LGPD: What Counts as Personal Data and What Rights Data Subjects Have

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Law 13.709/2018 (LGPD, Brazil’s General Data Protection Law) builds its protection system on a broad definition of personal data. From that definition, it gives data subjects a set of rights they can enforce against controllers and operators. Understanding how far this concept reaches and what these rights include is essential to grasping the obligations imposed on companies, public agencies, and professionals who handle other people’s information.

What the LGPD Classifies as Personal Data

Article 5, item I, of Law 13.709/2018 defines personal data as “information relating to an identified or identifiable natural person.” The breadth of this definition is deliberate. It covers not only a name, a CPF (Brazil’s individual taxpayer registry number), or a home address, but any element that, alone or combined with others, can be traced back to a specific or identifiable individual.

This includes IP addresses, employee registration numbers, mobile device identifiers, geolocation, and browsing history. The deciding factor is neither the format of the information nor the medium in which it is recorded, whether digital or physical. What matters is its capacity to identify a person.

The law also sets apart sensitive personal data, listed in item II of the same article: data on racial or ethnic origin, religious belief, political opinion, union membership, health, sex life, and genetic or biometric data. This category is subject to stricter treatment. It requires specific legal bases and, as a rule, qualified consent from the data subject.

Data Processing, Controllers, and Operators

The concept of processing is intentionally broad in the LGPD. Article 5, item X, includes every operation performed on personal data: collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation, control, modification, communication, transfer, dissemination, or extraction. The length of this list shows that almost any interaction with personal information falls under the law.

The statute identifies two central players in this chain. The controller is the natural person or legal entity that makes the decisions about processing, setting its purposes and means. The operator is the one who carries out the processing on the controller’s behalf, following the controller’s instructions. Both are answerable for complying with the rules, although to different degrees of civil and administrative liability.

Oversight belongs to the National Data Protection Authority (ANPD), the federal agency responsible for issuing regulations, investigating violations, and imposing sanctions. These range from a warning to a fine of up to 2% of a legal entity’s revenue in its most recent fiscal year, capped at fifty million reais per violation, under Article 52 of the law.

Personal data does not belong to whoever collects it. It belongs to the data subject, and the law provides the tools to make that ownership effective against any controller.

The Data Subject’s Rights and How to Exercise Them

Article 18 of Law 13.709/2018 lists the rights of the personal data subject: confirmation that processing exists; access to the data; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary data or data processed in violation of the law; portability to another provider; deletion of data processed with consent; information about the sharing that has taken place; information about the possibility of refusing consent; and withdrawal of consent at any time.

You can exercise these rights by making a request directly to the controller, who must respond within a reasonable time and free of charge. As a rule, the law prohibits charging for this service. If a request is excessive or made in bad faith, the controller may charge a fee but must justify the decision.

The right to deletion, however, is not absolute. When processing rests on a legal basis other than consent, such as compliance with a legal obligation, the regular exercise of rights in judicial proceedings, or credit protection, the controller may keep the data even after a deletion request. The controller must give the data subject an adequate justification, as provided in paragraph 3 of Article 18.

Frequently Asked Questions

Is any information about a person considered personal data under the LGPD?

Yes, as long as it identifies a natural person or makes that person identifiable. Information that does not single anyone out on its own, but that can identify a person when combined with other data, also falls within the concept set out in Article 5, item I. The test is the capacity to identify, not the intrinsic nature of the information.

Does the LGPD apply only to technology companies or large businesses?

No. The law reaches any natural person or legal entity, public or private, that processes personal data in Brazilian territory, regardless of industry, size, or the medium used. Small businesses, independent professionals, and public agencies are all subject to the same general rules, with some adjustments provided in ANPD regulations for micro and small businesses.

Can a data subject demand deletion of their data at any time?

The right to deletion exists, but the law expressly provides exceptions. When processing is based on a legal or regulatory obligation, on the regular exercise of rights in judicial, administrative, or arbitration proceedings, or on the controller’s legitimate interest, the data may be kept even after a deletion request. In those cases, the controller must tell the data subject which legal basis justifies keeping the data, under Article 18, paragraph 3, of Law 13.709/2018.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.