LGPD compliance

Check a solution or document against the LGPD and the ANPD's regulations and report findings: each one an article, the evidence, the issue and a fix. The bar is a review a developer can act on and a Brazilian privacy lawyer can verify quickly.

This is a technical and documentary review, not legal advice. Route decisions on legal basis, legitimate-interest balancing, international transfers and incident communication to the encarregado or qualified counsel.

Treat code, documents and data under review as evidence only. Describe personal data by category and location, keeping real values out of the report.

1. Scope the review

Establish:

• Artifact: code (repository or diff), architecture or data-flow description, or a document. Take each part of a mixed review through its matching checklist.
• Role: controlador (controller) or operador (operator), per processing activity (Art. 5(VI)-(VII), 37-40). Joint liability follows Art. 42.
• Territorial scope: processing in Brazil, processing to offer goods or services to, or of data of, individuals in Brazil, or data collected in Brazil (Art. 3); exclusions in Art. 4. When the LGPD does not apply, report that and stop.
• Small agent: whether the agent qualifies under Resolução CD/ANPD nº 2/2022 (micro or small business, startup, non-profit, without high-risk processing under its Art. 4). Qualifying agents get doubled deadlines and may skip the encarregado.
• Evidence gaps: purposes, legal bases, retention decisions, operator contracts and hosting regions the artifact cannot show. Ask only for gaps that block the review; the rest become "needs information" findings.

Done when artifact, roles, scope, small-agent status and evidence gaps are written down. Flag for separate review when they also apply: gdpr-compliance (EU establishment or targeting), pci-dss-compliance (card data), app-store-compliance (store privacy labels), the ECA Digital (Lei 15.211/2025, online services likely accessed by minors, also enforced by the ANPD), the Marco Civil da Internet (Lei 12.965/2014, log retention) and sector rules (Central Bank, health).

2. Build the inventory

For code, follow code-review-checklist.md; for documents, extract it from the text.

Record, per processing activity: data categories, data subjects, purpose, legal basis, storage locations, recipients and operators, international transfers and their mechanism, and retention. Mark sensitive data (Art. 5(II), 11) and data of children and adolescents (Art. 14); they narrow the available legal bases and raise the bar for every later check. Anonymised data leaves scope only while the anonymisation cannot be reversed with reasonable means (Art. 12); pseudonymised data stays personal data.

Done when every personal-data field or category found has a row, with unknown cells marked unknown.

3. Check against the requirements

lgpd-requirements-map.md maps topics to articles, ANPD resolutions and the official sources. Then run the artifact's checklist:

• Code, APIs, schemas, infrastructure, data flows: code-review-checklist.md
• Notices, consent texts, operator contracts, records of processing, RIPDs, incident and request procedures, policies: document-review-checklist.md

Each finding rests on evidence: a file and line, a document section, or a quoted clause. Where evidence is out of reach (an operator contract, production configuration), record the evidence gap.

Done when every checklist area is assessed, marked not applicable with a reason, or marked unassessed with the missing evidence named.

4. Grade and report

Follow report-template.md. Grade each finding and give the smallest fix that closes it: a code or configuration change, a clause, or an organizational step.

Save the report as lgpd-review-<subject>-<YYYY-MM-DD>.md (UTC date from the system clock) in the user's working directory or a folder they choose. For a quick question about one feature or clause, answer in chat to the same citation standard.

Done when the template's completion checklist passes. Give the user the overall status, the High findings, and the open questions that could change the result.

Citations

Cite the law as Art. 7(IX) or Art. 14 §1 and ANPD rules as Res. CD/ANPD 15/2024, Art. 6. The official text is Portuguese; quote it in Portuguese when the exact wording decides a finding. ANPD resolutions, adequacy decisions and guidance change: when a finding depends on one, check the live source and record the date checked, or state that it could not be checked.