Sensitive personal data under Brazil's LGPD (Lei Geral de Proteção de Dados, Law No. 13.709/2018) is personal data about racial or ethnic origin, religious belief, political opinion, trade union membership or affiliation to a religious, philosophical or political organisation, health or sex life, and genetic or biometric data, when linked to a natural person. In Portuguese the law calls it dados pessoais sensíveis. Article 11 limits how it may be processed: with consent given in a specific and prominent way for specific purposes, or without consent only where processing is indispensable for one of seven listed purposes. Legitimate interest and protection of credit are not among them.
What counts as sensitive personal data
Article 5(II) of the LGPD's official text sets a closed list. Sensitive personal data is data about a person's:
- Racial or ethnic origin
- Religious belief
- Political opinion
- Trade union membership
- Affiliation to a religious, philosophical or political organisation
- Health or sex life
- Genetic data
- Biometric data
The list is close to what the GDPR calls special categories of data in Article 9, which already includes trade union membership. The LGPD's addition is affiliation to religious, philosophical or political organisations as a category of its own. Article 11(1) also extends the rules to any processing that reveals sensitive data and may harm the person, so data that is not sensitive on its face can become sensitive through what it reveals.
Why the distinction matters
Sensitive data carries a higher risk of discrimination and harm. A leaked medical record can affect insurance, an exposed political opinion can lead to harassment, and a biometric template, once compromised, cannot be replaced the way a password can. The LGPD answers with tighter rules on the legal basis, on sharing and, in the health sector, on commercial use.
Article 11 offers two routes
The LGPD gives ten legal bases for ordinary personal data in Article 7. For sensitive data, Article 11 replaces them with a shorter list.
Route 1: specific and prominent consent
The data subject or their legal guardian consents "de forma específica e destacada", in a specific and prominent way, for specific purposes. Specific means the consent cannot be bundled into general terms. Prominent means it stands out: a separate checkbox or section that says which sensitive data is collected and why. The ANPD's guide on cookies and personal data of October 2022 recommends exactly that: placing the authorisation apart from the main text and naming the sensitive data and the purpose. The general LGPD consent requirements apply on top.
Route 2: processing without consent
Without consent, sensitive data may be processed only when it is indispensable for one of these purposes (Article 11(II)):
| Exception | Typical scenario |
|---|---|
| Legal or regulatory obligation | An employer keeps occupational health records a regulation requires |
| Public policies carried out by the public administration | A public health body processes data for a vaccination campaign |
| Studies by a research body, anonymised where possible | A university uses health records for epidemiological research |
| Regular exercise of rights, including in contracts and in judicial, administrative or arbitration proceedings | A party submits medical evidence in a court case |
| Protection of life or physical safety | A hospital checks a patient's blood type in an emergency |
| Health protection, only by health professionals, health services or health authorities | A doctor processes patient records for a diagnosis |
| Fraud prevention and the data subject's security in identification and authentication in electronic systems | A bank uses biometric verification at login |
Legitimate interest and protection of credit are not on the list, and contracts appear only as part of the exercise of rights. That is a real difference from the GDPR, where processing special category data needs both an Article 6 basis and an Article 9 condition, but the conditions include grounds such as employment and social security law.
Employee data shows how this works in practice. Health information an employer must keep for occupational health and safety rules rests on the legal obligation exception. Anything collected beyond what a rule requires, for example in a voluntary wellness programme, needs the employee's specific and prominent consent, given freely despite the employment relationship.
Health data has extra limits
Article 11 adds two rules for health data. Sharing it between controllers to obtain economic advantage is prohibited, except in health services, pharmaceutical assistance and healthcare for the benefit of data subjects, and for portability the data subject requests or the transactions those services involve. Health plan operators may not use health data to select risks when contracting or to exclude beneficiaries.
Biometric data is where the ANPD looks
The ANPD's list of supervision activities on its supervision page shows how much of its work concerns biometrics. It includes an investigation into Tools for Humanity over biometric data of World ID users in the Worldcoin project, the Paraná state education department over facial recognition of children and adolescents, and more than a dozen football clubs over biometric data of fans, including children, collected under the General Sports Law. A sanctioning proceeding against the pharmacy chain RaiaDrogasil concerns alleged behavioural profiling from sensitive data to sell targeted advertising.
For a website, biometrics matter as soon as you offer face or fingerprint login or verification to users in Brazil. The fraud-prevention exception in Article 11(II)(g) may cover authentication, but only while the rights in Article 9 are respected and the person's fundamental rights do not prevail.
