Processes personal data, in Brazil

Lei nº 12.414, de 9 de junho de 2011 (Lei do Cadastro Positivo), arts. 3º, 4º, 7º, 7º-A, 10, 12, 14 and 15 · Read the law's page

• Store in a credit-history database only objective, clear, true and easily understood information needed to assess the registered person's economic situation, and never excessive information or sensitive information (social and ethnic origin, health, genetic information, sexual orientation, political, religious or philosophical convictions).
• Notify the registered person, at no cost, within 30 days after opening the registry and state the channels for cancelling it, unless the person already has a registry in another database.
• Give enquirers the credit history only with the registered person's specific prior authorization, and keep procedures that prove that the authorization is authentic and valid.
• Use the information held only to analyze the registered person's credit risk or to support credit, a sale on credit or another transaction that carries financial risk to the enquirer, and let only enquirers that keep or intend to keep a commercial or credit relationship with the person access it.
• Do not keep payment-performance information in a database for more than 15 years.
• Do not require exclusivity from the sources of information.
• Publish on your website, in clear and accessible form, your policy for collecting and using personal data to prepare credit-risk analyses.
• Do not use in a credit score information unrelated to credit risk, information on origin, health, genetic information, sex or political, religious or philosophical convictions, information on persons who are not first-degree relatives or economic dependents of the registered person, or information on the registered person's exercise of the right of access.

Lei nº 12.414, de 9 de junho de 2011 (Lei do Cadastro Positivo), arts. 5º and 6º · Read the law's page

• Cancel or reopen a registry when the registered person asks, free of charge, within 2 business days, and pass the request to the other managers.
• Let the registered person access free of charge, without giving a reason, the information held, including the credit history and credit score, and provide it within 10 days.
• Correct or cancel, within 10 days and in every database that shared it, an entry that the registered person challenges as wrong.
• On request, give the registered person all the information held, its sources, the managers it was shared with, every enquirer that accessed it in the previous 6 months, a summary of the person's rights and confirmation of any cancellation.

Decreto nº 9.936, de 24 de julho de 2019 (regulamenta a Lei do Cadastro Positivo), arts. 2º, 7º, 8º, 9º, 10, 12, 13 and 18 · Read the law's page

• Hold net equity of at least R$ 100,000,000, shown by financial statements audited by an independent auditor registered with the Securities Commission, and hold independent technical certifications of your platform security and information-security policy, renewed at least every three years and reviewed every year.
• Give a registered person's credit history to an enquirer only with the person's prior and specific authorization, and let the person revoke an authorization at any time.
• Let a registered person cancel or reopen the registry at any time, and suspend an enquirer's access to the person's credit score within two business days of the request, passing the request to the other managers.
• Report a leak of registered persons' information or another security incident that may cause relevant risk or harm to the Autoridade Nacional de Proteção de Dados, the Central Bank of Brazil or the National Consumer Secretariat, according to the data involved, within two business days of learning of it, and promptly notify the persons affected.
• Let only enquirers that keep or intend to keep a commercial or credit relationship with the registered person access the person's information, and keep policies and controls that ensure it.
• Give the registered person free access, on your website and by telephone, to the information you hold, the sources that supplied it, the managers it was shared with and the enquirers that saw the credit history and score in the previous six months.
• Keep the authorizations and the cancellation, reopening, deletion, revocation and correction requests on file for at least 15 years after the registry is cancelled.

