Lei Geral de Proteção de Dados Pessoais (LGPD)
Welcome. Here you will find the content of Law No. 13,709, dated August 14, 2018 (LGPD - Text given by Law No. 13,853 of 2019), accessible in its original form at official PDF, in an easy and organized manner. All the articles are listed below and in the side menu. If you find this page helpful, feel free to support us by sharing the project.
Índice
Chapter 1
Preliminary Provisions
- Art. 6 Activities of processing of personal data shall be done in good faith and be subject to the following principles
- Art. 5 For purposes of this Law, the following definitions apply
- Art. 4 This Law does not apply to the processing of personal data that
- Art. 3 This Law applies to any processing operation carried out by a natural person or a legal entity of either public or private law
- Art. 2 he discipline of personal data protection is grounded on the following
- Art. 1 This Law provides for the processing of personal data
Chapter 2
Processing of personal data
- Art. 16 The processing of personal data shall be terminated under the following circumstances:
- Art. 15 The processing of personal data shall be terminated under the following circumstances
- Art. 14 The processing of personal data belonging to children and adolescents shall be done in their best interest
- Art. 13 When carrying out public health studies, research entities may have access to personal databases
- Art. 12 Anonymized data shall not be considered personal data, for purposes of this Law
- Art. 11 The processing of sensitive personal data shall only occur in the following situations
- Art. 10
- Art. 8 The consent provided in item I of Art. 7 of this Law shall be given
- Art. 9 The data subject has the right to facilitated access to information concerning the processing of her/his data
Chapter 3
Data Subjects’Rights
- Art. 22 The defense of the interests and rights of data subjects may be carried out in court
- Art. 21 Personal data concerning the regular exercise of rights by the data subject cannot be used to her/his detriment
- Art. 20 The data subject has the right to request for the review of decisions made solely based on automated processing
- Art. 19 Confirmation of the existence of or access to personal data shall be provided by means of request by the data subject
- Art. 18 The data subject , regarding the data subject’s data being processed by the controller
- Art. 17 Every natural person is assured ownership of her/his personal data, with the fundamental rights of freedom
Chapter 4
Rules
- Art. 32. The national authority may request agents of the public authorities to publish impact
- Art. 31 When there is an infringement of this Law as a result of personal data processing by public agencies
- Art. 28 vetoed
- Art. 30 The national authority may establish complementary
- Art. 29. The national authority may request, at any time, for bodies and entities of the Public Administration
- Art. 27 The shared use of personal data by public authorities shall fulfill the specific purposes of execution
- Art. 26 The shared use of personal data by public authorities shall fulfill the specific purposes of execution of public policies
- Art. 25 Data shall be kept in an interoperable format and structured for shared use intended for the execution of public policies
- Art. 24 Public companies and mixed-capital companies that operate in the competing market
Chapter 5
International transfer data
- Art. 36 Changes to guarantees presented as sufficient for compliance with the general
- Art. 35 The definition of the content of standard contractual clauses, as well as the verification of specific contractual clauses for a particular transfer
- Art. 34 The level of data protection in the foreign country or international organization referred to in item I of the lead sentence of Art
- Art. 33 International transfer of personal data is only allowed in the following cases
Chapter 6
Personal data processing agents
- Art. 45 When there is a violation of data subject’s rights in the scope of consumer relations
- Art. 44. Processing of personal data shall be deemed irregular when it does not obey the legislation
- Art. 43 Processing agents shall not be held liable only when they prove that
- Art. 42 The controller or the processor that, as a result of carrying out their activity of processing personal data
- Art. 41 The controller shall appoint a data protection officer to be in charge of processing personal data
- Art. 40 The national authority may provide standards of interoperability for purposes of portability
- Art. 39 The processor shall carry out the processing according to the instructions provided by the controller
- Art. 38 The national authority may determine that the controller must prepare a data protection impact assessment
- Art. 37 The controller and the processor shall keep records of personal data processing operations carried out by them
Chapter 7
Security and good pratices
- Art. 51 The national authority shall encourage the adoption of technical standards
- Art. 50 Controllers and processors
- Art. 49 The systems used for processing personal data shall be structured in order to meet the security requirements
- Art. 48 The controller must communicate to the national authority and to the data subject the occurrence of a security incident
- Art. 46 Processing agents shall adopt security, technical and administrative measures able to protect personal data
Chapter 8
Monitoring
- Art. 54 The amount of daily fines applied to infractions of this Law shall observe the severity of the infraction and the extent of the damage or losses caused
- Art. 53 The national authority shall define the methodologies that will be used for the calculation of the base value for fines
- Art. 52 Data processing agents that commit infractions of the rules provided in this Law
Chapter 9
The national data protection authority ("ANPD") and the nationalcouncil for protection of personal data and privacy
Chapter-10
Final and transitional provisions
- Art. 65
- Art. 64 The rights and principles expressed in this Law do not exclude others provided in the Brazilian legal system
- Art. 63 The national authority shall establish rules on the progressive suitability of databases established up to the date this Law comes into force
- Art. 62 The national authority and the Anísio Teixeira National Institute for Educational Studies and Research (Inep)
- Art. 61 The foreign company shall be notified and summonsed of all procedural acts provided in this Law
- Art. 60 Law No. 12,965, of April 23, 2014 (the “Brazilian Internet Law”), shall henceforth contain the following alterations