Sensitive data and cookies
Most cookies do not hold sensitive data: a session cookie stores an identifier, not a diagnosis. The risk comes from what tracking reveals. Analytics and advertising tags on a pharmacy, a clinic, a religious community's site or a political campaign can record visits that point to a person's health, belief or opinion, and an advertising profile built from them can turn those visits into sensitive data under Article 11(1).
The ANPD's 2022 guide already says non-necessary cookies that build behavioural profiles should rest on consent. Where the site's subject matter makes the profile sensitive, that consent must meet Article 11's specific and prominent standard, not only the general one.
LGPD and GDPR compared
| Aspect | GDPR (Article 9) | LGPD (Article 11) |
|---|---|---|
| Term used | Special categories of personal data | Sensitive personal data (dados pessoais sensíveis) |
| Categories | Racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic, biometric, health, sex life or sexual orientation | The same areas, plus affiliation to religious, philosophical or political organisations as its own category |
| Legitimate interest | Not an Article 9 condition, but an Article 6 basis alongside one | Not available |
| Consent standard | Explicit consent | Specific and prominent consent for specific purposes |
| Fraud prevention | No standalone condition | Article 11(II)(g) for identification and authentication |
| Breach notification | 72 hours to the authority | 3 working days to the ANPD and data subjects |
| Maximum fine | EUR 20 million or 4% of worldwide turnover | 2% of revenue in Brazil, capped at R$50 million per infringement |
Penalties for getting sensitive data wrong
Article 52 sets the same sanctions for sensitive data as for any other infringement, but sensitivity weighs on the seriousness of the case. Fines can reach 2% of revenue in Brazil, excluding taxes, capped at R$50 million per infringement, and the ANPD can also order publication, blocking or deletion of the data, suspension of a database or processing activity for up to 6 months, or a ban. Public bodies cannot be fined. The LGPD enforcement article lists the sanctions the ANPD has applied so far.
Practical steps for website owners
1. Audit what you collect
Run a cookie scan and review every data point your site collects from Brazilian users. Advertising pixels, analytics tools and social widgets can record visits that reveal health, political or religious interests, and you remain the controller for what you set on your site.
2. Separate consent for sensitive purposes
If you collect biometric data or another sensitive category, ask for it in its own, highlighted step that names the data and the purpose. A single "Accept all" button on a cookie banner does not meet Article 11.
3. Document your legal basis
For each sensitive data flow, record the Article 11 route you rely on. With consent, keep proof of how it was given. With an exception, record why the processing is indispensable, not merely useful.
4. Prepare for incidents
An incident involving sensitive data meets one of the risk criteria in Resolution CD/ANPD No. 15/2024, so expect to notify the ANPD and the people affected within 3 working days if it can also significantly affect their interests and rights. Keep every incident in your register for at least 5 years. The details are in LGPD data breach notification.
5. Watch the ANPD's agenda
The ANPD, a regulatory agency since Law 15.352 of 25 February 2026, publishes its regulatory agenda and its list of regulations on its site. As of October 2026, check that list before relying on older guidance on biometrics, impact assessments, children's data or AI. Brazil's rules sit alongside others on the privacy laws by region overview.
Questions about sensitive data under the LGPD
What types of data are considered sensitive under the LGPD?
Article 5(II) lists racial or ethnic origin, religious belief, political opinion, trade union membership, affiliation to religious, philosophical or political organisations, health or sex life, genetic data and biometric data, when linked to a natural person.
Can I use legitimate interest to process sensitive data under the LGPD?
No. Article 11 does not include legitimate interest or protection of credit. You need specific and prominent consent or one of the seven exceptions in Article 11(II).
Do cookies collect sensitive personal data?
Most do not directly. Tracking on sites about health, religion or politics can reveal sensitive attributes, and under Article 11(1) processing that reveals sensitive data and may cause harm falls under the same stricter rules.
What is the maximum fine for mishandling sensitive data in Brazil?
Up to 2% of the company's or group's revenue in Brazil, excluding taxes, capped at R$50 million per infringement. Daily fines, data blocking or deletion, suspensions and bans are also available.
How quickly must I report a breach involving sensitive data to the ANPD?
Within 3 working days of learning that the incident affected personal data, under Resolution CD/ANPD No. 15/2024, when it may cause relevant risk or damage. Sensitive data is one of the criteria for that risk. The people affected must be told within the same period.
How does the LGPD treat employee health data?
Health data an employer must keep under occupational health rules rests on the legal obligation exception in Article 11(II)(a). Anything beyond what a rule requires needs the employee's specific and prominent consent.
See which trackers run on your sensitive pages
Pages about health, faith or politics are where ordinary trackers turn into sensitive data. The free Script audit shows the third-party domains a page loads, the service and category behind each and whether it sets cookies before a choice.
