--- title: "Brazil — Lawful Processing & Special Data | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/brazil/lawful-processing-and-special-data/ source_html: /jurisdictions/brazil/lawful-processing-and-special-data/index.html description: "Brazil — Lawful Processing & Special Data: lawful_processing_and_special_data Lawful Processing & Special Data 4 sub-modules 6 claims Green ▾ # Legal basis and sensitive-data regimes are well-settled statutory provisions wi" generated_at: 2026-10-25T04:46:50Z content_sha256: c8a7de5ffe26b97c6a015208b9c99e070937e11653e8fd677652c7ba8b006a34 generator: "fe-fleet/md-twin@1.0" --- # Brazil — Lawful Processing & Special Data | Data Protection Monitor ### D2Lawful Processing & Special Data4 sub-modules6 claimsGreen▾# Legal basis and sensitive-data regimes are well-settled statutory provisions with several years of ANPD/court interpretation. Primary framework LGPD Arts. 7–13 Supervisory authority [Agência Nacional de Proteção de Dados (ANPD)](https://www.gov.br/anpd/) Traffic-light rationale — Green Legal basis and sensitive-data regimes are well-settled statutory provisions with several years of ANPD/court interpretation. #### Sub-modules (4) #### Lawful BasesGreen Ten legal bases exist for general personal data, including consent and legitimate interest; a distinct 'protection of credit' basis (Art. 7 X) is unique to Brazil and important for financial/credit-bureau processing. Claims (2): - The LGPD restricts processing of personal data to enumerated legal bases in Article 7, similar to GDPR Article 6, including consent and legitimate interest. - A distinctive 'protection of credit' legal basis (Art. 7 X) allows financial institutions and credit bureaus to process personal data for credit risk analysis and credit-history consultation. #### Consent ThresholdsGreen Consent must be free, informed, unambiguous and given for a specific purpose; written consent clauses must be visually highlighted, and the burden of proof for valid consent rests with the controller. Claims (1): - Consent must be given for particular purposes and the burden of proof is on the controller to demonstrate valid consent; consent may be revoked at any time free of charge. #### Special CategoriesGreen Sensitive personal data (Art. 5 II) includes racial/ethnic origin, religion, political opinion, union/religious/philosophical organisation membership, health, sex life, and genetic or biometric data; processing is restricted to the enumerated grounds of Article 11. Claims (2): - Sensitive personal data includes racial/ethnic origin, religious belief, political opinion, union/religious/philosophical organisation membership, health or sex life, and genetic or biometric data. - Processing of sensitive personal data is restricted to the situations enumerated in Article 11, including specific/distinct consent or, without consent, compliance with a legal obligation, public-policy execution, research (with anonymisation where possible), exercise of rights, life/safety protection, health protection, or fraud prevention. #### Pseudonymisation And AnonymisationAmber Anonymised data (using reasonable technical/cost means at the time of processing) falls outside LGPD scope, except where the anonymisation is reversible or the data is used to build an identified individual's behavioral profile. Claims (1): - Anonymised data can be treated as personal data under the LGPD when it is used to formulate a behavioural profile of a particular natural person who is identified. Category narrative 70 words The LGPD provides ten enumerated legal bases (Art. 7 and 11), including consent, legitimate interest, contract necessity and a distinctive 'protection of credit' basis. Sensitive/special-category data (racial/ethnic origin, religion, political opinion, union membership, health, sex life, genetic and biometric data) is subject to a stricter, separately enumerated set of bases under Article 11. Anonymisation and pseudonymisation are defined but ANPD has flagged that re-identifiable/behavioral-profiling data can fall back within scope. Evidence 6 Sources and claims (6) - Confirmed[IAPP](https://iapp.org/news/a/an-overview-of-brazils-lgpd) — The LGPD restricts processing of personal data to enumerated legal bases in Article 7, similar to GDPR Article 6, including consent and legitimate interest.observed 2026-08-03 - Confirmed[OneTrust DataGuidance](https://www.dataguidance.com/opinion/brazil-lgpd-v-gdpr) — A distinctive 'protection of credit' legal basis (Art. 7 X) allows financial institutions and credit bureaus to process personal data for credit risk analysis and credit-history consultation.observed 2026-08-03 - Confirmed[IAPP](https://iapp.org/news/a/processing-rights-and-dsars-under-brazils-lgpd) — Consent must be given for particular purposes and the burden of proof is on the controller to demonstrate valid consent; consent may be revoked at any time free of charge.observed 2026-08-03 - Confirmed[IAPP](https://iapp.org/news/a/an-overview-of-brazils-lgpd) — Sensitive personal data includes racial/ethnic origin, religious belief, political opinion, union/religious/philosophical organisation membership, health or sex life, and genetic or biometric data.observed 2026-08-03 - Confirmed[IAPP](https://prod.iapp.org/resources/article/brazilian-data-protection-law-lgpd-english-translation/) — Processing of sensitive personal data is restricted to the situations enumerated in Article 11, including specific/distinct consent or, without consent, compliance with a legal obligation, public-policy execution, research (with anonymisation where possible), exercise of rights, life/safety protection, health protection, or fraud prevention.observed 2026-08-03 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_lgpd_report.pdf) — Anonymised data can be treated as personal data under the LGPD when it is used to formulate a behavioural profile of a particular natural person who is identified.observed 2026-08-03