Choose the record from the legal event: routine processing, a data-subject request, a security incident, high-risk processing, an international transfer, or a role allocation.
A template is not an official ANPD form unless the authority says so. Adapt each record to the processing facts and keep the source, owner, decision, evidence, and review trigger.
Use LGPD templates to make recurring decisions reproducible, not to replace the legal analysis. A or event-specific record should identify the controller or operator, processing and people in scope, applicable provision, decision, responsible owner, evidence, approval, deadline where one exists, and the facts that require review.
Use a for the recurring inventory required by Article 37; a data-subject request record for Articles 18-20; an incident assessment and communication record for Article 48 and Resolution 15/2024; a for high-risk processing or an ANPD request; an international-transfer record for Articles 33-36 and Resolution 19/2024; and a role record for controller, operator, sub-operator, and encarregado decisions.
Keep separate templates when the trigger, responsible actor, deadline, or required evidence differs. One generic compliance form tends to hide whether a request was answered, an incident threshold was tested, a transfer mechanism was valid, or a safeguard was actually implemented.
Use the ANPD's own incident communication form when filing a report, and preserve the filed version and protocol. The model published by government bodies is a working aid rather than a substitute for Article 38's minimum content or the controller's own risk analysis.
Sources (2)
Articles 18-20, 33-41, and 46-48 establish the distinct rights, transfer, record, RIPD, role, security, and incident records these templates support.
Current ANPD index showing the status of Resolutions 2, 15, 18, 19, and later regulations used by the records on this page.
Start with stable identification fields: record ID and version, entity, controller and operator roles, product or process, purpose, people and data, source provision, owner, reviewer, decision date, and evidence location. Add the event-specific fields only after the applicable rule is known.
Distinguish a fact from a conclusion and a planned action from completed evidence. For example, a security-policy link does not prove that access was revoked, and an unsigned contract draft does not prove that an international-transfer mechanism is in force.
A rights template should not assign the 15-day Article 19 period to every Article 18 right. It should distinguish immediate simplified confirmation or access, a complete confirmation or access statement within 15 days, and other rights whose timing depends on the applicable ANPD or sector rule and the facts.
Sources (2)
ANPD's recommended RIPD information illustrates how processing, legal basis, necessity, risk, safeguards, consultation, approval, and review should be evidenced.
Article 9 permits a simplified processing record for qualifying small processing agents but does not remove the underlying accountability duty.
Assign a content owner for the legal fields and an operational owner for the workflow. Test the template with a real scenario before release, confirm that every required decision can be recorded, and prevent users from selecting a deadline or legal conclusion without the supporting provision.
Review templates after a relevant law or ANPD regulation changes and after evidence shows recurring omissions. A new vendor, purpose, data category, transfer, automated decision, incident pattern, or role change may require a new record, not merely a revised blank form.
Sources (2)
Article 6(X) requires measures that can demonstrate compliance and their effectiveness; the topic-specific provisions determine each record's content.
Current status index for the regulations that change incident, transfer, encarregado, and small-agent template fields.
Assign each template's legal fields, workflow, evidence, approval, version, and review to named owners.
Turn Templates into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review template scope, evidence fields, owners, and next actions.
How ANPD investigates LGPD infringements, classifies severity, selects sanctions, calculates fines, and weighs aggravating and mitigating evidence.
Apply LGPD Articles 3 and 4 to a processing activity, including foreign organisations, Brazil collection, targeting, exclusions, and the evidence to retain.
Apply Brazil's LGPD incident notification test, three-business-day clock, notice content, phased filing, affected-person communication, and five-year records.
An evidence-based Brazil LGPD checklist for scope, roles, legal bases, notices, rights, vendors, security incidents, transfers, retention, and governance.
Build an LGPD compliance program from processing records, legal bases, transparency, rights, security, vendors, transfers, incidents, and accountable evidence.
Classify LGPD controller, operator, sub-operator, and encarregado roles from actual decisions, instructions, processing facts, and Resolution 18 duties.
Brazil LGPD rights guide covering confirmation, access, correction, restriction, deletion, portability, consent, sharing, objection, and automated decisions.
Track Brazil LGPD commencement dates, data-access responses, incident notices, international-transfer clauses, and ANPD fine-payment deadlines.
Build an LGPD data-subject response that identifies the right, applies the correct timing, records the decision, protects third parties, and proves delivery.
Run an LGPD data-subject request from intake and identity checks through rights analysis, response timing, evidence, exceptions, and escalation.
Decide whether an LGPD incident is reportable, calculate the ANPD deadline, prepare complete or staged notices, and keep the required five-year record.
Run an LGPD personal-data incident from confirmation and risk assessment through three-business-day notices, supplementation, mitigation, and records.
Compare LGPD international-transfer mechanisms: adequacy, ANPD standard clauses, approved specific clauses, global corporate rules, consent, and other Article 33 routes.
Brazil LGPD international-transfer guide for identifying transfers, selecting Article 33 mechanisms, applying ANPD clauses, EU adequacy, and transparency.
Compare LGPD Article 7 bases for ordinary personal data and Article 11 bases for sensitive data, with consent, necessity, evidence, and edge cases.
Apply LGPD legitimate interest through purpose, necessity, balancing, reasonable expectations, safeguards, children, sensitive-data limits, and records.
Understand every ANPD administrative sanction under LGPD Article 52, the fine ceilings, non-monetary penalties, and public-body limits.
Answers to common Brazil LGPD questions about scope, roles, legal bases, rights, incidents, transfers, impact reports, small agents, and enforcement.
Reference guide to Brazil LGPD scope, principles, legal bases, transparency, rights, roles, security, incidents, transfers, records, and ANPD oversight.
Build an LGPD RIPD evidence file that proves the processing scope, high-risk screen, necessity, safeguards, residual risk, approval, and later review.
Decide when to prepare an LGPD RIPD, apply the ANPD high-risk screen, document required evidence and mitigation, approve residual risk, and review changes.
Check whether an organization qualifies for Brazil's small-processing-agent regime, which flexibilities apply, and which LGPD duties remain unchanged.
Classify an LGPD international transfer, confirm the processing legal basis and transfer mechanism, document onward transfers, and approve the evidence before launch.
Compare Brazil's LGPD and California's CCPA by scope, legal bases, consumer rights, sale and sharing rules, deadlines, transfers, and enforcement.
Compare Brazil's LGPD and the EU GDPR by scope, legal bases, roles, rights deadlines, impact assessments, incidents, transfers, and enforcement.
Apply LGPD Article 14 to children's and adolescents' data: age categories, best interests, legal bases, parental consent, limited collection, notices, and evidence.
Compare actual decision rights with contracts, operator instructions, sub-operator approvals, and the encarregado channel.
Test tracker classification, legal bases, banner choices, stored preferences, and deployed network behavior.
Assign the reportability decision, knowledge timestamp, ANPD filing, affected-person notice, and follow-up evidence.
Match each exporter, importer, onward flow, and processing basis to the selected Article 33 mechanism.
Record each purpose, data category, statutory basis, necessity, notice, retention, and reassessment trigger.
Document the interest, necessity, alternatives, expectations, impacts, effective safeguards, and approval.
Assign the report trigger, processing description, risk assessment, safeguards, controller decision, and mitigation checks.
Organize the infringement facts, classification, revenue inputs, mitigation evidence, and procedural deadlines.
Verify eligibility, group revenue, the two-part high-risk screen, each flexibility used, and continuing duties.