This dated narrative contains pending corrections. Read the notes, then expand the original text.
SettleADebt C_BR PASS-08 — Brazil
Distinct component: LGPD role, purpose/legal-basis, and data-subject access, correction, deletion and objection gateway for generic debt-information services.
Baseline: October 22, 2026, America/Los_Angeles.
Fresh source-access dates: October 26, 2026 PDT / October 27, 2026 UTC. Individual source-open clock times were not logged and remain unknown. No inferred source-access interval is used.
Status: Narrow federal research report with continuing publication, contract, provider, sector, territorial and country holds.
PASS-04 through PASS-07 remain saved but unreviewed. None of their consumer-contract, prescription, negative-register or Cadastro Positivo conclusions is adopted as an accepted premise. This pass independently reads the general LGPD gateway and only identifies sector-specific credit-data regimes as separate unresolved branches.
No actual person, company, creditor, debt adviser, database, report, score, consent, rights request, licence or private record was searched.
Executive determination
- The LGPD protects personal data relating to natural persons. It does not directly turn purely corporate information into “personal data,” although a business file can contain personal data about proprietors, directors, employees, guarantors or contacts. The current compiled LGPD defines titular as the natural person to whom the personal data relate. C_BR-P08-C001–C009. Planalto
- Role labels follow actual decision-making, not brand names. A controller determines the purposes and essential elements of a processing operation; an operator processes data on the controller’s behalf and instructions. The same organization can be controller for one operation and operator for another. Employees acting under their organization’s direction are ordinarily not separate operators. C013–C020. Serviços e Informações do Brasil+1
- Not all processing requires consent. For ordinary, nonsensitive personal data, potentially relevant bases include consent, compliance with a legal or regulatory obligation, contract or precontractual steps requested by the data subject, regular exercise of rights in judicial, administrative or arbitral proceedings, legitimate interest, and credit protection. Each basis has distinct predicates; the existence of a debt does not make every collection, reuse, enrichment, disclosure or marketing operation lawful. C026–C041. Planalto+1
- Consent is neither universal nor casual. Where relied upon, the controller bears the burden of proving a valid manifestation tied to determined purposes. Generic authorization is void; revocation must be free and facilitated. Revocation does not retroactively invalidate prior lawful processing and does not always compel destruction where an art. 16 retention exception or another independently valid operation applies. C033–C038, C047, C058–C059. Planalto+1
- Legitimate interest requires a concrete, purpose-specific analysis. It requires a legitimate interest, strict necessity, respect for the data subject’s reasonable expectations, transparency and a balance against fundamental rights. The ANPD’s guidance says the assessment should be repeated for each distinct purpose and should not be used if the subject’s rights and freedoms prevail. Legitimate interest under art. 7(IX) is an ordinary-data basis, not a general sensitive-data basis. C031, C039–C040. Planalto+3
- Data-subject rights are not all deletion rights. Confirmation, access, correction, anonymization/blocking/deletion of unnecessary, excessive or unlawfully processed data, consent-based deletion, portability, sharing information, revocation and qualified objection are separate rights with different predicates. An accurate debt datum lawfully retained under a valid purpose is not automatically deletable merely because the person would prefer it removed. C043–C059. Planalto+1
- **LGPD access has two express response forms.**Simplified confirmation/access: immediately.Clear and complete statement: within 15 days of the request, stating origin, absence of record where applicable, criteria and processing purpose, subject to trade secrets.The data subject chooses secure electronic delivery or paper. Other art. 18 rights are to receive immediate action where possible; where immediate action is impossible, the controller must explain why or identify the actual agent where possible. The reviewed current ANPD materials do not supply one generic fixed non-immediate deadline for every other art. 18 right. C050–C057, C071. Planalto+3
- Deletion remains subject to termination and retention rules. Processing can terminate when its purpose is achieved, the data cease to be needed, the period ends, consent is withdrawn subject to public interest, or the ANPD determines a violation. After termination, retention remains authorized for legal or regulatory obligations, protected research, compliant third-party transfer or the controller’s exclusive anonymized use. C047, C058–C059. Planalto+1
- Automated-decision review does not currently guarantee human review or credit approval. Article 20 permits a request to review a decision based solely on automated processing that affects the person’s interests, including credit profiling. The controller must provide clear and adequate information about criteria and procedures, subject to trade secrets. The current enacted text does not expressly promise that a human must perform the review, that the result must change, or that credit must be approved. C060–C062. Planalto+1
- Small-agent deadline relief is limited and conditional. Merely calling a company small does not establish eligibility. High-risk processing, revenue limits and economic-group limits can remove most differentiated treatment. A qualifying small agent may provide a simplified art. 19(I) statement within up to 15 days, and receives twice the ordinary 15-day period—30 days—for the complete art. 19(II) statement. The doubled period for other art. 18 requests depends on specific regulation; it is not a universal automatic 30-day rule. C063–C068. Serviços e Informações do Brasil+3
- LGPD compliance is not a provider licence. The ANPD says it does not recognize or accredit organizations as approved LGPD advisers or certification providers. A data-processing basis cannot supply OAB, financial, payment, debt-collection, professional or consumer-contract authority. C041, C072. Serviços e Informações do Brasil
G1. Operative current text, scope and actors
G1.1 Currentness and commencement crosswalk
| Instrument |
Material effect actually read |
Operative/currentness result |
| Lei 13.709/2018 — LGPD, current compiled text |
Current definitions, scope, principles, ordinary-data bases, consent, transparency, termination, retention, rights, automated decisions, agent duties and ANPD powers. |
Primary operative body for this pass. The current compilation reflects amendments through the 2026 agency changes. Planalto+1 |
| Lei 13.853/2019 |
Recast material definitions and rights, created the then-Autoridade Nacional, added current art. 18 §6 and revised art. 20. |
Effective on publication for its own provisions; historical amendment body, not substituted for the current compilation. Planalto+1 |
| General substantive LGPD commencement |
Current ANPD official guidance records September 18, 2020 for the general substantive provisions other than administrative sanctions. |
Used as the operative commencement statement. The earlier legislative vacatio chronology is not converted into a different current date. Serviços e Informações do Brasil |
| Lei 14.010/2020 |
Set August 1, 2021 for LGPD arts. 52–54 administrative sanctions. |
Sanctions commencement only; full sanctions procedure is deferred. Planalto |
| Lei 15.352/2026 |
Updated the LGPD to refer to the Agência Nacional de Proteção de Dados, adjusted definitions and transformed the institutional structure. |
Effective on its February 25, 2026 publication date. Planalto+1 |
| Resolução CD/ANPD 2/2022, consolidated official page |
Small-agent definitions, exclusions, high-risk test, channels and differentiated deadlines. |
Effective on DOU publication, January 28, 2022; current page incorporates the 2024 amendment. The page’s September 2026 modification date is not commencement. Serviços e Informações do Brasil |
| Current ANPD regulations catalogue |
Lists current ANPD resolutions and their statuses. |
Used as a bounded current-regulation inventory, not proof that an unlisted rule never existed. Serviços e Informações do Brasil |
C_BR-P08-C001. The current compiled LGPD is the controlling federal general body examined. The general substantive provisions are treated as operative from September 18, 2020; administrative sanctions from August 1, 2021; and the 2026 agency amendments from publication on February 25, 2026. Full historical MP/vacatio reconstruction is unnecessary to classify the current rights but remains outside this narrow report. Serviços e Informações do Brasil+2
G1.2 Definitions and person scope
| Term |
Current statutory meaning |
Narrow consequence |
| Dado pessoal |
Information relating to an identified or identifiable natural person. |
A debt amount, account identifier, contact detail, payment status or call note can be personal data where linked or linkable to an individual. |
| Dado pessoal sensível |
Listed categories including racial/ethnic origin, religion, political opinion, union affiliation, health, sexual life, genetic and biometric data linked to a natural person. |
Ordinary-data legal bases cannot be assumed to cover these data. Full sensitive-data analysis is deferred. |
| Dado anonimizado |
Data relating to a subject who cannot be identified using reasonable and available technical means. |
Merely removing a name is not automatically anonymization. Reidentifiable data remain within the LGPD. |
| Titular |
The natural person to whom the data relate. |
A corporation is not an LGPD titular, although personal data in its file can belong to individuals. |
| Controlador |
Natural or legal person, public or private, competent to make decisions concerning processing. |
Role follows actual decision authority for each operation. |
| Operador |
Natural or legal person processing personal data on behalf of the controller. |
A contractor is not automatically an operator if it decides its own purposes. |
| Tratamento |
Broad list of operations including collection, receipt, classification, use, access, storage, alteration, communication, transfer, dissemination and deletion. |
Intake, CRM entry, call recording, debt matching, document upload, lead referral and profile creation can each be separate processing operations. |
C002–C009. The LGPD protects data concerning natural persons. Pure company-level data fall outside that definition, but company debt records can simultaneously contain protected information about a sole proprietor, partner, director, employee, contact, guarantor or joint debtor. Planalto
Anonymization boundary
C005. Anonymized data are outside the ordinary personal-data regime only while identification cannot be reversed using reasonable and available means. Data used to form an identifiable natural person’s behavioral profile can still be personal data. Pseudonymization or removal of one identifier is not necessarily anonymization. Planalto
G1.3 Territorial triggers and exclusions
The LGPD applies where:
- the processing operation occurs in Brazil;
- processing aims at offering or supplying goods or services to individuals located in Brazil, or processing data of individuals located in Brazil; or
- the personal data were collected in Brazil.
It does not apply to personal processing for exclusively private and noneconomic purposes, and has distinct exclusions for journalism, art, academics and specified public-security/state activities. A commercial debt-information service does not become “private and noneconomic” merely because one employee or founder handles the data personally. C010–C012. Planalto+1
Foreign incorporation, foreign hosting or remote calls do not provide an automatic LGPD exemption. The exact territorial nexus still depends on processing locations, target individuals, collection location, offerings and data flows. Full international-transfer and recognition analysis is deferred.
G1.4 Publicly accessible data
C012, C038. Personal data accessible to the public remain protected:
- their processing must consider the purpose, good faith and public interest that justified the original availability;
- data manifestly made public by the subject may be processed without consent, but rights and principles remain;
- no-consent processing does not remove the other LGPD duties; and
- later reuse must have legitimate, specific purposes and preserve the subject’s rights.
