Art. 4 This Law does not apply to the processing of personal data that

Art. 4

This Law does not apply to the processing of personal data that:

I – is done by a natural person exclusively for private and non-economic purposes;

II – is done exclusively:

a) for journalistic and artistic purposes; or

b) academic purposes, with Arts. 7 and 11 of this Law being applicable in these cases;

III – is done exclusively for purposes of:

a) public safety;

b) national defense;

c) state security; or

d) activities of investigation and prosecution of criminal offenses; or

IV– have their origin outside the national territory and are not the object of communication, shared use of data with Brazilian processing agents or the object of international transfer of data with another country that is not the country of origin, since the country of origin provides a level of personal data protection adequate to that established in this Law.

§1 Processing of personal data as provided in item III shall be governed by specific legislation, which shall provide proportional and strictly necessary measures for fulfilling the public interest, subject to due legal process, the general principles of protection and the rights of the data subjects as provided in this Law.

§2 Processing of the data referred to in item III of the lead sentence of this article is forbidden for legal entity of private law, except in procedures under the authority of legal entity of public law, of which the national authority shall be specifically informed and which shall observe the limitation imposed in §4 of this article.

§3 The national authority shall issue technical opinions or recommendations regarding the exceptions provided in item III of the lead sentence of this article, and shall request of the responsible parties a data protection impact assessment.

§4 Under no circumstances the entirety of the personal data in a database, as provided in Item III of the lead sentence of this article, may be processed by a legal entity of private law.

§4 §4 Under no circumstances the entirety of the personal data in a database, as provided in Item III of the lead sentence of this article, may be processed by a legal entity of private law, unless its capital is integrally held by public entities. (New Wording Given by Law No. 13,853/2019)