--- title: "Brazil — Data Subject Rights | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/brazil/data-subject-rights/ source_html: /jurisdictions/brazil/data-subject-rights/index.html description: "Brazil — Data Subject Rights: data_subject_rights Data Subject Rights 5 sub-modules 5 claims Green ▾ # Rights catalogue is comprehensive and in force, though some response-timeline specifics are left to case-by-cas" generated_at: 2026-10-25T04:46:50Z content_sha256: 7cc6a6ea9d61981b494a8717c4cb56974ea5bb748290bff8379836ced6c6db16 generator: "fe-fleet/md-twin@1.0" --- # Brazil — Data Subject Rights | Data Protection Monitor ### D3Data Subject Rights5 sub-modules5 claimsGreen▾# Rights catalogue is comprehensive and in force, though some response-timeline specifics are left to case-by-case ANPD regulation. Primary framework LGPD Arts. 9, 18–20 Supervisory authority [Agência Nacional de Proteção de Dados (ANPD)](https://www.gov.br/anpd/) Traffic-light rationale — Green Rights catalogue is comprehensive and in force, though some response-timeline specifics are left to case-by-case ANPD regulation. #### Sub-modules (5) #### Access RightGreen Data subjects have the right to confirmation of the existence of processing and facilitated access to their data (Arts. 9, 19). Claims (1): - Data subjects have the right to facilitated access to information about the processing of their data, to be made available in a clear, adequate and ostensible manner. #### Rectification And ErasureGreen Article 18 grants rights to correct incomplete/inaccurate/outdated data and to anonymise, block, or delete unnecessary, excessive, or unlawfully processed data. Claims (1): - Article 18 rights include correcting incomplete, inaccurate or out-of-date data, and anonymising, blocking or deleting unnecessary or excessive data or data processed in noncompliance with the law. #### Restriction And ObjectionGreen Data subjects may petition against the controller before ANPD, and may oppose processing carried out under a consent-waiver ground if the LGPD is not being complied with. Claims (1): - The data subject has the right to petition regarding her/his data against the controller before the national authority, and may oppose processing carried out under a consent-waiver ground if there is noncompliance with the LGPD. #### Data PortabilityAmber Article 18(V) grants a right to data portability; sectoral implementation (e.g., Central Bank open-banking/open-finance rules) has been used to operationalise portability in the financial sector ahead of general ANPD guidance. Claims (1): - The Central Bank and Monetary Council's open banking regulation implemented consent-based data portability among financial institutions ahead of general ANPD portability guidance. #### Deadlines And Response WindowsAmber Where immediate compliance with a rights request is impossible, the controller must respond indicating either that it is not the processing agent or the factual/legal reasons preventing immediate action (Art. 19 §4); a fixed 15-day deadline applies specifically to requests for the text of international-transfer contractual instruments. Claims (1): - Upon a data subject's request for the full text of contractual instruments used in an international transfer, controllers have 15 days to provide it, excluding trade secrets. Category narrative 42 words Article 18 grants a GDPR-like bundle of rights (confirmation/access, correction, anonymisation/blocking/deletion, portability, information about sharing and about consequences of refusing consent, and review of automated decisions under Article 20). Rights must first be exercised directly against the controller before escalation to ANPD. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Evidence 5 Sources and claims (5) - Confirmed[DataGuidance](https://www.dataguidance.com/sites/default/files/lgpd_translation.pdf) — Data subjects have the right to facilitated access to information about the processing of their data, to be made available in a clear, adequate and ostensible manner.observed 2026-08-03 - Confirmed[IAPP](https://iapp.org/news/a/processing-rights-and-dsars-under-brazils-lgpd) — Article 18 rights include correcting incomplete, inaccurate or out-of-date data, and anonymising, blocking or deleting unnecessary or excessive data or data processed in noncompliance with the law.observed 2026-08-03 - Confirmed[IAPP](https://prod.iapp.org/resources/article/brazilian-data-protection-law-lgpd-english-translation/) — The data subject has the right to petition regarding her/his data against the controller before the national authority, and may oppose processing carried out under a consent-waiver ground if there is noncompliance with the LGPD.observed 2026-08-03 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/opinion/brazil-new-open-banking-rules) — The Central Bank and Monetary Council's open banking regulation implemented consent-based data portability among financial institutions ahead of general ANPD portability guidance.observed 2026-08-03 - Confirmed[IAPP](https://iapp.org/news/a/brazils-new-regulation-on-international-data-transfers) — Upon a data subject's request for the full text of contractual instruments used in an international transfer, controllers have 15 days to provide it, excluding trade secrets.observed 2026-08-03