The existence of a court page, public filing, social-media post, professional directory or public phone listing is therefore not a universal licence to build a debt profile, enrich marketing data or distribute a dossier. Planalto
G1.5 Role classification by actual operation
ANPD guidance is interpretive and nonbinding, but it supplies a useful functional approach:
- the organization, rather than each subordinate employee, is normally the agent;
- the same organization may be controller for one processing operation and operator for another;
- the operator must be a distinct person from the controller and acts within the controller’s purposes and instructions;
- joint control is contextual and may arise where two or more parties participate in determining purposes and essential means. C013–C020. Serviços e Informações do Brasil+2
| Hypothetical actor |
Possible role |
Controlling distinction and adverse branch |
| Debtor-side information service |
Usually controller for its own intake, service design, requested analysis, retention, billing and communications where it determines purpose and essential means. |
It may be an operator for a separate white-label function performed solely under another controller’s instructions. No actual SettleADebt classification is made. |
| Creditor or debt purchaser |
Typically controller for debt-account, servicing, collection-strategy and disclosure decisions it determines. |
A creditor’s contractor may be operator for instructed servicing but an independent controller for its own fraud, billing, employment or marketing operations. |
| Collector/call centre |
Operator where it processes only under a creditor-controller’s defined purpose and instructions. |
It becomes a controller for an operation if it determines an independent purpose such as its own lead resale or unrelated profiling. |
| Credit bureau or database manager |
Likely controller for database purposes and essential means it determines; sector law remains separate. |
Detailed negative-register, positive-register and score rules are not recertified here. |
| Software/hosting provider |
Operator where it merely hosts or processes under documented instructions. |
If it reuses data for its own product analytics, advertising, model training or resale, that reuse requires separate controller and legal-basis analysis. |
| Employee or internal team |
Ordinarily acts under the organization’s direction rather than as an independent controller/operator. |
An external professional making independent purpose decisions may be different. |
| Consumer’s representative |
Exercises rights for the data subject if legally constituted. |
Family relationship, possession of documents or a general assertion of authority is not itself proof. |
| Public authority |
Controller or public processing body under arts. 7(III) and 23 when executing statutory public functions. |
Public-body rights procedures use specific legislation and are not presumed identical to private-controller deadlines. |
| Two commercial participants |
Independent controllers or joint controllers depending on whether they separately or jointly decide purposes and essential means. |
A contract label such as “processor” is relevant but not conclusive if actual conduct differs. |
C016–C020. No private contract is available, so none of these actors is assigned a definitive role. A single business can have several roles across intake, servicing, hosting, analytics, marketing and regulatory retention.
G2. Ordinary-data purpose and legal bases
Primary body: Lei 13.709/2018, arts. 6–10
Literal URL: https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709compilado.htm
G2.1 Principles apply regardless of legal basis
Every legal basis remains bounded by:
- purpose: legitimate, specific, explicit and informed purposes;
- adequacy: compatibility with the disclosed purpose and context;
- necessity: minimum relevant, proportional and nonexcessive data;
- free access and quality: facilitated access and accurate, clear, relevant and updated data;
- transparency: clear information about processing and agents, subject to legitimate commercial and industrial secrets;
- security and prevention;
- non-discrimination;
- accountability: demonstrable effective compliance measures.
C022–C025. A controller cannot cure an excessive or incompatible operation merely by naming a legal basis. Planalto+1
G2.2 Material ordinary-data bases
| Basis |
Exact predicate |
Potential narrow debt-information use |
Principal limitation |
| Consent — art. 7(I) |
Valid, provable manifestation for determined purposes. |
Optional marketing, optional data enrichment or another operation genuinely offered as a choice. |
Consent must not be generic, coerced or used to conceal a processing operation that is actually mandatory. Revocation must be free and facilitated. |
| Legal or regulatory obligation — art. 7(II) |
Actual legal or regulatory duty imposed on the controller. |
Keeping legally required accounting, tax, regulatory or transaction records. |
The controller must identify the actual rule and retain only the data required for it. “Compliance” is not a free-floating basis. |
| Public policy — art. 7(III) |
Public administration treatment necessary to execute a policy in law/regulation or supported by specified instruments, subject to Chapter IV. |
Government debt programme or public assistance administration where the exact public mandate exists. |
Not a private debt-service basis and not a generic public-interest claim. |
| Contract/precontract — art. 7(V) |
Processing necessary to perform a contract with the subject or preliminary steps related to it at the subject’s request. |
Debtor-provided information needed to prepare a requested budget, match documents, communicate with authorized creditors or deliver a requested report. |
Does not automatically cover unrelated marketing, resale, broad model training or retention after the contractual purpose ends. |
| Regular exercise of rights — art. 7(VI) |
Necessary for rights in a judicial, administrative or arbitral proceeding. |
Maintaining evidence or records needed for an actual claim, defense or proceeding. |
It does not expressly create a general extrajudicial collection basis for every call or data disclosure. |
| Legitimate interest — arts. 7(IX), 10 |
Concrete legitimate interest; necessity; legitimate expectations; rights do not prevail; transparency and safeguards. |
Limited fraud prevention, service integrity, internal operational analysis or narrowly tailored communications where the balance supports them. |
Not available merely because processing is commercially useful. Ordinary data only under this basis; each purpose requires its own analysis. |
| Credit protection — art. 7(X) |
Processing genuinely for credit protection, including relevant sector legislation. |
Credit-risk and credit-protection operations within an applicable lawful regime. |
Not an all-purpose debt-data exemption, not an adviser licence and not a substitute for the sector’s own notice, access, correction or duration rules. |
C026–C032. These bases are alternatives, not a cumulative checklist and not a permission to select whichever sounds easiest after processing has begun. The controller must identify the basis appropriate to each purpose and operation. Planalto+1
Bases ordinarily outside this narrow commercial gateway
Research, life-protection and health-treatment bases exist in art. 7, but they are not treated here as ordinary foundations for a generic debt-information service. Invoking one would require its actual statutory facts. Sensitive data follow art. 11’s separate regime and are deferred.
G2.3 Consent requirements
Where consent is the chosen basis:
- written consent must be highlighted from other contract clauses;
- another form may be used if it demonstrates the subject’s will;
- the controller bears the proof burden;
- consent obtained through a defect of will is prohibited;
- consent must concern determined purposes;
- generic authorizations are void;
- changes to material information or an incompatible purpose require specific notice and a revocation opportunity;
- revocation must be express, free and facilitated; and
- prior processing remains ratified while it was supported, unless a valid deletion request and applicable deletion rule alter the future handling.
C033–C036. A signature on a debt-services contract is not automatically consent to every data operation described elsewhere in a privacy policy. Planalto+1
If consent is the basis for sharing data with another controller, art. 7 §5 generally requires specific consent unless another consent-exempt basis actually applies. C036–C037. Planalto
G2.4 Contract basis
C029. Contract or requested precontract steps support only data necessary to perform the subject’s contract or requested preliminaries.
For an independent debtor-side service, that could conditionally include:
- identity and contact information needed to communicate;
- creditor and account identifiers supplied for the requested analysis;
- balances, dates and documents needed to prepare a requested budget or negotiation packet; and
- records necessary to perform an expressly requested communication.
It does not automatically include:
- sale of leads;
- unrelated product marketing;
- indefinite retention;
- enrichment from unrelated public or purchased sources;
- disclosure to an unrequested lender;
- development of an unrelated commercial profile; or
- use of documents to train a broadly reusable model.
Each added purpose requires its own adequacy, necessity, transparency and legal-basis analysis.
G2.5 Regular exercise of rights
C030. Article 7(VI) covers judicial, administrative and arbitral proceedings. It may support retaining or using relevant evidence for an actual claim or defense, but it is not phrased as a blanket basis for every extrajudicial collection or negotiation operation. Planalto
A real application would require:
- the right or proceeding;
- whose right is exercised;
- why each datum is necessary;
- the anticipated or actual procedural context; and
- the retention period connected to that right.
G2.6 Legitimate interest
Article 10 requires concrete legitimate purposes and allows consideration of:
- support and promotion of the controller’s activities; and
- protection of the regular exercise of rights or provision of services benefiting the subject, respecting legitimate expectations and fundamental rights.
Only strictly necessary data may be processed, and transparency measures are mandatory. ANPD may request a data-protection impact report. C031, C039. Planalto
The ANPD’s 2024 nonbinding guide recommends a purpose-specific balancing test covering:
- legitimacy and specificity of the interest;
- necessity and less-intrusive alternatives;
- impact on rights and reasonable expectations; and
- safeguards and transparency.
The guide says processing should not proceed under legitimate interest where the subject’s rights and freedoms prevail. It also treats art. 7(IX) as a basis for nonsensitive personal data. C040. Serviços e Informações do Brasil+4
A balancing template published by ANPD is optional, not binding. Serviços e Informações do Brasil
G2.7 Credit protection
C032. Credit protection is an express art. 7(X) basis, but:
- the processing must genuinely concern credit protection;
- the sector’s own law still matters;
- art. 6 principles and art. 18 rights remain;
- the basis does not validate inaccurate or excessive data;
- it does not automatically authorize marketing, unrelated profiling or public disclosure;
- it does not eliminate correction or qualified objection rights; and
- it does not make a debt adviser a credit bureau, creditor, lender or licensed financial service. Planalto
The negative-register, Cadastro Positivo, score and SCR details are separate unreviewed branches and are not restated here.
G2.8 Public-source reuse
C038. A debt service that obtains personal data from a public webpage must still record:
- the original context and purpose of availability;
- the new concrete purpose;
- the legal basis for the new operation;
- why the use is compatible and necessary;
- what the subject is told;
- source reliability and update procedures;
- whether the source imposed lawful access conditions; and
- whether sensitive, excessive or third-party data are involved.
Public access does not convert data into ownerless information. Planalto
G2.9 Data-law basis is not substantive business permission
C041–C042. An LGPD basis answers only why a particular personal-data operation may occur. It does not answer whether the underlying activity—legal advice, debt negotiation, collection, payment handling, credit intermediation, lending or professional consultancy—is authorized.
ANPD expressly states that it does not accredit or recognize organizations as approved providers of LGPD consulting or compliance certification. Serviços e Informações do Brasil
G3. Data-subject rights and request route
Primary body: Lei 13.709/2018, arts. 9 and 15–20
Literal URL: https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709compilado.htm
G3.1 Transparency before a request
Article 9 requires facilitated, clear, adequate and prominent information concerning:
- the specific purpose;
- processing form and duration;
- controller identity and contact details;
- sharing and its purpose;
- agent responsibilities; and
- data-subject rights.