Lei nº 13.709, de 14 de agosto de 2018 (LGPD), arts. 1º-10, 15-16, 23-32, 37-41, 46-47, 49-51 (general regime, principles, lawful basis, public-sector processing, agents and governance) · Read the law's page

• Establish a lawful basis under article 7 before processing personal data, including data the person has made public.
• Take consent only when it is provided in writing or by another means demonstrating the data subject's free will, in a clause set apart from the other contract terms, and be ready to prove it meets these requirements.
• Keep a record of your processing operations, especially those based on legitimate interest, and name a person in charge (encarregado) whose identity and contact details you publish, preferably on your website.
• Adopt technical and administrative security measures suited to protect personal data against unauthorized access and accidental or unlawful destruction, loss, alteration, communication, or improper processing, from the design of the product or service through its execution.
• Delete personal data once processing ends, unless retention is needed to comply with a legal or regulatory obligation, for research with anonymization where possible, for an authorized transfer, or for your own exclusive anonymized use.
• As a public body, publish clear, up to date information about the legal basis, purpose and procedures for any processing you carry out, name a person in charge for it, and do not pass on personal data you hold to a private entity except in the cases the law lists.when it serves a public body

Lei nº 13.709, de 2018 (LGPD), art. 48 (security incident notification) · Read the law's page

• Notify the ANPD and the affected data subjects of a security incident that may create relevant risk or harm to data subjects, within the reasonable period the ANPD sets by regulation, and state the reasons for the delay when the notice is not immediate.
• Describe in the notification the nature of the personal data affected, the data subjects involved, the technical and security measures used, the risks related to the incident, and the measures taken or planned to reverse or mitigate its effects.
• Expect the ANPD to assess the incident's severity, and comply if it orders wide publicity of the incident or measures to reverse or mitigate its effects.

Lei nº 13.709, de 2018 (LGPD), arts. 17-19, 21-22 (rights of the data subject) · Read the law's page

• Let a data subject confirm that processing exists, access their data, correct it, or have it anonymized, blocked, deleted, or ported to another provider, on request.
• Answer a confirmation-of-processing or access request immediately in simplified form, or within 15 days with a complete, clear statement of the data's origin, the criteria used, and the purpose of the processing.
• Tell a data subject which public and private entities you shared their data with, let them object to processing carried out under a consent exemption where it violates this law, and let them revoke consent at any time through a free and easy procedure.
• Let a data subject or their legal representative bring an individual or collective judicial action to defend their personal-data rights.

Lei nº 13.709, de 2018 (LGPD), arts. 33-36 (international transfer of data) · Read the law's page

• Transfer personal data outside Brazil only to a country or organization with an adequate level of protection, or under contractual clauses, corporate rules, or another article 33 safeguard.
• Where you rely on standard contractual clauses, specific contractual clauses, global corporate rules, or a certification seal for a transfer, use only a form the ANPD has verified or approved, and report any change to those safeguards to it.
• Get the data subject's specific, highlighted consent before an international transfer that does not rest on an adequacy finding or another article 33 safeguard, telling them in advance that the operation is international.

Lei nº 13.709, de 2018 (LGPD), arts. 5º, II, 11-14 (sensitive personal data and children's data) · Read the law's page

• Obtain specific, highlighted consent, or another article 11 legal basis, before processing sensitive personal data such as health, genetic, or biometric data.
• Process a child's or adolescent's personal data only with specific, highlighted consent from at least one parent or legal guardian, except to contact the parent once without storing the data or to protect the child, and never condition participation in a game, application, or other activity on more personal data than the activity strictly needs.
• Do not treat anonymized data as personal data unless the anonymization process can be reversed using your own means or with reasonable effort, and treat data used to build an identifiable behavioral profile as personal data again.
• Give a public-health research body access to personal data only within a controlled and secure environment, anonymized or pseudonymized where possible, and never transfer that data to a third party.
• Do not share sensitive health data between controllers for economic advantage, except for the data subject's requested portability or the listed health-service, pharmaceutical, or health-assistance transactions.

