
Build an LGPD RIPD evidence file that proves the processing scope, high-risk screen, necessity, safeguards, residual risk, approval, and later review.
Brazil LGPD RIPD Workflow Guide
Decide when to prepare an LGPD RIPD, apply the ANPD high-risk screen, document required evidence and mitigation, approve residual risk, and review changes.
Brazil LGPD Small Processing Agents Guide
Check whether an organization qualifies for Brazil's small-processing-agent regime, which flexibilities apply, and which LGPD duties remain unchanged.
Brazil LGPD Templates Guide
Choose and maintain LGPD templates for processing records, data-subject requests, incidents, RIPDs, transfers, and controller-operator role evidence.
Brazil LGPD Transfer Workflow Guide
Classify an LGPD international transfer, confirm the processing legal basis and transfer mechanism, document onward transfers, and approve the evidence before launch.
LGPD vs CCPA: Key Differences for Privacy Teams
Compare Brazil's LGPD and California's CCPA by scope, legal bases, consumer rights, sale and sharing rules, deadlines, transfers, and enforcement.
LGPD vs GDPR: Key Differences for Privacy Teams
Compare Brazil's LGPD and the EU GDPR by scope, legal bases, roles, rights deadlines, impact assessments, incidents, transfers, and enforcement.
What should teams do about Children's Data under the Brazil LGPD?
Apply LGPD Article 14 to children's and adolescents' data: age categories, best interests, legal bases, parental consent, limited collection, notices, and evidence.
What should teams do about Controller Operator and DPO Roles under the Brazil LGPD?
Brazil LGPD guidance for Controller Operator and DPO Roles, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about Cookies under the Brazil LGPD?
Brazil LGPD guidance for Cookies, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about Incident Reporting To ANPD under the Brazil LGPD?
Brazil LGPD guidance for Incident Reporting To ANPD, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about International Transfer Mechanisms under the Brazil LGPD?
Brazil LGPD guidance for International Transfer Mechanisms, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about Legal Bases under the Brazil LGPD?
Brazil LGPD guidance for Legal Bases, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about Legitimate Interest Balancing under the Brazil LGPD?
Brazil LGPD guidance for Legitimate Interest Balancing, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about RIPD and DPIA under the Brazil LGPD?
Brazil LGPD guidance for RIPD and DPIA, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about Sanctions Methodology under the Brazil LGPD?
Brazil LGPD guidance for Sanctions Methodology, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about Small Processing Agents under the Brazil LGPD?
Brazil LGPD guidance for Small Processing Agents, with practical decisions, evidence, edge cases, and external source citations.