Where data processing is a condition of a service or right, that fact and the rights channels must be highlighted. C042. Planalto+1
G3.2 Rights matrix
| Right |
Actor owing the substantive duty |
Predicate |
Required response or act |
Express timing |
Exception or limit |
| Confirmation of processing |
Controller |
Express request by subject or legally constituted representative |
Confirm whether processing exists |
Simplified response immediately; complete statement within 15 days |
Small-agent variation below |
| Access |
Controller |
Same |
Provide the subject’s personal data and required information |
Same art. 19 alternatives |
Trade secrets limit some criteria; identity verification still needed |
| Correction |
Controller |
Data incomplete, inaccurate or outdated |
Correct the data |
Immediate action where possible; no one generic fixed non-immediate deadline identified |
If immediate action impossible, explain factual/legal reason |
| Anonymization, blocking or deletion |
Controller |
Data unnecessary, excessive or processed contrary to LGPD |
Apply appropriate measure |
Immediate action where possible; otherwise reasoned response |
Not a right to erase every accurate, lawfully processed datum |
| Portability |
Controller |
Express request |
Transfer to another service/product supplier |
Subject to ANPD regulation |
Excludes already anonymized data; trade secrets preserved; detailed mechanism held |
| Consent-based deletion |
Controller |
Data processed on consent and deletion requested |
Delete, subject to art. 16 |
No universal fixed deadline identified beyond immediate-action framework |
Art. 16 retention exceptions |
| Sharing information |
Controller |
Request |
Identify public/private entities with which the controller shared data |
Immediate action framework; complete access may carry 15-day statement |
Exact scope depends on actual sharing |
| Information about refusing consent |
Controller |
Consent requested |
Explain that consent is optional where truly optional and consequences of refusal |
Before or with consent request; art. 18 request also available |
Must not misdescribe mandatory processing as optional |
| Consent revocation |
Controller |
Express manifestation |
Stop future consent-based processing through free, facilitated procedure |
No fixed completion period identified; immediate-action framework |
Prior lawful processing remains; other independent bases/retention may continue |
| Qualified objection |
Controller |
Processing uses a consent-exempt basis and violates LGPD |
Assess objection and stop or correct noncompliant processing |
Immediate-action framework; non-immediate general deadline pending regulation |
Not an unconditional “opt out of any lawful processing” |
| Automated-decision review |
Controller |
Decision made solely through automated processing and affects interests |
Review decision and provide criteria/procedure information when requested |
No general art. 20 review deadline in the examined LGPD text |
Trade secrets; ANPD audit power; no guaranteed human review |
| Downstream propagation |
Controller/responsible agent |
Correction, deletion, anonymization or blocking made after sharing |
Notify sharing agents immediately so they repeat it |
Immediately |
Proven impossibility or disproportionate effort |
| Petition before ANPD |
ANPD after controller stage |
Unresolved request previously presented to controller |
Regulatory petition may be presented |
Regulatory process, not an automatic individualized remedy |
ANPD may analyze petitions in aggregate |
C043–C061. Planalto+3
G3.3 Confirmation and access
C043, C053–C056.
The data subject may choose:
- Simplified statement — immediately, or
- Clear and complete statement — within 15 days from the request.
The complete statement must identify:
- origin of the data;
- absence of a record, where applicable;
- criteria used; and
- processing purpose,
subject to commercial and industrial secrets.
Delivery is, at the data subject’s choice:
- secure and suitable electronic means; or
- paper.
Where processing originates in consent or contract, the subject may request a full electronic copy in a reusable format, subject to ANPD regulation and trade secrets. That detailed copy/portability mechanism is not treated as fully regulated here. Planalto+1
G3.4 Correction
C044, C050–C051, C057.
A person may request correction of incomplete, inaccurate or outdated data. The controller should act immediately where possible. If it cannot:
- it must state that it is not the relevant agent and identify the agent where possible; or
- give the factual or legal reasons preventing immediate action.
After correction, the responsible agent must immediately notify other agents with whom the data were shared, unless communication is demonstrably impossible or requires disproportionate effort. Planalto+1
The current official ANPD FAQ states that a general regulatory deadline for circumstances where immediate performance is impossible remains to be set in a specific norm. This report therefore does not invent five, ten, fifteen or thirty days for every correction request. Serviços e Informações do Brasil
G3.5 Deletion, anonymization and blocking
Unnecessary, excessive or unlawful data
C045. Article 18(IV) applies where data are unnecessary, excessive or processed contrary to the LGPD. The request should identify the challenged operation, purpose, data category or incompatibility. It is not limited to consent-based data. Planalto
Consent-based deletion
C047. Article 18(VI) covers personal data processed with consent, except art. 16 retention cases. Revocation and deletion are related but distinct:
- revocation stops the future consent basis;
- a deletion request invokes art. 18(VI);
- prior lawful processing is not automatically invalidated; and
- art. 16 can justify retention for limited purposes. Planalto+1
Accurate debt data
C059. An accurate debt datum is not immune from deletion merely because it is accurate, but accuracy alone also does not make deletion mandatory. The controller must determine:
- whether the purpose remains;
- whether the datum is still necessary;
- which legal basis supports continued processing;
- whether a legal/regulatory retention rule applies;
- whether the datum is required for an actual right or proceeding;
- whether processing has ended under art. 15; and
- whether art. 16 permits retention.
No actual debt record or retention law is available here.
G3.6 Processing termination and retention
Processing ends where:
- its purpose has been achieved or the data are no longer necessary or pertinent;
- the processing period ends;
- the subject communicates withdrawal of consent, subject to public interest; or
- ANPD determines termination following a violation.
After termination, data are deleted within technical limits, but retention remains authorized for:
- legal or regulatory obligations;
- research by a qualifying body, with anonymization where possible;
- transfer to a third party complying with LGPD; or
- exclusive use by the controller, without third-party access and with anonymization.
C058–C059. Planalto+1
A controller cannot rely on art. 16 as a generic “keep everything forever” clause. It must identify the applicable retention purpose and segregate data/use accordingly.
G3.7 Revocation and objection
Revocation
C035, C048. Consent may be revoked at any time through a free and facilitated procedure. The revocation addresses consent-based future processing. It does not automatically stop an independent legal-obligation, regular-rights or other valid processing operation, but a controller may not retroactively relabel processing merely to defeat withdrawal. Planalto
Objection
C049. Article 18 §2 permits objection to consent-exempt processing where the LGPD is being violated. It is not worded as an unconditional right to veto every operation based on legitimate interest, contract, legal obligation or credit protection. The controller must nevertheless assess whether the chosen basis, purpose, necessity and safeguards remain valid. Planalto
G3.8 Requests, representative and identity verification
Rights are exercised by an express request from:
- the data subject; or
- a legally constituted representative,
to a processing agent. C050. Planalto
The LGPD provisions examined do not prescribe one universal power-of-attorney form or identity-verification procedure. The controller needs a proportionate process that:
- verifies the requester;
- prevents unauthorized disclosure;
- recognizes valid representation;
- does not impose unnecessary data collection; and
- does not make rights practically impossible.
A family member, employee, lawyer, debt adviser or caregiver does not gain access merely by asserting a relationship.
G3.9 Request made to an operator
C008, C013, C050–C051.
Article 18 §3 allows an express request to an agente de tratamento, while the substantive rights are framed as rights against the controller. An operator receiving a request should:
- identify the relevant controller;
- preserve and forward the request according to instructions;
- avoid deciding beyond its authorized role;
- assist the controller where required by the processing arrangement; and
- not disclose data independently without authority.
If the recipient is not the relevant agent, the controller’s response framework includes identifying the correct agent where possible. Actual contract allocation remains unknown. Planalto+2
G3.10 Automated decisions
C060–C062.
Article 20 applies only to decisions:
- based solely on automated processing;
- affecting the subject’s interests; and
- including personal, professional, consumer or credit profiles where applicable.
The subject may:
- request review; and
- request clear and adequate information about criteria and procedures.
Commercial and industrial secrets remain protected. If information is withheld on that basis, ANPD may audit for discriminatory processing. The current text’s former human-review paragraph is vetoed; this pass therefore does not promise review by a human. It also does not promise approval, a changed score, a lower rate or reversal. Planalto+1
G3.11 Small processing agents
Eligibility
A small processing agent may include a qualifying microenterprise, small enterprise, startup, nonprofit private organization, natural person or unincorporated private entity performing controller/operator functions. C063. Serviços e Informações do Brasil
Differentiated treatment is unavailable where the agent:
- performs high-risk processing, except the narrow representation/mediation allowance;
- exceeds the applicable revenue limit; or
- belongs to an economic group exceeding it.
High risk requires cumulatively at least:
- one general criterion—large scale or significant effect on fundamental rights/interests; and
- one specific criterion, including solely automated profiling/credit decisions, emerging technologies, public-area surveillance or sensitive/children/adolescent/elderly data.
C064. Serviços e Informações do Brasil
Small status does not remove legal bases, principles or data-subject rights. C065. Serviços e Informações do Brasil
Deadlines
| Request |
Ordinary controller |
Qualifying small agent |
| Simplified confirmation/access |
Immediately |
Up to 15 days from request |
| Complete art. 19 statement |
Up to 15 days |
Double period: up to 30 days |
| Other art. 18 request where immediate action is impossible |
Specific general non-immediate period not identified in reviewed current regulation |
Double period only “under specific regulation”; not automatically 30 days |
| ANPD information/document request |
Applicable specific norm |
Double where Resolução 2 art. 14(IV) applies |
C066–C068. Serviços e Informações do Brasil+1
ANPD may withdraw a flexibility based on the nature, volume and risks of the operation. Serviços e Informações do Brasil
G3.12 Public authorities
Public authorities must process data for their public purpose, public interest and legal competencies, with accessible information about legal basis, purpose, procedures and practices. Rights deadlines and procedures follow specific public-law instruments, including habeas data, federal administrative-process and access-to-information legislation. This report does not apply the private-controller 15-day rule universally to public authorities. C021, C069. Planalto
G3.13 Generic ANPD route
The ordinary statutory and official-guidance sequence is:
- submit the rights request to the controller;
- retain evidence of that attempt and the response;
- if unresolved or unsatisfactory, a data-subject petition may be presented to ANPD.
ANPD warns that rights are not absolute—for example, deletion may be refused where legal retention is required—and that petitions may be reviewed in aggregate rather than individually. No petition, complaint, contact or filing was made here. C070. Serviços e Informações do Brasil+1
G4. Ten fictional workflows
All people, services, debt records, dates, bases, requests and outcomes below are invented. They do not represent an actual consumer or provider.
H01 — Data subject requests confirmation and complete access
Facts: A natural person sends a private debt-information service a clear request on Monday, October 19, 2026, asking whether it processes their data and requesting the complete art. 19 statement.
