LGPD Compliance (Lei 13.709/2018)

Last verified against official sources: 2026-07-10

When to Use

• Handling personal data (CPF, email, address, phone, IP)
• Processing sensitive data (health, biometrics, race/ethnicity, religion, political opinion)
• Processing children's or adolescents' data
• Implementing consent management
• Designing data retention and deletion policies
• Building user data export or portability features
• Reviewing code for privacy compliance
• Responding to data subject rights requests
• Handling data breach incidents

How to Respond

Key Definitions (Art. 5)

Principles (Art. 6)

All data processing must observe good faith and these principles:

Legal Bases for Processing (Art. 7)

Personal data may ONLY be processed under one of these 10 legal bases:

Consent Requirements (Art. 8)

• Must be written or demonstrable by other means
• Must be for specific purposes (blanket consent is void)
• Must be separate from other contractual clauses
• Can be revoked at any time via simple, free procedure
• If consent changes scope, user must be notified and can revoke
• Burden of proof is on the controller

Legitimate Interest (Art. 10)

When using legitimate interest as legal base:

• Processing only for legitimate purposes based on concrete situations
• Only use strictly necessary data
• Controller must adopt transparency safeguards (data subject rights remain)
• ANPD may request a Data Protection Impact Assessment (DPIA)

Sensitive Data (Art. 11)

Sensitive data requires stricter legal basis:

• Explicit consent from the data subject, for specific purposes; OR
• Without consent only when indispensable for:
  • Legal/regulatory obligation
  • Public administration policies
  • Research (anonymize when possible)
  • Life/safety protection
  • Health protection
  • Fraud prevention

Implementation Rules for Sensitive Data

DO:
- Encrypt sensitive columns at rest (health, biometrics, race/ethnicity)
- Use field-level encryption, not just disk encryption
- Restrict access with RBAC — principle of least privilege
- Log all access to sensitive data for audit
- Get explicit, specific consent before processing

DON'T:
- Store sensitive data in logs, error messages, or URLs
- Use sensitive data for automated decisions without human review
- Share sensitive data with third parties without specific consent
- Store sensitive data longer than necessary

Children's Data (Art. 14)

Processing children's data requires:

• Must be in the child's best interest
• Requires specific, prominent consent from at least one parent/guardian
• Controller must publish information about: types of data collected, how they're used, and how to exercise rights
• Cannot condition participation in games/apps on providing data beyond what's strictly necessary
• Collection without parental consent only to contact parents (single use, no storage) or for child protection

Note: For comprehensive children's data protection, also apply the ECA Digital (Lei 15.211/2025) skill which has additional requirements.

Data Subject Rights (Art. 18)

Data subjects have the right to obtain from the controller, at any time:

Response Deadlines (Art. 19)

Implementation: track every request with received-at timestamp, deadline, and resolution; alert before the deadline expires. Denials must be justified in writing with the legal basis (Art. 18, §4).

Implementation Pattern

# Pseudocode — Data Subject Rights Controller

# Right of Access (Art. 18, II)
def export_user_data(user_id):
    """Return ALL personal data for this user in structured format."""
    return {
        "profile": get_profile(user_id),
        "activity": get_activity_log(user_id),
        "consents": get_consent_records(user_id),
        "third_party_sharing": get_sharing_log(user_id),
        "exported_at": now(),
    }

# Right of Deletion (Art. 18, IV and VI)
def delete_user_data(user_id):
    """
    Soft-delete immediately, hard-delete/anonymize after retention period.
    Keep only what's required by legal obligation (Art. 16, I).
    """
    soft_delete_account(user_id)
    schedule_anonymization(user_id, days=RETENTION_DAYS)
    revoke_all_consents(user_id)
    notify_third_parties_of_deletion(user_id)

Security Requirements (Arts. 46-49)

Technical and Administrative Measures (Art. 46)

Controllers and operators must adopt security measures to protect data from:

• Unauthorized access
• Accidental or unlawful destruction, loss, alteration
• Unauthorized communication or dissemination

These measures apply from the design phase through execution (privacy by design — Art. 46, §2).

Incident Response (Art. 48)

The controller must notify ANPD and affected data subjects when a security incident may cause relevant risk or damage.

Notification must include:

1. Description of the nature of affected personal data
2. Information about affected data subjects
3. Technical and security measures used
4. Risks related to the incident
5. Reasons for any delay (if not immediate)
6. Measures adopted to reverse or mitigate the effects

Deadline: Resolução CD/ANPD nº 15/2024 requires notification within 3 business days of becoming aware of the incident.

