#
Legal basis and sensitive-data regimes are well-settled statutory provisions with several years of ANPD/court interpretation.
Sub-modules (4)
Lawful BasesGreen
Ten legal bases exist for general personal data, including consent and legitimate interest; a distinct 'protection of credit' basis (Art. 7 X) is unique to Brazil and important for financial/credit-bureau processing.
Claims (2):
- The LGPD restricts processing of personal data to enumerated legal bases in Article 7, similar to GDPR Article 6, including consent and legitimate interest.
- A distinctive 'protection of credit' legal basis (Art. 7 X) allows financial institutions and credit bureaus to process personal data for credit risk analysis and credit-history consultation.
Consent ThresholdsGreen
Consent must be free, informed, unambiguous and given for a specific purpose; written consent clauses must be visually highlighted, and the burden of proof for valid consent rests with the controller.
Claims (1):
- Consent must be given for particular purposes and the burden of proof is on the controller to demonstrate valid consent; consent may be revoked at any time free of charge.
Special CategoriesGreen
Sensitive personal data (Art. 5 II) includes racial/ethnic origin, religion, political opinion, union/religious/philosophical organisation membership, health, sex life, and genetic or biometric data; processing is restricted to the enumerated grounds of Article 11.
Claims (2):
- Sensitive personal data includes racial/ethnic origin, religious belief, political opinion, union/religious/philosophical organisation membership, health or sex life, and genetic or biometric data.
- Processing of sensitive personal data is restricted to the situations enumerated in Article 11, including specific/distinct consent or, without consent, compliance with a legal obligation, public-policy execution, research (with anonymisation where possible), exercise of rights, life/safety protection, health protection, or fraud prevention.
Pseudonymisation And AnonymisationAmber
Anonymised data (using reasonable technical/cost means at the time of processing) falls outside LGPD scope, except where the anonymisation is reversible or the data is used to build an identified individual's behavioral profile.
Claims (1):
- Anonymised data can be treated as personal data under the LGPD when it is used to formulate a behavioural profile of a particular natural person who is identified.
Sources and claims (6)
- ConfirmedIAPP — The LGPD restricts processing of personal data to enumerated legal bases in Article 7, similar to GDPR Article 6, including consent and legitimate interest.observed
- ConfirmedOneTrust DataGuidance — A distinctive 'protection of credit' legal basis (Art. 7 X) allows financial institutions and credit bureaus to process personal data for credit risk analysis and credit-history consultation.observed
- ConfirmedIAPP — Consent must be given for particular purposes and the burden of proof is on the controller to demonstrate valid consent; consent may be revoked at any time free of charge.observed
- ConfirmedIAPP — Sensitive personal data includes racial/ethnic origin, religious belief, political opinion, union/religious/philosophical organisation membership, health or sex life, and genetic or biometric data.observed
- ConfirmedIAPP — Processing of sensitive personal data is restricted to the situations enumerated in Article 11, including specific/distinct consent or, without consent, compliance with a legal obligation, public-policy execution, research (with anonymisation where possible), exercise of rights, life/safety protection, health protection, or fraud prevention.observed
- ProbableOneTrust DataGuidance — Anonymised data can be treated as personal data under the LGPD when it is used to formulate a behavioural profile of a particular natural person who is identified.observed