Actor and role: Assume the service is the controller for its own intake database.
Data/purpose/basis: Identity, contact and alleged debt-account data; exact purpose and basis are not yet established.
Primary claims: C043, C050–C056.
Standard-controller clock
- Day 0 / request date: Monday, October 19, 2026.
- The general Civil Code convention excludes the opening day and includes the endpoint.
- October 20 = day 1.
- November 3, 2026 = day 15.
- Formula: October 19, 2026 + 15 calendar days = November 3, 2026.
Intervening weekends and an intervening holiday do not stop a calendar-day count. If the legal endpoint itself falls on an applicable holiday, Civil Code art. 132 §1 moves it to the following business day. No state or municipal holiday is assumed.
Conditional result: A simplified statement is due immediately; the complete statement is due no later than November 3 under the stipulated facts.
Alternative branch: If the request is incomplete or identity cannot reasonably be verified, the controller should explain the actual impediment rather than silently treating the clock as nonexistent. The precise effect of an identity-information request on timing is not expressly resolved in the reviewed provisions.
Missing facts: Request receipt, controller identity, requested format, identity-verification process and whether the service holds any data.
Exact next question: When did the controller receive a sufficiently identifiable request, and did the subject request the simplified or complete response? Planalto+1
H02 — Inaccurate debt balance
Facts: A controller stores a R$20,000 debt balance, while the subject supplies credible documents showing R$12,000. The amounts are fictional.
Role: Controller of the debt-information record.
Purpose/basis: Account administration or another claimed debt-information purpose; actual basis unknown.
Right: Correction under art. 18(III).
Required act: Verify and correct if inaccurate; explain promptly if immediate action is impossible; notify sharing agents immediately after correction unless impossible or disproportionate.
Clock: The reviewed LGPD text requires immediate action where possible but does not supply one universal fixed fallback period for every correction. The 15-day complete-access period must not be imported automatically.
Adverse branch: The documents may omit later transactions, interest, allocation or a different account. A dispute over the legal debt amount is not always resolved merely by editing a database field.
Missing facts: Contract, ledger, source, calculation method, sharing recipients and controller role.
Exact next question: Is the challenged field factually inaccurate, or does it reflect a substantive debt dispute requiring separate contract analysis?
Claims: C044, C050–C051, C057, C071. Planalto+1
H03 — Accurate debt, but subject demands deletion
Facts: Assume the debt datum is factually accurate. The person requests: “Delete everything because I do not consent.”
Purpose/basis: Controller claims contract necessity, legal retention and regular exercise of rights rather than consent.
Right invoked: Deletion.
Conditional answer: Revocation of consent does not terminate processing that was not based on consent. The controller must still demonstrate the actual basis, purpose, necessity and retention period. Deletion may be required if data are unnecessary, excessive, unlawful or the purpose has ended; it is not automatic solely because the person objects.
Required response: Identify the basis, purpose, duration and retention justification; delete or restrict anything no longer justified; explain any lawful retention.
Adverse branch: A generic claim of “legal obligation” without identifying the rule is insufficient. Conversely, an accurate datum is not automatically excessive merely because unfavorable.
Missing facts: Exact basis per operation, retention rule, proceedings, contract and data categories.
Exact next question: Which specific data remain necessary for which current purpose and under which actual legal basis?
Claims: C042, C045, C047–C049, C058–C059. Planalto+1
H04 — Consent withdrawn while lawful retention is asserted
Facts: A debtor voluntarily consented to receive an optional financial-planning newsletter and upload documents for an optional analysis. Later the person revokes consent and requests deletion. The provider says tax and defense records must remain.
Purpose/basis: Newsletter and optional analysis based on consent; limited records allegedly retained under legal obligation or regular exercise of rights.
Conditional answer:
- optional consent-based future processing must stop after valid revocation;
- consent-based data are subject to deletion, except art. 16 retention;
- the controller may retain only the subset genuinely covered by a valid retention purpose;
- retained data cannot continue to be used for the withdrawn newsletter merely because stored.
Adverse branch: The controller may have used contract rather than consent for the requested analysis. The actual privacy notice and processing ledger control.
Missing facts: Consent record, purposes, revocation receipt, applicable retention law, retained fields and access restrictions.
Exact next question: Which processing operation actually relied on consent, and which specific retained fields are required independently?
Claims: C033–C037, C047–C048, C058. Planalto+1
H05 — Public-source data repurposed into a debt lead
Facts: A company extracts a person’s name and lawsuit reference from a public webpage and combines it with purchased contact information to market a debt service.
Role: The company decides the new marketing purpose and is controller for that operation.
Claimed basis: “It was public.”
Conditional answer: Public availability is not itself a legal basis. The controller must assess the original public purpose, its new purpose, necessity, transparency, legitimate expectations and an actual art. 7 basis. Data enrichment and direct marketing are distinct operations.
Adverse branch: Some narrow outreach may be supportable under legitimate interest after a valid balance and safeguards; other uses may be incompatible, excessive or misleading.
Missing facts: Source, original purpose, access restrictions, data fields, acquisition method, marketing channel, balancing test and opt-out process.
Exact next question: Why would the person reasonably expect this public datum to be combined and used for this particular debt-service solicitation?
Claims: C012, C022–C025, C031, C038–C040. Planalto+2
H06 — Operator receives an access request
Facts: A cloud platform stores creditor records solely under a creditor’s instructions. A debtor sends the platform an access request.
Roles: Creditor assumed controller; cloud platform assumed operator.
Right: Confirmation/access.
Conditional answer: The request may be made to a processing agent, but the controller owes the substantive response. The operator should authenticate and route the request under its instructions, preserve it and assist rather than independently decide unrelated disclosure or deletion.
Adverse branch: If the platform uses the records for its own model training or lead business, it may be a controller for that separate operation and cannot route away its own duties.
Missing facts: Processing agreement, actual instructions, separate uses, controller contact and receipt date.
Exact next question: Does the platform process exclusively for the creditor, or does it determine any independent purpose?
Claims: C007–C008, C013, C018, C050–C051. Planalto+1
H07 — Representative requests a person’s debt file without authority proof
Facts: A relative or debt adviser requests a consumer’s full file, saying the person verbally authorized them, but supplies no reliable proof.
Role: Purported representative, not automatically a controller or operator.
Right: Access on behalf of data subject.
Conditional answer: Art. 18 permits a request from a legally constituted representative. The controller may require proportionate proof of authority and identity before disclosure.
Adverse branch: Demands for excessive personal information or impossible formalities could obstruct the right and violate necessity/free access.
Missing facts: Authority document, identity, scope, expiry, revocation and controller verification process.
Exact next question: What valid instrument establishes this person’s authority to receive the requested categories?
Claims: C020, C050, C052. Planalto
H08 — Solely automated adverse credit decision
Facts: A lender’s system automatically rejects an application without human input, based partly on debt information supplied by a generic information service.
Roles: Lender/controller for the decision; data supplier may be another controller or operator depending on actual conduct.
Right: Art. 20 review and criteria/procedure information.
Required act: Review the solely automated decision when requested and supply clear, adequate information concerning criteria and procedures, subject to legitimate trade secrets.
Clock: No general numerical art. 20 review deadline was established by the provisions examined.
Adverse branch: If a human made a substantive decision, art. 20’s “solely automated” predicate may fail, though other transparency and correction rights remain.
No promised result: The right does not guarantee human review, approval, score increase, rate reduction or model-source-code disclosure.
Missing facts: Degree of human involvement, controller, inputs, criteria, request date and response.
Exact next question: Was the outcome made solely by automated processing, or did a person exercise meaningful decision authority?
Claims: C060–C062. Planalto+1
H09 — Legitimate-interest processing is objected to
Facts: A service keeps former prospects’ contact and debt-category data for internal conversion analytics and periodic marketing, relying on legitimate interest. A former prospect objects.
Basis: Legitimate interest.
Right: Qualified objection and general art. 18 rights.
Conditional answer: The objection is not an unconditional veto, but it requires the controller to reassess:
- whether the purpose is concrete and legitimate;
- whether each datum is strictly necessary;
- the subject’s expectations;
- whether rights prevail;
- whether a less intrusive method exists;
- whether marketing and analytics are separate purposes; and
- safeguards and transparency.
If the operation violates LGPD, the objection should succeed and the data should be stopped, corrected, blocked or deleted as appropriate.
Adverse branch: Limited fraud/security records may remain justified even if marketing stops.
Missing facts: Balance test, notice, frequency, suppression list, retention period and separate purposes.
Exact next question: Can the controller demonstrate a separate balance for analytics and for marketing rather than one generic “business interest”?
Claims: C031, C039–C040, C049. Planalto+1
H10 — Requester wrongly assumes every small business gets 30 days
Facts: A microenterprise receives a complete access request on Monday, October 19, 2026. It plans to answer all rights requests in 30 days, relying on “small-company status.” Assume for the calculation only that it genuinely qualifies for differentiated treatment and is not excluded for high-risk processing, revenue or group status.
Primary rules: Resolução 2 arts. 3–4 and 14–15.
Qualifying small-agent complete-statement calculation
- Day 0: October 19, 2026.
- Ordinary complete period: 15 calendar days.
- Small-agent double: 15 days × 2 = 30 calendar days.
- Day 30: Wednesday, November 18, 2026.
- Formula: October 19, 2026 + 30 calendar days = November 18, 2026.
If the endpoint is an applicable holiday, the general Civil Code convention moves it to the next business day. No local holiday is assumed.
Different simplified branch
The small agent may provide the simplified art. 19(I) statement within up to 15 days—not 30.
Other rights branch
The resolution does not establish a universal 30-day period for correction, deletion, objection or revocation. Its double-period language for art. 18 requests operates according to specific regulation, and the official FAQ states that the general non-immediate deadline remains for ANPD regulation.
Adverse branch: Solely automated credit profiling can help create high-risk status when combined with a general high-risk criterion, removing most differentiated treatment.
Missing facts: Revenue, group status, scale, risks, automated profiling, data categories and request type.
Exact next question: Does the entity actually qualify under arts. 2–4, and is the request simplified access, complete access or another art. 18 right?
Claims: C063–C068, C071. Serviços e Informações do Brasil+3
G5. Old-to-new reconciliation of supplied reviewed rows
Literal P01 G53 row preserved
| Original field |
Literal saved content |
| # |
G53 |
| Issue |
Privacy/data processing |
| Finding and claim refs |
LGPD nexus identified; C035 |
| Status; exact missing material and next action |
Partial; classify roles, basis, notices, security/transfers in dedicated review. |
Original coordinator acceptance: gateway_checked_with_conditions_not_accepted.
