Personal Data Protection: Your Rights as a Citizen in the Digital Age

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Collecting personal data has become routine for companies and government agencies in nearly every consumer and civic relationship. To balance this reality, Brazilian law gives data subjects a set of rights: you can find out what information has been recorded about you, correct what is wrong, and demand deletion of what is unnecessary. Understanding these safeguards is the first step toward responding when data processing breaks the rules.

What Rights the Law Gives Data Subjects

Brazil’s General Personal Data Protection Law, in force since 2020, builds a series of safeguards around the data subject. The data subject is the individual the data relates to, and who decides, within the limits of the law, how that information may circulate. The starting point is the right to confirm that your data is being processed and, after that, to access what has actually been recorded.

Access lets you learn where the information came from, why it is being processed, and with whom it has been shared. That snapshot opens the door to other rights: correcting incomplete, inaccurate, or outdated data, and having data anonymized, blocked, or deleted when it is processed in violation of the law.

You also have the right to portability, meaning transfer of your data to another service provider on express request, and the right to deletion of data processed on the basis of consent when you decide to withdraw that consent. In addition, you have the right to be informed about the public and private entities with which the controller has shared your data, and the option to withhold consent, with full awareness of the consequences of refusing.

These rights are not merely formal. Each one corresponds to a concrete obligation for whoever collects and uses the data, whether an online store, a bank, a phone carrier, or a public agency. An unjustified refusal to honor a data subject’s request violates the law and can result in liability.

How to Exercise Your Rights in Practice

Exercising your rights begins with identifying the controller, which is the company or agency that decides how the data is processed. The request must be directed to the controller, preferably through a channel that generates proof of submission, such as an email, an official form, or a service ticket number.

Most organizations must appoint a data protection officer (encarregado), who receives complaints and communications from data subjects and serves as the point of contact. Locating this channel, usually listed in the website’s privacy policy, speeds up the response and creates a formal record of your request.

Your request should be clear about which right you are exercising. It is not enough to express dissatisfaction; you should specify whether you want access, correction, deletion, or portability, and describe the data in question. The more specific the request, the less room the company has for evasive answers.

Keeping all of your evidence is essential. Screenshots, ticket numbers, dates, and the content of the responses make up the record that will support a possible administrative complaint or lawsuit. Without this file, proving the company’s failure to act becomes harder.

Keep in mind that, as a rule, honoring a data subject’s rights is free of charge. Charging a fee to give you access to your own data or to correct it runs against the protective purpose of the law, and you should challenge it right away.

The data subject is the individual the data relates to, and who decides, within the limits of the law, how that information may circulate.

Where to Turn in Case of Misuse

When the controller ignores your request, responds unsatisfactorily, or uses your data abusively, you have more than one path. The first is to file a complaint with Brazil’s National Data Protection Authority, the agency responsible for monitoring compliance with the law and imposing administrative penalties, which range from a warning to a fine.

The authority’s work does not replace the courts. If you suffer financial or moral damages because of irregular data processing, you can seek compensation in court. The law provides that processing agents are liable for the damages they cause, and in certain situations liability is assessed strictly, with the burden on the provider to show that it acted properly.

In consumer relationships, consumer protection agencies can also be called in, especially when the misuse of data overlaps with practices such as debt collection based on irregular registries or unauthorized sharing with business partners. The Public Prosecutor’s Office (Ministério Público), for its part, protects collective interests when a violation affects a large number of people.

Which path to take depends on your goal. If you want to correct a practice and see the company penalized administratively, you will tend to start with the regulatory authority; if you suffered concrete harm and want to be compensated, you turn to the courts. Nothing prevents you from combining the two, since they address different aspects of the same problem.

Deadlines, Free Access, and Practical Precautions

The law sets deadlines for the controller to respond to data subjects’ requests. A request to confirm processing and obtain access, for example, calls for an immediate response in a simplified format and a more complete one within a period set by regulation. Missing these deadlines strengthens the case that the controller failed to act.

Free access is the rule, and making it easy to exercise your rights is a principle that guides the entire application of the law. Artificial barriers, such as requiring you to appear in person without need or imposing incomprehensible forms, can be treated as an obstacle to the data subject’s rights.

For public agencies, the logic is similar, with some adaptations. Government bodies also process personal data and are bound by obligations of transparency and purpose, except in specific cases involving public safety and criminal investigation, which follow their own rules. Citizens keep the right to know how the government uses their data.

Frequently Asked Questions

What should I do if the company does not respond to my request for access to my data?

The first step is to gather proof of your request, such as ticket numbers and dates, and repeat the request through the data protection officer’s channel. If the silence continues, you can file a complaint with the regulatory authority and, if you have suffered harm, consider filing a lawsuit. The lack of a response is, in itself, a relevant element in showing that the law was violated.

Can I demand deletion of all my data at any time?

Not always. The right to deletion applies mainly to data processed on the basis of consent, which can be withdrawn. In some situations, the company or public agency is legally required to keep certain records, for example to comply with a legal obligation or to exercise rights in legal proceedings. In those cases, a refusal to erase everything may be legitimate, as long as it is properly justified.

Who is the data protection officer, and how do I find them?

The data protection officer (encarregado) is the person the organization designates to act as the communication channel between the organization, data subjects, and the regulatory authority. Their contact information is usually in the privacy policy of the website or app. Sending your request to this channel makes it more formal and makes it easier to prove that you tried the proper route before turning to outside bodies.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.