Article 7 of Brazil's LGPD (Lei Geral de Proteção de Dados, the General Data Protection Law) lists 10 legal bases for processing personal data: consent, a legal or regulatory obligation, public policies, research, a contract, the exercise of rights in proceedings, protection of life, protection of health, legitimate interest and protection of credit. Every processing operation needs at least one of them, and the law ranks none above the others.
That is four more than the six lawful bases in the GDPR, and the extra ones change how Brazilian businesses justify everyday processing. If your website collects data from people in Brazil, the basis you choose decides which rights they can use, what you must document and whether you need a cookie banner choice at all. The LGPD's official text on Planalto, the Brazilian presidency's legislation site, is the source for every article cited below.
The 10 bases at a glance
| Article 7 | Legal basis | Typical use on a website or in a business |
|---|---|---|
| I | Consent of the data subject | Marketing emails, advertising and analytics cookies |
| II | Legal or regulatory obligation | Tax records, invoices, payroll |
| III | Public policies (public administration only) | Benefits and public programmes |
| IV | Studies by a research body | Academic and statistical research |
| V | Contract or pre-contract steps requested by the data subject | Delivering an order, sending a quote |
| VI | Regular exercise of rights in judicial, administrative or arbitration proceedings | Keeping records of a customer dispute |
| VII | Protection of life or physical safety | A medical emergency |
| VIII | Protection of health, by health professionals, health services or health authorities only | Clinical care |
| IX | Legitimate interests of the controller or a third party | Fraud prevention, some service improvements |
| X | Protection of credit | Credit scoring and credit bureaus |
Documenting the choice is part of accountability. Article 37 asks controllers and processors to keep records of their processing operations, especially those based on legitimate interest, and the ANPD (Agência Nacional de Proteção de Dados), a regulatory agency since Law 15.352 of 25 February 2026, can ask to see them. Choose the basis before you collect: a basis picked after the fact to rescue processing that never had one is hard to defend.
Each basis in practice
1. Consent of the data subject
Consent under the LGPD must be a free, informed and unambiguous expression of will for a specific purpose. If you rely on it, Article 8 puts the burden of proving it on you. Generic authorisations are void, a written consent clause must stand out from the rest of a contract, and the data subject can revoke consent at any time through a free and easy procedure. The consent requirements article covers revocation and the common mistakes in detail.
Consent also travels badly. Article 7(5) says a controller that obtained consent and wants to share the data with other controllers needs specific consent for that sharing. A purchased email list therefore rarely comes with consent you can use: the people on it agreed to the seller, not to you.
For websites, the ANPD's guide on cookies and personal data (October 2022) says consent is the most appropriate basis for non-necessary cookies, such as those used for advertising or behavioural profiles, and not appropriate for cookies that are strictly necessary for the site to work.
2. Compliance with a legal or regulatory obligation
You can process personal data to meet a duty imposed by law or regulation: tax reporting, payroll records or retention periods set by a sector regulator.
3. Execution of public policies
Only the public administration can use this basis, to process and share data needed for public policies set out in laws or regulations or backed by contracts and agreements.
4. Studies by a research body
Research bodies can process personal data for studies, and the law requires them to anonymise it whenever possible.
5. Performance of a contract
Processing is allowed when it is necessary to perform a contract the data subject is party to, or for preliminary steps the data subject asked for. An online shop that uses a shipping address to deliver an order relies on this basis, and so does a business that sends a quote someone requested.
6. Regular exercise of rights in proceedings
Data can be processed to exercise rights in judicial, administrative or arbitration proceedings, the last under Brazil's Arbitration Law (Law 9.307/1996). Companies keep customer dispute records or disciplinary files on this basis, limited to what the purpose needs.
7. Protection of life or physical safety
Processing is lawful when needed to protect the life or physical safety of the data subject or a third party. Medical emergencies are the obvious case. This is the LGPD's counterpart to the GDPR's vital interests.
8. Protection of health
This basis is reserved for procedures carried out by health professionals, health services or health authorities. It has no direct counterpart among the GDPR's six bases and is closer to the health-care condition in Article 9(2)(h) GDPR.
Article 11 adds limits for health data. Health plan operators may not use it to select risks when contracting or to exclude beneficiaries, and sharing health data between controllers for economic advantage is prohibited except in narrow cases such as portability requested by the data subject.