Literal P01 D05 row preserved
| Original field |
Literal saved content |
| # |
D05 |
| Named deferred family |
Credit reporting and correction |
| Gateway reference/status |
C003, C035; Deferred |
| Exact next research action |
Research CDC records, LGPD, cadastro-positive and bureau-specific current primary rules. |
Original coordinator acceptance: explicit_deferred_hold_preserved.
Narrow PASS-08 disposition
| Supplied row |
PASS-08 result |
Exact remaining question |
| P01 G53 |
General natural-person scope, controller/operator roles, ordinary legal bases, transparency, rights and small-agent timing gateway researched. |
Actual SettleADebt role, purposes, contracts, notices, security, transfers, vendors, retention schedule and datasets remain absent. |
| P01 D05 — LGPD component only |
General LGPD access, correction, deletion, revocation, objection, sharing and automated-review framework researched. |
Negative and positive credit-register rules, SCR, scoring products, sector deadlines and actual bureau records remain unreviewed and unadopted. |
Neither original row is overwritten. PASS-08 appends only the general LGPD component.
PASS-08 source register
Access date for every source: October 26, 2026 PDT / October 27, 2026 UTC.
Source-specific clock times: unknown and not inferred.
FRESH-READ—OPERATIVE means current enacted or consolidated official text.
FRESH-READ—AMENDMENT means an enacted amendment body.
REGULATORY—OPERATIVE means current ANPD regulation.
OFFICIAL GUIDANCE means published nonbinding ANPD interpretation.
OFFICIAL CATALOGUE means an inventory/status page, not substantive legislation.
| Source ID |
Issuer, title and full literal URL |
Exact body, pages, status, commencement and read limit |
| C_BR-P08-S001 |
Presidência da República, Lei 13.709, de 14 de agosto de 2018 — Lei Geral de Proteção de Dados Pessoais, texto compilado. https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709compilado.htm |
FRESH-READ—OPERATIVE. Arts. 1, 3–10, 12, 15–20, 23, 38–41, 55-J and 65. Current compiled HTML; printed page and PDF index N/A. General substantive commencement recorded by current ANPD guidance as September 18, 2020; arts. 52–54 effective August 1, 2021. Sensitive-data, security, incidents, international transfer, sanctions and damages modules not completed. Planalto+1 |
| S002 |
Presidência da República, Lei 13.853, de 8 de julho de 2019. https://www.planalto.gov.br/ccivil_03/_ato2019-2022/2019/lei/l13853.htm |
FRESH-READ—AMENDMENT. Arts. 1–4 and material amendments to LGPD arts. 3, 5, 7, 18, 20, 55-J/K and 65. Published July 9, 2019; its art. 4 states effect on publication. Current wording taken from S001. HTML; printed page/PDF index N/A. Planalto+1 |
| S003 |
Presidência da República, Lei 14.010, de 10 de junho de 2020. https://www.planalto.gov.br/ccivil_03/_ato2019-2022/2020/lei/l14010.htm |
FRESH-READ—AMENDMENT. Art. 20 inserted LGPD art. 65(I-A), setting August 1, 2021 for arts. 52–54; art. 21 effective on publication. DOU June 12, 2020. Only sanctions commencement traced; sanctions merits excluded. HTML; printed page/PDF index N/A. Planalto |
| S004 |
Presidência da República, Lei 15.352, de 25 de fevereiro de 2026. https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2026/lei/l15352.htm |
FRESH-READ—AMENDMENT. Art. 1 amendments to LGPD art. 5 and ANPD structure; arts. 12–17 transition; art. 21 effect on publication. DOU Extra February 25, 2026. Current compiled text S001 controls substantive wording. HTML; printed page/PDF index N/A. Planalto+1 |
| S005 |
Agência Nacional de Proteção de Dados, Resolução CD/ANPD 2, de 27 de janeiro de 2022 — Regulamento para agentes de tratamento de pequeno porte, texto oficial consolidado. https://www.gov.br/anpd/pt-br/acesso-a-informacao/institucional/atos-normativos/regulamentacoes_anpd/resolucao-cd-anpd-no-2-de-27-de-janeiro-de-2022 |
REGULATORY—OPERATIVE. Resolution arts. 1–2; Annex arts. 1–7 and 14–16. DOU January 28, 2022; effect on publication. Consolidated page incorporates Resolução 15/2024. Page modification September 16, 2026 is not commencement. HTML; printed page/PDF index N/A. Serviços e Informações do Brasil+1 |
| S006 |
Agência Nacional de Proteção de Dados, Regulamentações da ANPD. https://www.gov.br/anpd/pt-br/acesso-a-informacao/institucional/atos-normativos/regulamentacoes_anpd |
OFFICIAL CATALOGUE. Current resolutions/status inventory read to bound the regulatory search. It is not the operative body of every linked resolution and does not prove that no additional applicable instrument exists outside the displayed catalogue. HTML; no commencement, printed page or PDF index. Serviços e Informações do Brasil |
| S007 |
Agência Nacional de Proteção de Dados, Perguntas Frequentes. https://www.gov.br/anpd/pt-br/acesso-a-informacao/perguntas-frequentes |
OFFICIAL GUIDANCE. Items 1.3, 5.8 and 5.9: staged commencement, no ANPD accreditation of LGPD consulting organizations, immediate art. 18 response framework, art. 19 deadlines and pending general regulation. Nonbinding guidance; not a substitute for the statute or regulation. HTML; printed page/PDF index N/A. Serviços e Informações do Brasil+1 |
| S008 |
ANPD, Guia Orientativo para Definições dos Agentes de Tratamento de Dados Pessoais e do Encarregado, versão 2.0, abril de 2022. https://www.gov.br/anpd/pt-br/centrais-de-conteudo/materiais-educativos-e-publicacoes/Segunda_Versao_do_Guia_de_Agentes_de_Tratamento_retificada.pdf/@@display-file/file |
OFFICIAL GUIDANCE PDF, nonbinding. Version page: printed p.4, zero-based PDF index 3. Roles by operation/employees: printed p.7, index 6. Joint control: printed p.13, index 12. Operator/instructions: printed p.17, index 16. Twenty-six PDF pages. Used for role interpretation only. Serviços e Informações do Brasil+3 |
| S009 |
ANPD, Hipóteses legais de tratamento de dados pessoais — Legítimo Interesse, versão 1.0, fevereiro de 2024. https://www.gov.br/anpd/pt-br/centrais-de-conteudo/materiais-educativos-e-publicacoes/guia_legitimo_interesse.pdf/@@display-file/file |
OFFICIAL GUIDANCE PDF, nonbinding. Version/publication: printed p.3, zero index 2. Ordinary-data nature: printed p.7, index 6. Rights/expectations: printed p.22, index 21. Balancing: printed p.29, index 28. Optional test model: printed p.45, index 44. Fifty-three pages. Used narrowly for legitimate-interest interpretation, not as enacted law. Serviços e Informações do Brasil+4 |
| S010 |
ANPD, Denúncia / Petição de Titular referente à LGPD. https://www.gov.br/anpd/pt-br/canais_atendimento/cidadao-titular-de-dados/denuncia-peticao-de-titular-referente-lgpd |
OFFICIAL PROCEDURAL GUIDANCE. Controller-first sequence, evidence of prior attempt, nonabsolute rights and possible aggregate review. No complaint or petition initiated. HTML; no legislative commencement, printed page or PDF index. Serviços e Informações do Brasil+1 |
| S011 |
Presidência da República, Lei 10.406/2002 — Código Civil, texto compilado. https://www.planalto.gov.br/ccivil_03/leis/2002/l10406compilada.htm |
FRESH-READ—TIMING ONLY. Art. 132 caput and §§1–4 for fictional date calculations: exclude start, include endpoint, endpoint holiday extension, month/year and hour conventions. No prescription, service-contract or mandate conclusion imported. HTML; printed page/PDF index N/A. Planalto |
Displayed source count: 11.
- 4 enacted/current statutory bodies;
- 1 operative ANPD regulation;
- 1 official regulatory catalogue;
- 4 official nonbinding guidance bodies;
- 1 Civil Code timing source.
No materially relied source is a private contract, commercial policy, search snippet or unnamed record.
