> For the complete documentation index, see [llms.txt](https://www.opensourcelaw.com.br/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.opensourcelaw.com.br/en/legislation/4.-general-data-protection-law.md).

# 4. General Data Protection Law

The LGPD applies to <mark style="background-color:purple;">any data processing operation</mark> carried out in the national territory, directed at individuals in the national territory, or involving data that were collected in the national territory, <mark style="background-color:purple;">by a natural person or a public- or private-law legal entity</mark>.

{% hint style="info" %}
The law does not apply to the processing of personal data carried out by a natural person <mark style="background-color:purple;">for exclusively private and non-economic purposes</mark>, as well as to any operation carried out for exclusively journalistic, artistic, academic, public security, national defense, state security, or investigation and prosecution of criminal offenses purposes.
{% endhint %}

## Definitions:

* **Personal Data:** information related to a natural person;
* **Sensitive Personal Data:** of racial or ethnic origin, religious belief, political opinion, union membership or membership in a religious, philosophical, or political organization, data concerning health or sexual life, genetic or biometric data;
* **Anonymized Data**: related to a data subject who cannot be identified;
* **Controller:** natural or legal person responsible for decisions regarding the processing of personal data;
* **Processor:** natural or legal person who processes personal data on behalf of the controller;
* **Data Protection Officer:** person who acts as a communication channel between the controller, data subjects, and the National Data Protection Authority (ANPD);
* **Processing Agents:** the controller and the processor;
* **Processing:** any operation performed with personal data;
* **Consent:** <mark style="background-color:purple;">free, informed, and unequivocal expression</mark> by which the data subject agrees to the processing of their personal data for a <mark style="background-color:purple;">specific purpose</mark>;
* **Blocking:** temporary suspension of any processing operation;
* **Deletion:** deletion of data or a set of data; and
* **Personal Data Protection Impact Report:** controller documentation containing the description of personal data processing processes that may generate risks, as well as measures, safeguards, and risk mitigation mechanisms.

{% hint style="info" %}
The data subject's consent for data processing is one of the most important pillars of the law. However, if the data subject makes their data publicly available, the requirement for prior consent will be waived.
{% endhint %}

{% hint style="warning" %}
The controller that needs to share data with other controllers must obtain new <mark style="background-color:purple;">specific consent</mark> for this purpose.
{% endhint %}

{% hint style="warning" %}
Generic authorizations for the processing of personal data are considered void.
{% endhint %}

In addition, <mark style="background-color:purple;">if there are changes in purpose</mark> for the processing of personal data that are not compatible with the initial consent, the controller must inform the data subject in advance, who may revoke consent if they disagree with the changes, in compliance with the <mark style="background-color:purple;">right to withdraw consent</mark>.

{% hint style="info" %}
Anonymized data will not be considered personal data, <mark style="background-color:purple;">except when the anonymization process is reversed or can be reversed</mark>.
{% endhint %}

## Principles:

* **Purpose**: processing for legitimate, specific, explicit, and informed purposes, with no possibility of subsequent processing in a manner incompatible with those purposes;
* **Adequacy:** compatibility of the processing with the purposes;
* Necessity: limitation of processing to the minimum necessary to achieve its purposes;
* **Free Access:** guarantee of easy and free consultation on the form and duration of personal data processing;
* **Data Quality:** guarantee of accuracy, clarity, relevance, and updating of the data;
* **Transparency:** guarantee of clear, accurate, and easily accessible information about the processing and the processing agents;
* **Accountability and Responsibility:** demonstration of the adoption of effective measures to prove compliance with personal data protection rules.

## Obligations:

* notify the ANPD and the data subject of security incidents within a reasonable time;
* draw up <mark style="background-color:purple;">good privacy and governance practices rules</mark>;
* draw up <mark style="background-color:purple;">educational actions</mark>;
* provide internal and external oversight and risk mitigation mechanisms;
* draw up <mark style="background-color:purple;">response plans</mark> for incidents and remediation;&#x20;
* carry out systematic assessment processes of privacy impacts and risks and <mark style="background-color:purple;">continuous monitoring</mark>.

For projects that carry out international data transfers, this will only be allowed if:

* to countries or international organizations that provide the same degree of protection of personal data as Brazilian law;
* the controller provides contractual guarantees, global corporate rules, seals, certificates, and data protection codes of conduct;
* the data subject has given specific and prominent consent to the transfer, with prior information about the international nature of the operation.

## Penalties:

* warning;
* daily fine;
* simple fine of up to 2% (two percent) of the legal entity's revenue, excluding taxes, limited in total to R$ 50,000,000.00 (fifty million reais) per violation;
* public disclosure of the violation;
* blocking of the personal data to which the violation refers;
* deletion of the personal data to which the violation refers;
* partial suspension of the operation of the database to which the violation refers for a maximum period of 6 (six) months, extendable for an equal period;
* suspension of the processing activity of the personal data to which the violation refers for a maximum period of 6 (six) months, extendable for an equal period;
* partial or total prohibition of the exercise of activities related to data processing.