Sanctions (Art. 52)

Criteria for Sanctions (Art. 52, §1)

ANPD considers: severity, good faith, advantage obtained, economic condition, recidivism, damage, cooperation, adoption of good practices, adoption of governance policies, prompt adoption of corrective measures, proportionality.

Data Retention (Art. 15-16)

Processing ends when:

• Purpose achieved or data no longer necessary
• End of processing period
• Data subject request (including consent revocation)
• ANPD order

After processing ends, data must be deleted, except for:

• Legal/regulatory obligation to retain
• Research (anonymized)
• Transfer to third party (respecting legal requirements)
• Exclusive use by the controller (anonymized, no third-party access)

Recommended Retention Policy

Anonymization vs. Pseudonymization (Arts. 5, 12, 13)

"Reasonable means" test (Art. 12, §1): consider cost, time, and available technology required for re-identification. If re-identification is cheap and fast, the data is NOT anonymized. Data used for behavioral profiling of an identifiable person is personal data regardless (Art. 12, §2).

Techniques

Anti-Patterns

DON'T:
- Hash CPF (or any low-entropy identifier) without salt/secret — the full CPF
  space can be brute-forced in minutes; the "anonymized" column is reversible
- Call pseudonymized data "anonymous" in the privacy policy — it is still
  personal data under the LGPD
- Store the pseudonymization key/mapping alongside the pseudonymized data
- Release record-level datasets with unique quasi-identifier combinations

DO:
- Use HMAC with a secret key (kept in a separate vault) when you need
  consistent pseudonyms
- Run re-identification tests BEFORE calling any dataset anonymized:
  singling out (can one record be isolated?), linkability (can records be
  linked to another dataset?), inference (can an attribute be deduced?)
- Re-assess anonymization when new external datasets or techniques emerge

Crypto-Shredding Pattern

To fulfill deletion requests (Art. 18) when data lives in immutable stores or backups: encrypt each data subject's data with a per-subject key; deletion = destroying the key. The remaining ciphertext becomes unrecoverable — effectively anonymized without rewriting backups. Document this approach in the retention policy.

Code Review Checklist

When reviewing code that handles personal data:

• No PII in logs — mask CPF, email, names in log messages
• No PII in error responses — generic messages to users, details server-side only
• No PII in URLs — use POST body, not query params for sensitive data
• Legal base documented — each data collection point has a documented legal base
• Consent recorded — timestamp, scope, and method of consent stored
• Consent revocable — simple mechanism to withdraw consent
• Data minimization — only collecting what's needed for the stated purpose
• Access control — users see only their own data; admins have audit trails
• Encryption at rest — sensitive columns encrypted (not just disk-level)
• Encryption in transit — TLS 1.2+ for all connections
• Retention enforced — automated deletion/anonymization when retention expires
• Deletion cascade — account deletion removes data from all systems including backups
• Third-party disclosure — data sharing with third parties documented and consented
• International transfers — cross-border data transfers comply with Art. 33-36

International Data Transfer (Art. 33)

Transfer to other countries or international organizations is only allowed when:

• Country/organization provides adequate protection (recognized by ANPD)
• Controller provides safeguards (standard contractual clauses, binding corporate rules, certifications)
• Specific consent from data subject
• Required for international legal cooperation
• Required to protect life/safety
• Authorized by ANPD
• Required by treaty/convention
• Required for contract execution (at data subject's request)

EU adequacy: Resolução CD/ANPD nº 32/2026 recognizes the EU as providing adequate data protection for international transfers.

References

• Lei 13.709/2018 (LGPD)
• ANPD — Perguntas Frequentes
• Resolução CD/ANPD nº 15/2024 — Comunicação de Incidentes
• Resolução CD/ANPD nº 4/2023 — Dosimetria de Sanções
• Resolução CD/ANPD nº 2/2022 — Agentes de Pequeno Porte
• Resolução CD/ANPD nº 19/2024 — Transferência Internacional
• Resolução CD/ANPD nº 18/2024 — Atuação do Encarregado

See Also

• digital-eca-compliance — Use when processing children's or adolescents' data. ECA Digital (Lei 15.211/2025) adds requirements beyond LGPD Art. 14: age verification, anti-compulsive design, content moderation, penalties up to 10% of revenue.
• lgpd-document-generator — Use when you need to generate compliance documents: privacy policies, terms of use, consent forms, ROPA, cookie policies.
• lgpd-sanctions — Use for risk assessment and understanding ANPD enforcement: dosimetry criteria, fine calculation, real precedent cases, aggravating/mitigating factors.
• marco-civil-compliance — Use when building internet platforms. Marco Civil complements LGPD with data retention obligations (1 year connection logs, 6 months application logs), net neutrality, and provider liability rules.