The LGPD, Brazil's Lei Geral de Proteção de Dados (General Data Protection Law), gives every person nine rights over their personal data in Article 18: confirmation that their data is processed, access, correction, anonymisation, blocking or deletion of unnecessary data, portability, deletion of data processed on consent, information about who received the data, information about refusing consent, and withdrawal of consent. Article 20 adds a tenth, the review of automated decisions.
The rights apply whenever a controller is within the LGPD's reach: processing in Brazil, offering goods or services to people in Brazil or processing their data, or collecting data on Brazilian territory. Ignoring them can lead to sanctions from the ANPD, including fines of up to 2% of a company's Brazilian revenue, capped at BRL 50 million per infringement.
The nine rights under Article 18
Article 18 of the LGPD lets data subjects exercise these rights at any time, on request and free of charge. Each one creates a duty for the controller.
| Right | Article 18, item | What the controller must do |
|---|---|---|
| Confirmation of processing | I | Confirm whether personal data is being processed |
| Access | II | Give the data subject the data processed about them |
| Correction | III | Correct incomplete, inaccurate or outdated data |
| Anonymisation, blocking or deletion | IV | Anonymise, block or delete unnecessary or excessive data, or data processed against the law |
| Portability | V | Transfer data to another provider on express request, under ANPD regulation |
| Deletion of consent-based data | VI | Delete data processed on the basis of consent, except where Article 16 allows it to be kept |
| Information on sharing | VII | Say which public and private entities the data was shared with |
| Information on refusing consent | VIII | Explain that consent can be refused and what follows |
| Withdrawal of consent | IX | Let the data subject withdraw consent through a free and easy procedure |
Two more provisions sit outside Article 18. Article 20 gives the right to ask for a review of decisions made solely by automated processing that affect the person's interests, including decisions that define a personal, professional, consumer or credit profile. Article 21 forbids using data about someone's lawful exercise of their rights against them.
Confirmation and access come first
The right to confirm whether processing is happening, and to see the data, is the base of every other right. A data subject who does not know what a controller holds cannot meaningfully ask for correction, deletion or portability.
Article 19 sets two response formats. A simplified confirmation is due immediately. A clear and complete statement, covering the origin of the data, any absence of records, the criteria used and the purpose of processing, is due within 15 days of the request. That is half the one month the GDPR allows, and the law has no general extension for complex requests. Article 19, paragraph 4, lets the ANPD set different deadlines for specific sectors.
Under Article 19, paragraph 3, when processing is based on consent or a contract, the data subject can ask for a full electronic copy of their personal data in a format that allows later use, including in other processing. Commercial and industrial secrets stay protected.
Correction, blocking and deletion
Data subjects can ask controllers to correct incomplete, inaccurate or outdated personal data at any time. The law sets no format or channel for a correction request.
The right to anonymisation, blocking or deletion under Article 18, IV, applies to data that is unnecessary, excessive or processed against the LGPD. It is separate from the deletion right in Article 18, VI, which covers data processed on the basis of consent. Once consent is withdrawn, the controller must delete that data unless Article 16 allows it to be kept:
- To meet a legal or regulatory obligation of the controller.
- For study by a research body, anonymised wherever possible.
- To transfer to a third party, as long as the LGPD's processing rules are respected.
- For the controller's exclusive use, with no third-party access, and only if the data is anonymised.
A further duty follows from Article 18, paragraph 6. When a controller corrects, deletes, anonymises or blocks data, it must immediately tell every processing agent it shared the data with, so they can do the same. The only exception is where that is shown to be impossible or would take disproportionate effort.
Data portability waits for ANPD rules
The right to data portability lets individuals ask for their data to be transferred to another provider of a service or product. The request must be express, and the transfer follows ANPD regulation and protects commercial and industrial secrets.
Portability does not cover data the controller has already anonymised (Article 18, paragraph 7). Article 40 lets the ANPD set interoperability standards for portability. As of October 2026, its list of published regulations includes rules on security incidents, the data protection officer, international transfers and sanctions, but no regulation on portability or on data subject rights in general.
For SaaS products and platforms with users in Brazil, the right still has practical consequences. You need a documented way to extract a user's personal data in a structured, machine-readable format and send it to a third party they name.
Withdrawing consent and objecting
Article 8, paragraph 5, says consent can be withdrawn at any time by an express request, through a free and easy procedure. Processing carried out while consent was valid stays lawful, unless the data subject also asks for deletion under Article 18, VI. The rules on giving and revoking consent under the LGPD have their own guide.
Separately, Article 18, paragraph 2, lets data subjects object to processing based on one of the legal bases that do not need consent, such as legitimate interest, where the controller does not comply with the LGPD. That is narrower than the general right to object in Article 21 of the GDPR, but it still gives people a way to challenge processing they believe is unlawful.
The ANPD's 2024 action against Meta shows how these rights meet in practice. In July 2024 it ordered Meta to stop using Brazilian users' data to train generative AI models, with a daily fine of BRL 50,000 for non-compliance, after finding problems with transparency and with how users could object.
Review of automated decisions (Article 20)
Article 20 lets data subjects ask for a review of decisions made solely by automated processing of their personal data that affect their interests. That covers decisions that define personal, professional, consumer and credit profiles, and aspects of personality.
On request, the controller must give clear and adequate information about the criteria and procedures behind the automated decision. If it refuses on the grounds of commercial or industrial secrecy, the ANPD can audit the processing for discriminatory aspects.
