LGPD (Brazil’s General Personal Data Protection Law): The Nine Rights of Data Subjects

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Brazil’s General Personal Data Protection Law gave individuals a catalog of nine rights they can exercise against any company or public agency that processes their information. These rights allow data subjects to know about, control and, in specific situations, delete their own data.

What the LGPD Recognizes for Data Subjects

Law 13.709/2018, known as the General Personal Data Protection Law, sets out in Article 18 a list of nine rights that a data subject can exercise directly against the controller, meaning the individual or legal entity that makes the decisions about how personal information is processed. This list is not merely declaratory. Each right comes with administrative enforcement mechanisms before the National Data Protection Authority and judicial remedies before the courts.

The nine rights range from confirming that data is being processed to seeking review of automated decisions that affect the data subject’s interests. Read as a whole, the provision follows a progressive logic. First, you find out what is being done with your information. Then you access its content, correct it, control it, transfer it and, depending on the circumstances, have it deleted or object to its processing.

The law requires that the response to a request be free of charge, in an accessible format and within a reasonable time, as set by the National Authority’s regulations. A controller that misses the deadline or refuses to comply without justification faces administrative sanctions, ranging from a warning to a fine of up to two percent of revenue, capped at fifty million reais per violation.

The Nine Rights in Detail

The first right is to obtain confirmation that processing exists. You can ask a company whether it collects, stores or shares data about you. The answer must be straightforward: processing exists or it does not. This right is the gateway to all the others, because without that initial confirmation you would not even know whom to address your follow-up requests to.

The second is the right of access to the data. Once the existence of processing is confirmed, you can request the content of the stored information, including its source, its purpose, how long it will be kept and the entities with which the controller shares it. The third right builds on the second: correction of incomplete, inaccurate or outdated data. This safeguard protects the integrity of the information and prevents decisions based on mistaken records.

The fourth right is the anonymization, blocking or deletion of unnecessary or excessive data, or data processed in violation of the LGPD. It should not be confused with a broad right to deletion. It applies specifically to information collected beyond what is necessary or in breach of the law. The fifth right allows portability of your data to another service or product provider upon express request, subject to trade and industrial secrets.

The sixth right is deletion of data processed on the basis of consent, except where the law allows the data to be retained, such as to comply with a legal obligation, to transfer it to third parties in compliance with data protection rules, or for the controller’s exclusive use in anonymized form. The seventh concerns information about the public and private entities with which the controller has shared your data. This transparency right works against the silent passing of information between companies in the same corporate group or between commercial partners.

The nine rights range from confirming that data is being processed to seeking review of automated decisions that affect the data subject’s interests.

How to Exercise Each Right in Practice

The eighth right is to receive information about the possibility of withholding consent and the consequences of doing so. Before obtaining your consent, the controller must explain what will happen if you refuse: whether the service will be discontinued, whether it will be partially restricted, or whether refusing has no effect on the relationship. The ninth right is withdrawal of consent, which you can exercise at any time by express statement, through a free and accessible procedure.

Secondary regulations have also added the right to review decisions made solely on the basis of automated processing, under Article 20 of the Law. Although it does not appear in the list in Article 18, it is part of the set of prerogatives a data subject may exercise. It is becoming increasingly important as algorithmic systems spread through credit approval, insurance underwriting, hiring processes and consumer profiling.

To exercise any of these rights, you must submit a request to the Data Protection Officer, a role that most controllers are required to designate. The officer’s contact information must appear clearly and accessibly on the company’s website or in its privacy policy. If there is no response, or the response is unsatisfactory, you may file a complaint with the National Data Protection Authority and, depending on the case, bring a lawsuit seeking specific enforcement of the violated right. You may combine that claim with a request for compensation for material or moral damages.

You should make your request in writing, preferably through a channel that generates proof of sending and receipt. Describe clearly which of the nine rights you wish to exercise and provide the identifying information needed to locate your record. Keeping the request number or confirmation is essential if you later need to hold a non-responsive controller accountable, whether administratively or in court.

Frequently Asked Questions

What exactly are the nine rights under Article 18 of the LGPD?

The nine rights are: confirmation that processing exists; access to the data; correction of incomplete or outdated data; anonymization or deletion of unnecessary data or data processed in violation of the law; portability to another provider; deletion of data processed on the basis of consent; information about shared use; information about the possibility of refusing consent and the consequences of doing so; and withdrawal of consent. You can exercise each of them directly against the controller, without first going to court.

How long does the controller have to respond to a data subject’s request?

The Law provides that the response must be given immediately in a simplified format or, in a complete format, within fifteen days of the request, as set by the regulations of the National Data Protection Authority. Missing the deadline is an administrative violation and may lead to sanctions ranging from a warning to a fine. It is also without prejudice to civil liability for any material or moral damages the delay causes the data subject.

Can I request deletion of any personal data a company stores?

No. The deletion right in Article 18 applies to data processed on the basis of consent and is subject to important exceptions, such as the controller’s compliance with a legal or regulatory obligation, transfer to third parties in compliance with the Law’s rules, and the controller’s own exclusive use of the data, provided it is anonymized. Data processed on other legal bases, such as performance of a contract or the regular exercise of rights, follows its own rules and may be kept for as long as the purpose justifying the processing remains.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.