BrazilLGPD, rights of the data subject
Lei nº 13.709, de 2018 (LGPD), arts. 17-19, 21-22 (rights of the data subject)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Let a data subject confirm that processing exists, access their data, correct it, or have it anonymized, blocked, deleted, or ported to another provider, on request.NIST Privacy FrameworkCT.PO-P3
- Answer a confirmation-of-processing or access request immediately in simplified form, or within 15 days with a complete, clear statement of the data's origin, the criteria used, and the purpose of the processing.NIST Privacy FrameworkCT.DM-P1
- Tell a data subject which public and private entities you shared their data with, let them object to processing carried out under a consent exemption where it violates this law, and let them revoke consent at any time through a free and easy procedure.NIST Privacy FrameworkCM.AW-P4NIST Privacy FrameworkCT.PO-P3
- Let a data subject or their legal representative bring an individual or collective judicial action to defend their personal-data rights.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P4Records of data disclosures and sharing are maintained and can be accessed for review or transmission/disclosure.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 17 to 19 and 21 to 22 set the data subject's rights and the time limits for answering them (immediately in simplified form, or within 15 days with a complete declaration). Article 19, paragraph 1 requires personal data to be stored in a format that favors the exercise of the right of access, which concerns the data itself and not a log or a record of processing. None of the cited articles requires a log or a record; the controller's register of processing operations is in Article 37, which this row does not cite.
- Kind
- None
- As of
What this law does
Article 17 assures every natural person title to their own personal data and the fundamental rights of liberty, intimacy and privacy that the LGPD protects.
Article 18 gives the data subject the right to confirm processing exists, access, correct, anonymize, block, delete, or port their data to another provider, learn which public and private entities the controller shared their data with, learn the consequences of withholding consent, and revoke consent at any time through a free and easy procedure, and article 19 requires the controller to answer a confirmation or access request immediately in simplified form or within 15 days with a full, clear statement of the data's origin, the criteria used, and the treatment's purpose.
Article 21 bars using data about a data subject's exercise of their own rights to their detriment, and article 22 lets the data subject or a representative defend these rights in an individual or collective judicial action.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .