LGPD DSAR Response Template decisions under the Brazil LGPD should be written in operational language: who is in scope, what must happen, what evidence proves it, and when escalation is needed.
Use this guide to define the scope, owner, evidence inputs, and review outcome before execution.
This page explains how to respond to LGPD data subject requests using a practical template: what triggers a response, who owns the task, what evidence to record, which deadline applies, and when to escalate for review.
1
Section 1
How should an LGPD DSAR Response Template workflow run under the Brazil LGPD?
Run the workflow as LGPD processing triage: role, purpose, lawful basis, data category, right/transfer/incident trigger, required action, evidence, and DPO review.
Capture the request, product, role, data flow, jurisdiction, and deadline.
Check the source-linked rule and route exceptions before implementation.
Record the action taken, owner, reviewer, evidence location, and next review date.
Keep a plain-language output that support, product, legal, security, and compliance teams can all understand.
What fields should the LGPD DSAR Response Template capture?
A useful template captures role, purpose, lawful basis, data subject, category, transfer or incident trigger, owner, evidence, and ANPD/DPO escalation note.
Source URL and source quote.
Entity, product, service, system, data category, and user group.
Decision result, control action, owner, reviewer, due date, and escalation reason.
Evidence attachment, approval note, exception note, and review cadence.
LGPD Article 18 is the primary basis for a DSAR response workflow because it lists the rights a data subject may exercise against the controller.
"O titular dos dados pessoais tem direito a obter do controlador, em relação aos dados do titular por ele tratados, a qualquer momento e mediante requisição"