Atomic PASS-08 claim/evidence register
| Claim ID |
Area; atomic proposition, predicate, act/effect and retained limit |
Source and pinpoint |
| C_BR-P08-C001 |
A098. Current operative general body is the compiled LGPD; substantive rights are treated as effective September 18, 2020, sanctions August 1, 2021, and 2026 agency amendments on publication. |
S001 art. 65; S003 art. 20; S004 art. 21; S007 item 1.3. Serviços e Informações do Brasil+2 |
| C002 |
A098. LGPD protects personal data concerning natural persons; a legal entity is not itself an LGPD data subject. |
S001 arts. 1, 5(I),(V), 17. Planalto+1 |
| C003 |
A098. Corporate records can contain personal data about identifiable individuals. |
S001 art. 5(I); application depends on fields and identifiability. Planalto |
| C004 |
A098. Sensitive data are a separately defined protected category and are not cleared by this ordinary-data pass. |
S001 art. 5(II), art. 11. Planalto+1 |
| C005 |
A098. Data are anonymized only where identification cannot be reversed using reasonable available means. |
S001 arts. 5(III), 12. Planalto+1 |
| C006 |
A097. “Processing” includes collection, receipt, use, access, storage, alteration, sharing, transfer, dissemination and deletion. |
S001 art. 5(X). Planalto |
| C007 |
A097. Controller is the person competent to make processing decisions. |
S001 art. 5(VI). Planalto |
| C008 |
A097. Operator processes personal data on behalf of the controller. |
S001 arts. 5(VII), 39. Planalto+1 |
| C009 |
A098. Titular is the natural person to whom the processed personal data relate. |
S001 art. 5(V). Planalto |
| C010 |
A098. LGPD territorial triggers include processing in Brazil, offerings/processing directed to individuals located in Brazil and data collected in Brazil. |
S001 art. 3. Planalto+1 |
| C011 |
A098. Exclusively private and noneconomic natural-person processing and specified other art. 4 categories are outside LGPD. |
S001 art. 4. Planalto |
| C012 |
A098. Publicly accessible data remain subject to purpose, good faith, public interest, principles and data-subject rights. |
S001 art. 7 §§3–7. Planalto |
| C013 |
A097. Agent role is classified per processing operation; one organization can be controller and operator for different operations. |
S008 printed p.7/index 6. Serviços e Informações do Brasil |
| C014 |
A097. Employees and subordinate internal teams ordinarily act under the organization rather than as separate operators. |
S008 printed p.7/index 6. Serviços e Informações do Brasil |
| C015 |
A097. Joint control is contextual where participants jointly determine purposes and essential elements; LGPD does not expressly define the term. |
S008 printed p.13/index 12; guidance only. Serviços e Informações do Brasil |
| C016 |
A097. A debtor-side service is controller for operations whose purposes and essential means it determines. |
Inference from S001 art. 5(VI) and S008; actual service facts absent. |
| C017 |
A097. A creditor-side contractor may be operator for instructed processing and controller for separate self-determined purposes. |
S001 arts. 5(VI)–(VII), 39; S008 pp.7,17. Planalto+1 |
| C018 |
A097. A software vendor that reuses data for its own purposes needs separate controller/basis analysis. |
S001 art. 5(VI)–(VII); S008 role-by-operation guidance. |
| C019 |
A097. Bureau/database-manager roles require actual purpose and sector law; no sector classification is made here. |
S001 art. 5(VI); sector branches held. |
| C020 |
A097. A representative exercising rights is not automatically a controller/operator; valid authority is required. |
S001 art. 18 §3. Planalto |
| C021 |
A097. Public-authority processing follows arts. 7(III), 23 and specific public-law rights procedures. |
S001 arts. 7(III), 23. Planalto+1 |
| C022 |
A098. Processing must have legitimate, specific, explicit and informed purpose without incompatible later use. |
S001 art. 6(I). Planalto |
| C023 |
A098. Processing must be compatible with the informed purpose and context. |
S001 art. 6(II). Planalto |
| C024 |
A098. Processing is limited to the minimum pertinent, proportional and nonexcessive data. |
S001 art. 6(III). Planalto |
| C025 |
A098. Free access, quality, transparency, security, prevention, non-discrimination and accountability apply independently of the selected basis. |
S001 art. 6(IV)–(X). Planalto+1 |
| C026 |
A097. Consent is one ordinary-data legal basis, not a universal requirement. |
S001 art. 7(I). Planalto |
| C027 |
A097. Legal/regulatory obligation requires an actual obligation imposed on the controller. |
S001 art. 7(II). Planalto |
| C028 |
A097. Public-policy basis is for public administration under the stated public-policy instruments and Chapter IV. |
S001 art. 7(III). Planalto |
| C029 |
A097. Contract/precontract basis requires necessity for the subject’s contract or requested preliminary steps. |
S001 art. 7(V). Planalto |
| C030 |
A097. Regular-exercise basis in art. 7(VI) concerns judicial, administrative or arbitral proceedings. |
S001 art. 7(VI). Planalto |
| C031 |
A097. Legitimate interest requires concrete legitimate purpose and that subject rights do not prevail. |
S001 arts. 7(IX), 10. Planalto+1 |
| C032 |
A097. Credit protection is an express basis but remains subject to sector law, principles and rights. |
S001 art. 7(X), §6. Planalto |
| C033 |
A098. Consent must be demonstrable; controller bears proof burden; written consent is highlighted. |
S001 art. 8 caput, §§1–3. Planalto |
| C034 |
A098. Consent must concern determined purposes; generic authorization is void. |
S001 art. 8 §4. Planalto |
| C035 |
A098. Consent may be revoked at any time through a free and facilitated procedure. |
S001 art. 8 §5. Planalto |
| C036 |
A098. Consent-based controller-to-controller sharing generally needs specific consent unless another consent-exempt basis applies. |
S001 art. 7 §5. Planalto |
| C037 |
A098. Dispensing with consent does not remove the remaining LGPD obligations and rights. |
S001 art. 7 §6. Planalto |
| C038 |
A098. Public or manifestly public data can be reused only under legitimate specific purposes, preserved rights and principles. |
S001 art. 7 §§3–4, 7. Planalto |
| C039 |
A097. Legitimate interest permits only strictly necessary data and requires transparency. |
S001 art. 10 §§1–2. Planalto |
| C040 |
A098. ANPD guidance recommends a purpose-specific balance of legitimacy, necessity, impact, expectations and safeguards; art. 7(IX) is not an ordinary basis for sensitive data. |
S009 pp.7,22,29,45. Serviços e Informações do Brasil+2 |
| C041 |
A097. An LGPD legal basis does not confer legal, professional, collection, lending, payment or consultancy permission. |
Nature of LGPD basis; S007 item 5.8 confirms no ANPD adviser accreditation. Serviços e Informações do Brasil |
| C042 |
A098. Subject is entitled to clear information on purpose, form/duration, controller, contacts, sharing, responsibilities and rights. |
S001 art. 9. Planalto+1 |
| C043 |
A098. Subject may request confirmation and access at any time. |
S001 art. 18(I)–(II). Planalto |
| C044 |
A098. Subject may request correction of incomplete, inaccurate or outdated data. |
S001 art. 18(III). Planalto |
| C045 |
A098. Subject may request anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data. |
S001 art. 18(IV). Planalto |
| C046 |
A098. Portability requires express request and ANPD regulation, preserving trade secrets; anonymized data excluded. |
S001 art. 18(V), §§7; art. 40. Planalto+1 |
| C047 |
A098. Consent-based data may be deleted on request subject to art. 16 retention exceptions. |
S001 art. 18(VI), arts. 15–16. Planalto+1 |
| C048 |
A098. Subject may obtain sharing information, refusal-of-consent consequences and revoke consent. |
S001 art. 18(VII)–(IX). Planalto |
| C049 |
A098. Objection to consent-exempt processing is statutory where LGPD is violated, not an unconditional veto. |
S001 art. 18 §2. Planalto |
| C050 |
A098. Rights request may be made by the subject or legally constituted representative to a processing agent. |
S001 art. 18 §3. Planalto |
| C051 |
A098. If immediate action is impossible, controller must identify the proper agent where possible or state factual/legal reasons. |
S001 art. 18 §4. Planalto |
| C052 |
A098. Rights requests are free to the subject, under regulatory terms and deadlines. |
S001 art. 18 §5. Planalto |
| C053 |
A098. Simplified confirmation/access is immediate for an ordinary controller. |
S001 art. 19(I). Planalto |
| C054 |
A098. Complete confirmation/access statement is due within 15 days from request. |
S001 art. 19(II). Planalto |
| C055 |
A098. Subject chooses secure electronic or printed delivery. |
S001 art. 19 §2. Planalto |
| C056 |
A098. Full electronic copy for consent/contract processing remains subject to ANPD regulation and trade secrets. |
S001 art. 19 §3. Planalto |
| C057 |
A097. Correction/deletion/anonymization/blocking must be communicated immediately to sharing agents, except impossibility or disproportionate effort. |
S001 art. 18 §6. Planalto |
| C058 |
A098. Processing terminates under art. 15 predicates; art. 16 allows specified retention after termination. |
S001 arts. 15–16. Planalto+1 |
| C059 |
A098. Accurate debt data are not universally deletable or universally retainable; current purpose, basis, necessity and art. 16 must be assessed. |
Inference from S001 arts. 6, 15–18; actual sector facts held. |
| C060 |
A098. Subject may request review of a solely automated decision affecting interests, including credit profile. |
S001 art. 20 caput. Planalto |
| C061 |
A098. Controller must provide clear criteria/procedure information subject to trade secrets; ANPD can audit discriminatory aspects if withheld. |
S001 art. 20 §§1–2. Planalto |
| C062 |
A098. Current art. 20 does not expressly guarantee human review, reversal, approval or score increase. |
S001 art. 20; §3 vetoed. Planalto |
| C063 |
A097. Small-agent status has defined organizational predicates and is not established by self-description. |
S005 Annex art. 2. Serviços e Informações do Brasil |
| C064 |
A097. High-risk processing, revenue and group limits can exclude differentiated treatment; high risk requires one general and one specific criterion. |
S005 Annex arts. 3–4. Serviços e Informações do Brasil |
| C065 |
A098. Small-agent flexibility does not remove legal bases, principles, law, contracts or subject rights; accessible request channels remain required. |
S005 Annex arts. 6–7. Serviços e Informações do Brasil |
| C066 |
A098. Qualifying small agent may provide simplified art. 19(I) statement within up to 15 days. |
S005 Annex art. 15. Serviços e Informações do Brasil |
| C067 |
A098. Qualifying small agent gets double the 15-day complete-statement period: 30 days. |
S005 Annex art. 14(III); S001 art. 19(II). Serviços e Informações do Brasil+1 |
| C068 |
A098. Double period for other art. 18 requests operates under specific regulation; no universal automatic 30-day deadline is established. |
S005 Annex art. 14(I), sole paragraph; S007 item 5.9. Serviços e Informações do Brasil+1 |
| C069 |
A098. Rights against public authorities follow specific public-law deadlines and procedures. |
S001 art. 23 §3. Planalto |
| C070 |
A098. ANPD petition follows an unresolved controller-first request; rights are not absolute and petitions may be analyzed collectively. |
S010. Serviços e Informações do Brasil+1 |
| C071 |
A098. Current official FAQ says non-immediate general art. 18 response deadlines remain for ANPD regulation; only art. 19 has the stated immediate/15-day options. |
S007 item 5.9. Serviços e Informações do Brasil |
| C072 |
A098. ANPD does not accredit LGPD consulting organizations; 2026 law transformed it into the Agência Nacional de Proteção de Dados. |
S007 item 5.8; S004 arts. 1,21. Serviços e Informações do Brasil+1 |
| C073 |
A098. No actual actor, dataset, consent, basis, rights request, retention rule, automated decision, record or locality was reviewed; no provider/country acceptance follows. |
Research boundary and supplied holds. |
Displayed claim count: 73, C_BR-P08-C001–C073.