9. Legitimate interests of the controller
Processing can rest on the legitimate interests of the controller or a third party, unless the data subject's fundamental rights and freedoms that require protection prevail. Article 10 names two examples: supporting and promoting the controller's activities, and protecting the data subject's rights or providing services that benefit them, within their legitimate expectations. Only the data strictly necessary for the purpose may be processed, the controller must keep the processing transparent, and the ANPD may ask for a data protection impact report.
The ANPD's legitimate interest guide (February 2024) sets out a three-stage balancing test: purpose, necessity, and balancing with safeguards. If the result is inconclusive, another basis must be used. The European approach to the same basis is covered in legitimate interest as a legal basis.
10. Protection of credit
The LGPD allows processing to protect credit, including under the specific credit legislation. Credit bureaus and scoring rely on it in Brazil, while the GDPR has no equivalent basis.
Sensitive data has a shorter list
Sensitive personal data covers racial or ethnic origin, religious belief, political opinion, trade union or religious, philosophical or political membership, health or sex life, and genetic or biometric data. Article 11 replaces the 10 bases with its own list.
The main route is consent given in a specific and highlighted way for specific purposes. Without consent, processing is allowed only where it is indispensable for a closed set of cases: a legal or regulatory obligation, public policies, research, the exercise of rights (including in contracts), protection of life, protection of health, or fraud prevention and the data subject's security in identification and authentication. Legitimate interest and protection of credit are not on the list.
How the LGPD bases map to the GDPR
Most bases line up with the GDPR's Article 6, but four do not have a direct match.
| LGPD basis | Closest GDPR equivalent | Difference |
|---|---|---|
| Consent (I) | Consent, Article 6(1)(a) | Very similar: free, informed, unambiguous, for a specific purpose |
| Legitimate interest (IX) | Legitimate interests, Article 6(1)(f) | The LGPD names promoting the controller's activities as an example |
| Protection of life (VII) | Vital interests, Article 6(1)(d) | Same idea |
| Protection of health (VIII) | No Article 6 basis, closest to Article 9(2)(h) | Only health professionals, health services and health authorities |
| Protection of credit (X) | None | EU credit scoring usually relies on legitimate interests or a legal obligation |
| Research (IV), rights in proceedings (VI) | No separate Article 6 basis | The LGPD makes them bases in their own right |
The GDPR's six bases are explained in the guide to the lawful basis for processing, and the privacy laws by region overview compares Brazil with other countries.
The basis you choose shapes the data subject's rights
Most rights in Article 18 apply whatever the basis: confirmation that processing exists, access, correction, anonymisation, blocking or deletion of unnecessary or unlawful data, portability to another provider under ANPD rules, and information about who the data was shared with.
Some depend on the basis. Where you rely on consent, the data subject can revoke it and can request the erasure of the data processed with it, subject to the retention cases in Article 16, such as a legal obligation. You must also tell people they can refuse consent and what follows if they do. Where you rely on another basis, Article 18(2) lets data subjects object if the processing breaks the law.
Access requests have a deadline. Under Article 19, a simplified confirmation or access is provided immediately, and a full statement giving the origin of the data, the criteria used and the purpose within 15 days of the request.
Questions about LGPD legal bases
Do I need consent for every tracking mechanism under LGPD?
The LGPD has no cookie-specific rule, but the ANPD's 2022 cookie guide says consent is the most appropriate basis for non-necessary cookies, such as advertising and behavioural profiling, and not appropriate for strictly necessary cookies.
What happens if a user revokes their consent?
Processing carried out before the revocation remains valid as long as there is no request for erasure (Article 8(5)). From then on, processing that relied on that consent must stop.
Can I change my legal basis later?
The LGPD has no article on switching bases, but it expects the basis to be chosen, recorded and explained to data subjects before processing starts. If the purpose changes beyond what a consent covered, Article 9(2) requires telling the data subject first, who can then revoke consent.
Can I use a purchased email list under the LGPD?
Rarely on consent. Article 7(5) requires specific consent before a controller shares consent-based data with other controllers, so the people on a bought list must have agreed to their data going to you.
Does the LGPD apply to companies outside Brazil?
Yes. Article 3 applies the law wherever a company is based when the processing happens in Brazil, aims to offer goods or services to people in Brazil, or uses personal data collected in Brazil.
Is protection of credit a valid basis in Europe?
No. Protection of credit is a legal basis specific to the LGPD. Organisations in the EU usually rely on legitimate interests or a legal obligation for similar credit checks.
Match each cookie on your site to a basis
The cookie question comes down to which cookies are strictly necessary and which need consent. The free Cookie scanner lists the cookies your pages set and sorts them into categories, so you can see which ones should wait for a visitor's choice.
