The Right to Object to Data Processing

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

The right to object to the processing of personal data is one of the most powerful safeguards in the LGPD (Brazil’s General Data Protection Law). It allows data subjects to demand that the use of their information stop in specific situations.

What the right to object to the processing of personal data means

The right to object is set out in Article 18, paragraph 2, of the General Data Protection Law (Law No. 13.709/2018). It allows data subjects to object to the processing of their personal data when it is carried out in violation of the law. Unlike a simple request for deletion, the right to object calls for a broader review of whether the challenged processing is legitimate and necessary.

The importance of this right becomes even clearer in the context of due diligence. Due diligence involves collecting and cross-referencing large volumes of personal, financial, and asset-related information. Companies, law firms, and consulting firms run these checks to assess risk in business transactions, mergers, acquisitions, and hiring. In this setting, data subjects often have no idea their information is being processed, which makes the right to object an essential form of protection.

Brazilian law follows a well-established international trend. Article 21 of the European General Data Protection Regulation (GDPR) already provided for the right to object as a fundamental safeguard. The LGPD adopted the concept and adapted it to Brazil’s legal reality. It gives data subjects a mechanism to question not only whether the processing exists, but also whether it is proportionate and fits the purpose the controller has declared.

This subject is directly related to privacy in the workplace, a topic we cover in a dedicated article.

This subject is directly related to sensitive data under the LGPD, a topic we cover in a dedicated article.

Legal bases and the limits of the right to object in due diligence

Not every instance of data processing can be effectively challenged. The LGPD lists situations in which processing is considered legitimate regardless of the data subject’s consent. These include compliance with a legal or regulatory obligation (Article 7, item II), performance of a contract (Article 7, item V), and the regular exercise of rights in judicial, administrative, or arbitration proceedings (Article 7, item VI). In due diligence, controllers often invoke legitimate interest (Article 7, item IX) as the legal basis for processing.

When processing rests on legitimate interest, data subjects have more room to exercise the right to object. That is because legitimate interest requires the controller to prepare a data protection impact assessment showing that the benefits of the processing outweigh the risks to the data subject’s fundamental rights and freedoms. If the controller cannot demonstrate that proportionality, the data subject’s objection should prevail.

In practice, we see that many companies that perform due diligence process personal data without even correctly identifying the applicable legal basis. They use public and private databases, cross-reference registration data, review financial histories, and search court records without properly informing the data subjects. This lack of transparency is, in itself, an irregularity that strengthens the data subject’s right to object.

It is important to note that the right to object is not absolute. A controller may show that there are legitimate and overriding grounds to continue processing, such as fraud prevention or compliance with regulatory obligations imposed by bodies like the Central Bank, the CVM (Brazil’s Securities and Exchange Commission), or the COAF (Brazil’s financial intelligence unit). In those cases, processing may continue despite the data subject’s objection, as long as it is strictly limited to the purpose that justifies it.

How to exercise the right to object in practice

Exercising the right to object follows a procedure that combines a formal communication with legal grounds. The first step is to identify who the data controller is, meaning the individual or legal entity that makes the decisions about the processing. In due diligence, there may be several controllers (the hiring company, the consulting firm carrying out the review, and any data suppliers), so it takes care to identify them correctly.

Once you have identified the controller, you should send a formal request to the organization’s data protection officer (DPO). The request should include your identification, a description of the data whose processing you are questioning, and the grounds for your objection. We recommend making this communication in writing, preferably by electronic means with confirmation of receipt, so there is a record of it.

The controller must respond to the request within a reasonable time, as provided in Article 18, paragraph 5, of the LGPD. If the response is unsatisfactory, or if the controller refuses to stop the processing without giving an adequate justification, you may turn to Brazil’s National Data Protection Authority (ANPD) by filing an administrative petition. The ANPD has the authority to order the processing to stop and to impose administrative sanctions on the violating controller.

The right to object to data processing is not merely a legal formality. It is a concrete protection that allows data subjects to question the proportionality and necessity of the use of their personal information.

In due diligence, the effectiveness of an objection depends heavily on when it is made. When the data subject learns of the processing while data is still being collected and analyzed, the chances of stopping it are greater. After the due diligence process is complete and a decision has been made based on the data collected, an objection may have limited effect on consequences that have already materialized, although it still ensures that the data is deleted for future uses.

Risks for companies that ignore the right to object

The consequences for organizations that disregard data subjects’ right to object are significant and reach several areas. On the administrative side, the ANPD may impose sanctions including warnings, fines of up to 2% of the company’s revenue (capped at R$ 50 milhões per violation), public disclosure of the violation, and the blocking and deletion of personal data processed unlawfully. These penalties are set out in Article 52 of the LGPD and have been enforced since the sanctioning procedure was regulated.

In court, a data subject whose right to object was ignored may seek compensation for moral and material damages. The controller’s liability for unlawful processing of personal data is strict when it results from a risky activity (Article 42 of the LGPD), which makes it easier for the harmed data subject to obtain redress. In due diligence, the damage can be especially serious when improper data processing leads to adverse decisions about the data subject’s credit, employment, or reputation.

Beyond the direct legal consequences, ignoring the right to object creates considerable reputational risk. Companies in regulated sectors (financial services, health care, telecommunications) face additional scrutiny from sector regulators and the media. Public disclosure of a violation by the ANPD can damage business relationships and the trust of customers and partners.

In the specific context of due diligence, neglecting the right to object can taint the entire underlying transaction. If a merger or acquisition is conducted on the basis of data that was obtained and processed unlawfully, the acquiring company takes on not only the liability for the original violation but also responsibility for decisions made on the strength of information whose collection and processing were questionable from the start.

Compliance best practices for due diligence

A robust data protection program for due diligence starts with clearly defining the legal basis that applies to each category of data processed. We recommend that organizations create a detailed map of their data flows, identifying what personal information is collected, from which sources, for what purposes, and for how long it will be stored. This map is essential for responding properly to any objection.

Transparency with data subjects is another essential pillar. Whenever possible, data subjects should be told how their data is processed in the due diligence context, with a clear statement of the purpose, the legal basis relied on, and the channels available to exercise their rights. We recognize that in some situations advance notice can undermine the purpose of the review (as in fraud investigations). Even then, the notice should be given as soon as the restriction that prevented it ends.

Data minimization is an indispensable practice. Due diligence should not collect more information than is strictly necessary for its intended purpose. Sensitive data (racial origin, religious belief, health data, and others listed in Article 5, item II, of the LGPD) requires additional care and, as a rule, should not be processed in commercial due diligence without strong justification.

Finally, it is worth stressing the importance of having clear internal procedures for receiving and responding to objections. The data protection officer must be trained to evaluate each request, assess whether the objection is well founded in light of the legal basis used, and communicate a reasoned decision to the data subject. Documenting the entire process is essential both to demonstrate compliance before the ANPD and to support a defense in any court proceedings.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.