Complete granular core coverage
| # |
Required subquestion |
Finding/claims |
Status and exact next action |
| P08-G01 |
Current compiled LGPD |
C001 |
Answered. Recheck official consolidation at publication/use date. |
| G02 |
Amendment chronology |
C001, C072 |
Material amendments traced. Full historical MP sequence not needed for current application. |
| G03 |
Commencement |
C001 |
Answered for current use: Sept. 18, 2020 general; Aug. 1, 2021 sanctions. |
| G04 |
Natural-person scope |
C002, C009 |
Answered. Identify actual individual linked to each datum. |
| G05 |
Juristic-person data |
C002–C003 |
Conditional. Separate corporate data from personal data in business files. |
| G06 |
Personal-data definition |
C003 |
Answered. Map each field and identifiability. |
| G07 |
Sensitive data |
C004 |
Excluded/deferred. Apply art. 11 and specialist modules separately. |
| G08 |
Anonymized data |
C005 |
Conditional. Test realistic reidentification means. |
| G09 |
Processing definition |
C006 |
Answered. Inventory each operation, not only collection. |
| G10 |
Controller |
C007 |
Answered gateway. Identify actual purpose/means decisions. |
| G11 |
Operator |
C008 |
Answered gateway. Obtain instructions and processing agreement. |
| G12 |
Employee/internal team |
C014 |
Ordinarily not separate agent. Verify no independent outside role. |
| G13 |
Role per operation |
C013 |
Answered. Map intake, storage, sharing, analytics and marketing separately. |
| G14 |
Joint controllers |
C015 |
Guidance only. Determine shared purpose/essential means and contracts. |
| G15 |
Debtor-side service |
C016 |
Conditional controller role. Obtain actual purposes and product flow. |
| G16 |
Creditor-side service |
C017 |
Conditional mixed role. Obtain creditor instructions and self-use. |
| G17 |
Bureau/database manager |
C019 |
Sector branch held. Identify system and sector statute. |
| G18 |
Software vendor |
C018 |
Conditional operator/controller split. Inspect reuse and model training. |
| G19 |
Representative |
C020, C050 |
Conditional. Obtain legally valid authority. |
| G20 |
Public authority |
C021, C069 |
Separate route. Identify statute, function and public procedure. |
| G21 |
Brazil processing nexus |
C010 |
Answered gateway. Locate each processing operation. |
| G22 |
Foreign/remote nexus |
C010 |
Conditional. Map offerings, individuals, collection and transfer. |
| G23 |
Private noneconomic exception |
C011 |
Answered narrow exception. Commercial service ordinarily does not qualify. |
| G24 |
Professional/economic processing |
C010–C011 |
Within general scope if nexus exists. Permission remains separate. |
| G25 |
Public-source data |
C012, C038 |
Not unrestricted. Record original/new purpose and compatibility. |
| G26 |
Purpose principle |
C022 |
Answered. Document each specific purpose. |
| G27 |
Adequacy |
C023 |
Answered. Compare use with disclosed purpose/context. |
| G28 |
Necessity |
C024 |
Answered. Minimize data and retention. |
| G29 |
Access/quality/transparency/security principles |
C025 |
Answered gateway. Security full module deferred. |
| G30 |
Consent basis |
C026 |
Available, not mandatory universally. |
| G31 |
Legal obligation basis |
C027 |
Conditional. Cite actual obligation and fields. |
| G32 |
Public-policy basis |
C028 |
Public-administration branch only. |
| G33 |
Contract/precontract basis |
C029 |
Conditional. Prove subject request and necessity. |
| G34 |
Regular exercise of rights |
C030 |
Proceeding-specific. Identify actual judicial/admin/arbitral right. |
| G35 |
Legitimate interest |
C031, C039–C040 |
Conditional. Perform purpose-specific balance and safeguards. |
| G36 |
Credit protection |
C032 |
Conditional sector basis. Do not infer unrestricted debt-data use. |
| G37 |
Later marketing/reuse |
C022–C024, C038 |
Separate purpose/basis required. |
| G38 |
Consent proof |
C033 |
Controller burden. Preserve manifestation and version. |
| G39 |
Generic consent |
C034 |
Void as consent. |
| G40 |
Consent revocation |
C035 |
Free/facilitated. Separate prior processing and retention. |
| G41 |
Consent-based sharing |
C036 |
Specific consent unless another basis applies. |
| G42 |
Consent exemption |
C037 |
No exemption from principles/rights. |
| G43 |
Legitimate-interest expectations/balance |
C039–C040 |
Required. One balance per distinct purpose. |
| G44 |
Ordinary versus sensitive basis |
C004, C040 |
Separated. No art. 7(IX) shortcut for sensitive data. |
| G45 |
Data basis versus provider permission |
C041, C072 |
Separated. Preserve professional/financial/payment holds. |
| G46 |
Art. 9 transparency |
C042 |
Answered. Audit notice content and placement. |
| G47 |
Confirmation right |
C043 |
Answered. Determine controller and receipt date. |
| G48 |
Access right |
C043 |
Answered. Define requested dataset/format. |
| G49 |
Simplified response |
C053 |
Immediate for ordinary controller. |
| G50 |
Complete response |
C054 |
15 days for ordinary controller. |
| G51 |
Electronic or paper |
C055 |
Subject choice. |
| G52 |
Full reusable electronic copy |
C056 |
Regulation-dependent. Preserve trade secrets. |
| G53 |
Correction |
C044, C051 |
Immediate where possible. No invented fallback period. |
| G54 |
Anonymization/blocking/deletion |
C045 |
Only statutory predicates. |
| G55 |
Consent-based deletion |
C047 |
Subject to art. 16. |
| G56 |
Legal/regulatory retention |
C058 |
Conditional. Identify actual rule and access restrictions. |
| G57 |
Research/transfer/exclusive anonymized retention |
C058 |
Conditional exceptions. |
| G58 |
Accurate debt deletion |
C059 |
No universal result. Analyze basis, purpose and retention. |
| G59 |
Portability |
C046 |
Right exists; mechanics held pending regulation. |
| G60 |
Sharing recipients |
C048 |
Information right established. |
| G61 |
Consequences of refusing consent |
C048 |
Disclosure required. Do not label mandatory processing optional. |
| G62 |
Revocation |
C048 |
Established. Separate other independent bases. |
| G63 |
Objection |
C049 |
Qualified by LGPD noncompliance. |
| G64 |
Downstream propagation |
C057 |
Immediate, subject to statutory exceptions. |
| G65 |
Representative request |
C050 |
Valid authority required. |
| G66 |
Request received by operator |
C008, C050–C051 |
Route/assist under instructions. Determine own-controller operations. |
| G67 |
Identity verification |
C050, C025 |
Proportionate process needed; exact form held. |
| G68 |
Automated review |
C060 |
Only solely automated decisions affecting interests. |
| G69 |
Criteria/procedures |
C061 |
Clear/adequate information, trade-secret limit. |
| G70 |
Human review/approval/score promise |
C062 |
Not established. |
| G71 |
Public-authority deadlines |
C069 |
Specific law controls. |
| G72 |
Controller-first ANPD route |
C070 |
Described only. No contact or filing. |
| G73 |
Full complaint/remedy process |
C070, C073 |
Deferred. |
| G74 |
Small-agent eligibility |
C063 |
Unproved. Obtain registration/revenue/group facts. |
| G75 |
Small-agent high-risk exclusion |
C064 |
Assess scale/rights impact plus specific criterion. |
| G76 |
Small-agent channels/rights |
C065 |
Rights remain. |
| G77 |
Small simplified access |
C066 |
Up to 15 days. |
| G78 |
Small complete access |
C067 |
Up to 30 days. |
| G79 |
Other small-agent rights deadlines |
C068, C071 |
No universal doubled number. |
| G80 |
H01 confirmation/access |
C043, C053–C055 |
Completed fiction; actual request absent. |
| G81 |
H02 inaccurate balance |
C044, C051, C057 |
Completed fiction; merits documents absent. |
| G82 |
H03 accurate debt/deletion |
C045, C058–C059 |
Completed fiction; retention basis unknown. |
| G83 |
H04 consent withdrawal/retention |
C035, C047–C048, C058 |
Completed fiction. |
| G84 |
H05 public-source reuse |
C012, C031, C038–C040 |
Completed fiction. |
| G85 |
H06 operator request |
C008, C013, C050–C051 |
Completed fiction. |
| G86 |
H07 representative |
C020, C050 |
Completed fiction. |
| G87 |
H08 automated decision |
C060–C062 |
Completed fiction. |
| G88 |
H09 legitimate-interest objection |
C031, C039–C040, C049 |
Completed fiction. |
| G89 |
H10 small-agent assumption |
C063–C068, C071 |
Completed fiction. |
| G90 |
P01 crosswalk/currentness/country acceptance |
C001, C072–C073 |
Narrow augmentation only; all broader holds retained. |
Displayed core-coverage count: 90 rows, P08-G01 through G90.
Separately named deferred families
| # |
Deferred family |
Exact remaining action |
| P08-D01 |
Sensitive personal data |
Apply art. 11 bases, prohibitions and actual sensitive fields separately. |
| D02 |
Children and adolescents |
Research art. 14, best-interest and current child-data regulation separately. |
| D03 |
Biometrics and genetic data |
Classify sensitive data, fraud/security basis and technical use. |
| D04 |
Security measures |
Read arts. 46–49 and current ANPD security guidance/regulations with actual architecture. |
| D05 |
Security incidents |
Apply current incident-notification regulation and actual risk facts. |
| D06 |
International transfers |
Apply current Resolução 19/2024, adequacy decisions and actual data routes. |
| D07 |
Bulk marketing and suppression lists |
Identify channels, purpose, basis, expectations and communications law. |
| D08 |
Full profiling and commercial scoring |
Obtain actual model, inputs, purposes, sector law and automated-decision facts. |
| D09 |
Data-protection impact reports |
Determine high-risk operations and current ANPD requirements. |
| D10 |
Encarregado/DPO obligations |
Apply current 2026 definition and ANPD regulations to actual entity. |
| D11 |
Full controller/operator/joint-controller liability |
Obtain contracts and conduct; research arts. 42–45 and current case law. |
| D12 |
Public-authority and notarial processing |
Apply arts. 23–30, LAI, habeas data and administrative procedure separately. |
| D13 |
Ordinary negative credit-register rules |
PASS-06 remains unreviewed and unadopted. |
| D14 |
Cadastro Positivo |
PASS-07 remains unreviewed and unadopted. |
| D15 |
SCR and Banco Central reporting |
Read current BCB sector instruments independently. |
| D16 |
Protest and notarial debt records |
Apply Lei 9.492 and local implementation separately. |
| D17 |
Cadin and other public debtor registers |
Apply specific public-law regime. |
| D18 |
Court judgments and public judicial data |
Apply CPC, court-publicity and sealing rules separately. |
| D19 |
Provider professional permission |
Preserve OAB, CRA, CORECON and other P01 holds. |
| D20 |
Financial, lending and payment permission |
Preserve P01/P02 financial and payment holds. |
| D21 |
Current CMN 4.935 / Joint Resolution 17 |
Preserve PASS-02 partial current-source hold. |
| D22 |
BCB Resolution 494 and payment institutions |
Separate current payment-authorisation review. |
| D23 |
Client-money custody and safeguarding |
Obtain actual account title, processor and funds flow. |
| D24 |
Adviser fees and consumer contracts |
PASS-04 remains unreviewed and unadopted. |
| D25 |
Settlement, novation and creditor authority |
Obtain actual agreements and substantive authority separately. |
| D26 |
Prescription and interruption |
PASS-05 remains unreviewed and unadopted. |
| D27 |
General collection conduct |
Research communications, harassment, contact restrictions and remedies separately. |
| D28 |
Secured debts, collateral and guaranties |
Apply product/security/obligor law separately. |
| D29 |
Insolvency, recuperação and falência |
Determine effect of actual proceeding, plan and court orders. |
| D30 |
Tax |
Identify transaction, retention duty and current tax authority. |
| D31 |
Complaints, sanctions and full regulatory procedure |
Read current ANPD procedural regulations; no complaint made. |
| D32 |
Civil remedies, damages and exhaustive case law |
Research causation, standing, limitation and current precedents separately. |
| D33 |
State, DF and municipal implementation |
All 27 territorial branches remain individually deferred below. |
| D34 |
Foreign law, recognition and overseas enforcement |
No foreign-law premise is adopted. |
| D35 |
Full Brazil, A097/A098, parent-program and publication acceptance |
HOLD pending same-coordinator review and all remaining components. |
Displayed deferred-family count: 35 rows.