Lei nº 13.709, de 2018 (LGPD), arts. 42-45, 52-54, 55-A a 58-B (civil liability, administrative sanctions and the ANPD) · Read the law's page

• Expect administrative sanctions, including a simple fine of up to 2% of the private legal entity's, group's, or conglomerate's revenue in Brazil in its last fiscal year, excluding taxes, capped in total at R$50,000,000.00 per infraction, for violations the ANPD investigates through due administrative process.
• As a controller or operator, repair patrimonial, moral, individual, or collective damage you cause a person by processing personal data in violation of the data-protection legislation, and expect a court to shift the burden of proof to you where the data subject's allegation is plausible.
• Expect the ANPD to require information from you at any time, to receive and act on data-subject complaints, and to inspect and sanction noncompliant processing through a process that guarantees your defense and right of appeal.
• Comply with an ANPD warning's corrective-measures deadline before facing escalation to a fine, publicity of the infraction, blocking or deletion of the data involved, or suspension of the processing activity.

Resolução CD/ANPD nº 1, de 28 de outubro de 2021 (Regulamento do Processo de Fiscalização e do Processo Administrativo Sancionador), Anexo, arts. 5º and 6º · Read the law's page

• Give the ANPD copies of the documents, data and information it asks for to assess your processing activities, within the period, at the place, and in the format and other conditions it sets.
• Allow the ANPD access to your facilities, equipment, applications, systems, tools, documents and data relevant to assessing your processing, whether held by you or by third parties, and let it learn which information systems you use to process data.
• Submit to audits the ANPD carries out or orders, keep documents, data and information for the periods set by law and regulation and for as long as an administrative proceeding that needs them runs, and make available on request a representative with the knowledge and authority to support the ANPD.

Lei nº 14.289, de 3 de janeiro de 2022, arts. 2º, 3º and 6º · Read the law's page

• Do not disclose information that identifies a person as living with HIV or chronic hepatitis B or C, or as a person with leprosy or tuberculosis, in a health service, school, workplace, public administration, public security body, court proceeding or written or audiovisual media.
• Break professional secrecy over that condition only where a law requires it, for just cause, or with the person's express authorization (the legal guardian's, for a child) given by a signed informed-consent form, subject to article 11 of the LGPD.
• Protect the information on those persons held in a public or private health service or a private health-plan operation, and keep it confidential where it could identify the condition.
• Organize care in a health service so that the general public cannot identify the condition.

Emenda Constitucional nº 115, de 10 de fevereiro de 2022, arts. 1º-3º (Constituição Federal, arts. 5º, LXXIX, 21, XXVI and 22, XXX) · Read the law's page

• Respect, in any processing of personal data, the constitutional right to the protection of personal data, including in digital media, as the law defines it.

Resolução CD/ANPD nº 15, de 24 de abril de 2024 (Regulamento de Comunicação de Incidente de Segurança), Anexo, arts. 4º-6º, 9º and 10 · Read the law's page

• Notify the ANPD of a security incident that may create relevant risk or damage to data subjects within three business days of learning that it affected personal data, unless a specific law sets another period, and send the notice through the data protection officer or an authorized representative on the ANPD's electronic form.
• Include in the notice to the ANPD the nature and category of the data affected, the number of data subjects, the security measures used before and after the incident, the risks and possible impacts, the reasons for any delay, the measures taken or planned, the dates of the incident and of your knowledge of it, the officer's details, the controller's identification, and the other particulars article 6, paragraph 2 lists.
• Notify the affected data subjects within three business days of learning that the incident affected personal data, in plain language, and directly and individually where you can identify them.
• Where direct and individual notice is not feasible or the data subjects cannot be identified, announce the incident within the same period through means such as your website, applications, social media and service channels, so that it stays visible for at least three months.
• Keep a record of every security incident, including one not reported to the ANPD or to data subjects, for at least five years, stating the date you learned of it, the circumstances, the nature and category of data, the number of data subjects, the risk assessment, the corrective measures, the form and content of any notice, and the reasons for not giving notice.

