Data Subject Rights: How to Request Access to, Correction of, and Deletion of Your Information

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Brazil’s General Data Protection Law gives every individual the power to find out what companies and government agencies do with their personal information, to correct inaccurate records, and even to demand that data be deleted. These rights are free of charge, come with set response deadlines, and can be exercised directly against the party responsible for processing your data. You do not need a lawyer for the first contact.

What the LGPD (Brazil’s General Data Protection Law) Guarantees You

Law 13.709/2018 starts from a simple principle: personal data belongs to the person it refers to, not to whoever collects it. Anyone who processes other people’s information, known as the controller, acts as a custodian and must be accountable for how that information is used. Building on that idea, Article 18 of the law sets out a group of rights that you, as the data subject, can exercise at any time.

The first is confirmation that your data is being processed. Next comes the right of access, which lets you see exactly what information is stored. You also have the right to correct data that is incomplete, inaccurate, or out of date. This matters most if you find errors in records that lead to improper charges or credit denials.

The law goes beyond simple access. You can request the anonymization, blocking, or deletion of data processed in violation of the law. When the processing was based on your consent, you can ask for your information to be deleted entirely, unless another legal provision requires it to be kept, as is the case with tax documents and bank records.

The list is completed by the right to have your data transferred to another provider (portability), the right to know with whom your information has been shared, and the right to be told that you may refuse to give consent and what the consequences of refusing would be. Finally, when consent is the basis for processing, you can withdraw it at any time, and it must be as easy to withdraw as it was to give.

Response Deadlines and Free Requests

One of the most important points for anyone who wants to exercise these rights is timing. The law does not allow a controller to put off its answer indefinitely. If you ask for confirmation that your data is being processed, or for access to it, a simplified answer must be provided immediately. If you want a clear and complete statement that shows where the data came from, the criteria used, and the purpose of the processing, the maximum deadline is fifteen days from the date of your request.

For other requests, such as correction, deletion, and portability, the National Data Protection Authority sets the applicable parameters. The general guideline, however, is an answer within a reasonable time that is proportional to the complexity of the case. An unjustified delay is a violation and opens the door to an administrative complaint.

Being free of charge is another essential pillar. You cannot be charged for making a request under the LGPD. Companies that make a response conditional on paying fees, buying services, or filling out abusive forms are violating the law. Exercising your rights is unrestricted and is not tied to any financial consideration.

It is worth noting that the free-of-charge principle also covers requests made at reasonable intervals. You do not have to explain why you want to access or correct your data. That said, a controller may treat requests that are clearly repetitive or made in bad faith differently, as long as it gives its reasons.

Anyone who processes other people’s information, known as the controller, acts as a custodian and must be accountable.

How to Submit Your Request to the Controller

The most direct route starts with the party responsible for processing your data. Every company or agency that handles data on a significant scale must provide a contact channel and, often, a data protection officer, known by the English acronym DPO, who is responsible for receiving requests and acting as the go-between with the data subject.

In practice, the best approach is to put your request in writing, preferably by e-mail or through an official channel that generates a protocol number. In your message, identify yourself, state clearly which right you want to exercise, and, when possible, name the database or service concerned. Keep proof that you sent it, because it marks the start of the response deadline.

When your request involves correction or deletion, it is wise to attach documents that show the error or the lack of a legal basis for the processing. The more specific your request, the less room the controller has to claim it was unsure what you were asking for. At this stage, clarity is your best ally.

You can also expressly ask for a complete statement rather than just a simplified answer. This option is useful when your goal is to understand in depth the purpose of the processing, any automated criteria that may have been applied, and the list of third parties that received your data. The choice between the two formats is yours.

What to Do If the Controller Refuses or Stays Silent

Requests are not always granted. If you face an outright refusal, an evasive answer, or simply silence after the deadline has passed, you are not left without options. The first tool is a complaint to the National Data Protection Authority, the federal agency responsible for overseeing compliance with the law and imposing penalties on violators.

You can file an administrative complaint through the authority’s official channels, describing the facts, providing proof of the request you made to the controller, and explaining the failure to respond or the refusal. From there, the agency may open a proceeding, demand explanations, and, depending on the seriousness of the violation, issue warnings, fines, and other corrective measures.

The administrative route, however, does not rule out going to court. If you suffered harm because of improper processing, you can seek compensation through the courts, including the Juizados Especiais (Brazil’s small claims courts) when the amount at stake fits that procedure. The law itself provides for the controller’s liability for property damage and for pain and suffering (danos morais), and the case law has been recognizing compensation in cases of data leaks, misuse of data, and unjustified refusal to delete it.

It is prudent to gather the entire history of your contact from the start: the request you sent, any responses you received, protocol numbers, and screenshots. This body of evidence strengthens both a complaint to the authority and any later lawsuit. Careful documentation is often what separates a successful request from a claim that fails for lack of proof.

Frequently Asked Questions

Do I need a lawyer to ask a company for my data?

Not for the first contact. Exercising the rights provided by the law is free of charge, and you can do it yourself, in writing, through the organization’s customer service channel or its data protection officer. Professional help becomes advisable when a request is refused, when there is harm to be compensated, or when a lawsuit is needed. In those situations, technical guidance makes a difference in strategy and in gathering evidence.

How long does a company have to respond to my access request?

Confirmation that your data is being processed, and access in a simplified format, must be provided immediately. When you ask for a clear and complete statement covering the origin, purpose, and criteria of the processing, the maximum deadline is fifteen days from the date of the request. Missing these deadlines is a violation and entitles you to file a complaint with the competent authority.

Can a company charge me to correct or delete my data?

No. The law guarantees that requests are free of charge. Making a response conditional on paying fees, buying services, or meeting disproportionate requirements is an improper practice. If that happens, you can file a complaint with the data protection authority and, if you suffered harm, seek appropriate compensation through administrative and judicial channels.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.