All 27 inherited states and Distrito Federal
These jurisdiction names are inherited from P01. No geography API, IBGE endpoint or fresh territorial enumeration was used. The LGPD contains nationally applicable general rules, but that does not establish every local procedure, consumer body, public-authority route or court application.
| State / DF |
PASS-08 local status |
Exact remaining local issue |
| Acre (AC) |
No local primary body read |
AC public-authority procedure, Procon, courts, local privacy channels and municipalities. |
| Alagoas (AL) |
No local primary body read |
AL public bodies, consumer procedure, courts and municipal implementation. |
| Amapá (AP) |
No local primary body read |
AP administrative routes, courts, accessibility and municipalities. |
| Amazonas (AM) |
No local primary body read |
AM public processing, remote access, courts and local consumer authorities. |
| Bahia (BA) |
No local primary body read |
BA administrative, Procon, court and municipal application. |
| Ceará (CE) |
No local primary body read |
CE public-authority deadlines, consumer enforcement and courts. |
| Distrito Federal (DF) |
No local primary body read |
DF public entities, TJDFT, consumer authority and local procedures. |
| Espírito Santo (ES) |
No local primary body read |
ES administrative, judicial and municipal implementation. |
| Goiás (GO) |
No local primary body read |
GO public authority, courts, Procon and municipal channels. |
| Maranhão (MA) |
No local primary body read |
MA administrative procedure, courts, accessibility and municipalities. |
| Mato Grosso (MT) |
No local primary body read |
MT public processing, consumer routes and courts. |
| Mato Grosso do Sul (MS) |
No local primary body read |
MS administrative/court procedure, border processing and municipalities. |
| Minas Gerais (MG) |
No local primary body read |
MG public entities, consumer enforcement and courts. |
| Pará (PA) |
No local primary body read |
PA public processing, courts, language/accessibility and municipalities. |
| Paraíba (PB) |
No local primary body read |
PB administrative rights, Procon and court routes. |
| Paraná (PR) |
No local primary body read |
PR public-authority procedure, courts and local consumer implementation. |
| Pernambuco (PE) |
No local primary body read |
PE public processing, courts and municipalities. |
| Piauí (PI) |
No local primary body read |
PI administrative, judicial and accessibility routes. |
| Rio de Janeiro (RJ) |
No local primary body read |
RJ public entities, courts, Procon and municipal procedures. |
| Rio Grande do Norte (RN) |
No local primary body read |
RN administrative rights, courts and local consumer enforcement. |
| Rio Grande do Sul (RS) |
No local primary body read |
RS public processing, courts and current local interpretation. |
| Rondônia (RO) |
No local primary body read |
RO administrative, court, remote-access and municipal procedures. |
| Roraima (RR) |
No local primary body read |
RR public bodies, courts, multilingual/accessibility and municipalities. |
| Santa Catarina (SC) |
No local primary body read |
SC administrative, court and consumer implementation. |
| São Paulo (SP) |
No local PASS-08 primary body read |
SP public bodies, TJSP, Procon, municipal and local procedural rules. |
| Sergipe (SE) |
No local primary body read |
SE administrative, consumer, judicial and municipal routes. |
| Tocantins (TO) |
No local primary body read |
TO public authority, courts, accessibility and municipalities. |
Displayed territorial count: 27 rows; zero states/DF cleared.
Evidence-backed article, checklist and conditional-tool opportunities
| Opportunity |
Supported function |
Mandatory guardrail |
| LGPD role mapper for debt services |
Map who decides each intake, storage, sharing, analytics and marketing operation. |
A contract label is not conclusive; no actual SettleADebt role determination. |
| Purpose-and-basis ledger |
Record each purpose, data category, basis, necessity, recipients and retention trigger. |
Never allow “the debt exists” or “public data” as a generic basis. |
| Consent evidence checklist |
Version, highlighted clause, determined purposes, proof, sharing authorization and revocation channel. |
Do not imply consent is always required or that generic consent is valid. |
| Legitimate-interest balance worksheet |
Interest, concrete purpose, necessity, expectations, impacts, safeguards and alternatives. |
ANPD template is optional; not suitable as a blanket sensitive-data basis. |
| Data-subject request classifier |
Distinguish confirmation/access, correction, deletion, revocation, objection, portability and automated review. |
Each right has separate predicates; no universal deletion button. |
| Access deadline calculator |
Standard immediate/15-day options and qualifying-small-agent 15/30-day branches. |
Require controller type, request type, receipt date, eligibility and local endpoint holiday. |
| Deletion/retention decision tree |
Test art. 15 termination, art. 18 predicate and art. 16 exception. |
No result that an accurate debt is automatically deletable or permanently retainable. |
| Representative-access checklist |
Verify subject identity, representative authority, scope, expiration and secure delivery. |
Avoid excessive proof and unauthorized disclosure. |
| Automated-decision review checklist |
Determine solely automated status, affected interest, criteria request and response. |
No human-review, approval, score-increase or model-source-code promise. |
| Small-agent eligibility checker |
Test organizational status, revenue/group limits and high-risk criteria. |
Self-description as a startup or small company is insufficient. |
| Public-source reuse worksheet |
Record original public purpose, new purpose, basis, necessity and subject expectations. |
Public availability is not unrestricted reuse permission. |
| Controller-first request log |
Preserve request, receipt, response, impediment explanation and downstream propagation. |
Does not submit a complaint or guarantee ANPD individual action. |
A safe tool must clearly separate:
- supplied factual input;
- role inference;
- legal-basis candidate;
- statutory right;
- known deadline;
- unresolved regulation;
- sector-law dependency; and
- actual legal-review hold.
It must never output “LGPD requires consent for everything,” “all debt data must be deleted,” “public data are free to use,” or “the company has 30 days because it is small.”
Researcher self-check
| Reconciliation item |
Actual result |
| Assigned component |
P01 G53 and D05 remaining general LGPD role/basis/rights gateway only. |
| PASS-04/PASS-05/PASS-06/PASS-07 reliance |
None. All remain unreviewed and unadopted. |
| Sources |
11 displayed. |
| Atomic claims |
73 displayed, C_BR-P08-C001–C073. |
| Core coverage |
90 displayed, P08-G01–G90. |
| Deferred families |
35 displayed, P08-D01–D35. |
| Territorial rows |
27 displayed, none cleared. |
| Fictional workflows |
10 displayed, H01–H10. |
| Old-to-new crosswalk |
2 supplied P01 rows, G53 and D05, preserved literally and narrowly augmented. |
| Timing examples |
H01 ordinary complete-access 15-day calculation; H10 qualifying-small-agent 30-day calculation. |
| Current primary text |
Current compiled LGPD read; 2019, 2020 and 2026 material amendment/currentness bodies traced. |
| Current regulation |
Resolução CD/ANPD 2 consolidated text read; current ANPD regulatory catalogue checked. |
| General non-immediate art. 18 deadline |
Not established. Current official FAQ says ANPD regulation is required. |
| Small-agent relief |
Limited to qualifying agents and exact differentiated provisions; no universal 30-day rule. |
| Full sensitive-data module |
Deferred. |
| Security/incidents/transfers |
Deferred. |
| Credit-register doctrines |
Not replayed or accepted. |
| Actual actor roles |
Not determined without contracts and operational facts. |
| Actual data, report, score, consent or request |
None obtained or searched. |
| Named person/company/provider/bureau/licence lookup |
None performed. |
| Complaint/contact/filing |
None performed. |
| APIs, Deep Research, Work/Codex, subagents or new chats |
None used. |
| Source-specific clock times |
Unknown and not invented. |
| Local coordinator files |
No write performed or claimed. |
| Model/power |
No self-certified model tier, Pro status, quota, recovery or measured ranking. |
| Review status |
Not independent review or all-source certification. Same-coordinator review remains separate. |
| Country/publication status |
HOLD. No provider, contract, locality, A097/A098, parent or Brazil-wide acceptance. |
Exact evidence required for an actual LGPD classification
- Every legal entity and natural person involved.
- Data-flow and system diagram.
- Dataset and field inventory.
- Purpose assigned to each processing operation.
- Controller/operator/joint-controller decision evidence.
- Contracts and instructions between processing participants.
- Claimed legal basis for each purpose.
- Consent text, versions, proof and revocation channel where relevant.
- Legitimate-interest assessment where relied upon.
- Privacy notice and art. 9 disclosures.
- Public-source provenance and original purpose.
- Sharing recipients and international routes.
- Retention schedule and each supporting legal obligation/right.
- Actual rights-request and receipt chronology.
- Identity and representative-verification procedure.
- Correction and downstream-propagation records.
- Automated-decision architecture and degree of human involvement.
- Small-agent eligibility, revenue/group and high-risk facts.
- Sector-specific negative/positive/SCR/protest/public-record rules.
- Applicable state/DF/public-authority and municipal procedures.
- Current official versions of each consequential source at actual use.
Final disposition: PASS-08 establishes the narrow current federal LGPD gateway for ordinary personal-data scope, roles, purposes, legal bases, transparency, data-subject access, correction, deletion, revocation, objection, automated-decision review and small-agent deadlines. It does not establish that any actual debt-information operation, consent, retention, disclosure, automated decision, provider, contract or database is lawful, unlawful, deletable, compensable, licensed or accepted.
END C_BR PASS-08