Resolução CD/ANPD nº 18, de 16 de julho de 2024 (Regulamento sobre a atuação do encarregado pelo tratamento de dados pessoais), Anexo, arts. 3º, 5º, 8º-10 and 19-21 · Read the law's page

• Appoint a data protection officer by a formal written, dated and signed act that states how the officer acts and what the officer does, and give the act to the ANPD when it asks.
• If you are a public body that processes personal data, appoint an officer and publish the appointment in the official gazette of the Union, the state, the Federal District or the municipality.for a public body
• Publish the officer's identity and contact details on your website, clearly and prominently, and keep them current; the contact details must let data subjects exercise their rights and let the ANPD reach the officer.
• Give the officer the human, technical and administrative means to work, technical autonomy, and direct access to senior management, and give data subjects fast and effective ways to reach the officer.
• Do not give the officer duties that create a conflict of interest, and if one arises, decline to appoint the person, take measures to remove the risk, or replace the officer.

Resolução CD/ANPD nº 19, de 23 de agosto de 2024 (Regulamento de Transferência Internacional de Dados), Anexo I, arts. 4º, 9º, 16, 17, 21 and 28 · Read the law's page

• Base every international transfer of personal data on a legal basis in article 7 or 11 of the LGPD and on a valid transfer mechanism: an ANPD adequacy decision, standard contractual clauses, global corporate rules, specific contractual clauses, or the hypotheses in article 33, items II(d) and III to IX, of the LGPD.
• Limit the transfer to the minimum necessary for its purposes, covering only data that are pertinent, proportionate and not excessive.
• Check whether the processing is an international transfer, whether it falls under Brazilian data protection law, and whether it rests on a valid legal basis and transfer mechanism, and adopt measures able to show compliance and their effectiveness.
• When you rely on the ANPD's standard contractual clauses, adopt the text of Annex II in full and without alteration in a contract between exporter and importer, and let no other term of the contract exclude, modify or contradict the clauses.
• Give a data subject who asks the full text of the clauses used for the transfer within 15 days, unless specific ANPD regulation sets another period and subject to trade and industrial secrecy, and publish on your website a plain-language document in Portuguese about the transfer.
• Submit specific contractual clauses and global corporate rules to the ANPD for approval before relying on them, and obtain its prior approval for any later change to them.

Lei nº 15.211, de 17 de setembro de 2025 (Estatuto Digital da Criança e do Adolescente), arts. 7º, 16, 22 and 26 · Read the law's page

• Configure any product or service directed at children and adolescents, or likely to be accessed by them, by default to the most protective privacy and data-protection setting available, and do not process their personal data in a way that causes, facilitates or contributes to a violation of their privacy.
• When you process the data of children and adolescents, above all for purposes not strictly necessary to run the product or service, map the risks, make efforts to mitigate them and prepare a data-protection impact, monitoring and evaluation report to share when the authority requests it.
• Do not use profiling techniques to direct commercial advertising at children and adolescents.
• Do not build behavioral profiles of child and adolescent users from their personal data, including data obtained in age verification, to direct commercial advertising.

Lei nº 12.965, de 23 de abril de 2014 (Marco Civil da Internet), art. 7º · Read the law's page

• Do not supply a user's personal data, including connection records and application access records, to third parties unless the user gives free, express and informed consent or the law provides for it.
• Give the user clear and complete information on how personal data are collected, used, stored, processed and protected, and use them only for purposes that justify the collection, that the law does not prohibit and that the service contract or terms of use specify.
• Obtain the user's express consent to the collection, use, storage and processing of personal data, given apart from the other contract clauses.
• Delete definitively, when the user asks at the end of the relationship, the personal data the user supplied to the application, except records that the law requires you to keep.

Lei nº 8.078, de 11 de setembro de 1990 (Código de Proteção e Defesa do Consumidor), art. 43 · Read the law's page

• Give the consumer access, on request, to the information kept on him or her in registries, files and records, and to its sources.
• Keep consumer registries and data objective, clear, true and in easily understood language, with no negative information covering more than five years.
• Tell the consumer in writing when you open a registry on him or her that the consumer did not ask for.
• Correct inaccurate data immediately when the consumer asks, and tell the recipients of the incorrect information of the change within five business days.
• Do not supply, once a consumer debt is time-barred, information that could hinder the consumer's new access to credit.