How controllers must respond
Article 18, paragraph 3, says rights are exercised through an express request by the data subject or their legal representative to the processing agent. No format is set, so requests can arrive by email, phone, letter or an online form.
| Request type | Deadline | Source |
|---|---|---|
| Simplified confirmation of processing | Immediately | Article 19, I |
| Detailed access statement | 15 days | Article 19, II |
| Other Article 18 rights | The deadlines set by regulation, free of charge | Article 18, paragraph 5 |
If the controller cannot act immediately, Article 18, paragraph 4, allows two responses: say that it is not the processing agent and name the agent where possible, or give the factual or legal reasons that prevent immediate action. Every response is free.
Data subjects who think their rights were ignored can petition the ANPD directly (Article 18, paragraph 1) and also consumer protection bodies (paragraph 8). Article 22 allows individual and collective court actions.
LGPD and GDPR rights compared
The LGPD's rights closely follow the GDPR's, with practical differences that matter for teams answering requests in both systems.
| Aspect | LGPD | GDPR |
|---|---|---|
| Number of rights | 9 in Article 18, plus automated decision review in Article 20 | 8 core rights (Articles 15 to 22) |
| Access response deadline | Immediately (simplified) or 15 days (detailed) | 1 month, extendable by 2 months |
| Extension for complex requests | None in the law (sector rules possible) | Up to 2 more months with notice |
| Right to object | Limited to non-consent bases where the LGPD is breached | Broader, covers legitimate and public interest processing |
| Portability format | Not yet specified (the ANPD is to regulate it) | Structured, commonly used and machine-readable |
| Breach notice to data subjects | For incidents that may cause relevant risk or damage, within 3 working days (Resolution CD/ANPD No. 15/2024) | Only when the risk to rights and freedoms is high |
| Data protection officer | All controllers, except small processing agents exempted by Resolution CD/ANPD No. 2/2022 | Only in specific circumstances (Article 37) |
The LGPD makes information about data sharing (Article 18, VII) a right of its own, where the GDPR covers it within the right to be informed. For websites operating under both laws, the shorter LGPD deadlines usually set the pace.
What happens when rights are ignored
The ANPD is now the Agência Nacional de Proteção de Dados (National Data Protection Agency): Law No. 15,352 of 25 February 2026 made it a regulatory agency with functional, technical, decision-making, administrative and financial autonomy (Article 55-A). In December 2025 it adopted its map of priority topics for 2026 and 2027 (Resolution CD/ANPD No. 30/2025).
Its first fine, in July 2023, hit Telekall Infoservice, a small telemarketing company: BRL 14,400 in two simple fines for processing without a legal basis and for breaching the ANPD's enforcement regulation, plus a warning for having no data protection officer. On 24 August 2026 the agency fined ByteDance Brasil BRL 153.8 million at first instance over the data of under-18s registered on TikTok without a valid legal basis, and ordered deletion of data it could not regularise. LGPD enforcement and fines are covered in detail in a separate guide.
Steps for website owners
If your website collects data from visitors in Brazil through cookies, forms, user accounts or analytics, you are probably a controller under the LGPD and have to make these rights work in practice.
- Appoint a data protection officer and publish their contact details on your website. Small processing agents are exempt under Resolution CD/ANPD No. 2/2022, but they must still offer a channel for requests, and the exemption does not cover high-risk processing or companies above the revenue limits.
- Set up a documented intake for requests: a dedicated email address, a web form or a privacy portal. Log every request with the date received and the date answered.
- Map your data flows so you know where personal data sits, who can see it and which third parties received it. Without that, you cannot answer access, portability or sharing requests in time.
- Run a cookie scan to find every first-party and third-party cookie, and make sure your banner collects consent for specific purposes, as Articles 7 and 8 require.
- Build deletion and anonymisation workflows that reach every system and processor, and tell everyone you shared the data with (Article 18, paragraph 6).
Short answers on LGPD rights
How quickly must a controller answer an LGPD access request?
A simplified confirmation of processing is due immediately. A detailed statement covering the origin of the data, the criteria and the purposes is due within 15 days of the request (Article 19).
Can a controller charge a fee for LGPD requests?
No. Article 18, paragraph 5, says requests are answered at no cost to the data subject, within the deadlines and terms set by regulation.
Does the LGPD right to portability apply to anonymised data?
No. Article 18, paragraph 7, excludes data the controller has already anonymised from the portability right.
What is the difference between deletion under Article 18, IV and Article 18, VI?
Item IV covers anonymising, blocking or deleting data that is unnecessary, excessive or processed against the LGPD, whatever the legal basis. Item VI covers deleting data processed on the basis of consent, subject to the retention cases in Article 16.
Can someone in Brazil ask for a review of an automated decision?
Yes. Article 20 gives the right to ask for a review of decisions made solely by automated processing that affect the person's interests, including credit, consumer and personality profiling. The controller must explain the criteria used, or the ANPD may audit the process.
What penalties can the ANPD impose for ignoring data subject rights?
Warnings with deadlines for corrective measures, fines of up to 2% of the company's Brazilian revenue excluding taxes (capped at BRL 50 million per infringement), publication of the infringement, blocking or deletion of the data, and suspension or prohibition of processing.
Handle consent requests from Brazilian visitors
Kukie.io gives visitors from Brazil a banner, which can be shown in Brazilian Portuguese, where they can accept, reject or withdraw consent at any time, and keeps a record of every choice you can export when someone asks what they agreed to. It is one part of a setup for privacy laws around the world.
