Art. 1 - This Law provides for the processing of personal data, including by digital means, by a natural person or a legalArt. 2 - The discipline of personal data protection is grounded on the following:Art. 3 - This Law applies to any processing operation carried out by a natural person or a legal entity of public orArt. 4 - This Law does not apply to the processing of personal data that:Art. 5 - For purposes of this Law, the following definitions apply:Art. 6 - Activities of processing of personal data shall be done in good faith and be subject to the following principles:
Section I - Requirements for the Processing of Personal Data
Art. 7 - Processing of personal data shall only be carried out under the following circumstances:Art. 8 - The consent provided in Item I of Art. 7 of this Law shall be given in writing or by anotherArt. 9 - The data subject has the right to facilitated access to information concerning the processing of her/his data, which much beArt. 10 - Controller’s legitimate interest can only be grounds for processing personal data for legitimate purposes, based on particular situations, which includeSection II - Processing of Sensitive Personal Data
Art. 11 - The processing of sensitive personal data shall only occur in the following situations:Art. 12 - anonymised data shall not be considered personal data, for purposes of this Law, except when the process of anonymisation toArt. 13 - When carrying out public health studies, research entities may have access to personal databases, which shall be processed exclusively withinSection III - Processing of Children and Adolescents’ Personal Data
Art. 14 - The processing of personal data belonging to children and adolescents shall be done in their best interest, pursuant to thisSection IV - Termination of Data Processing
Art. 15 - The processing of personal data shall be terminated under the following circumstances:Art. 16 - Personal data shall be deleted following the termination of their processing, within the scope and technical limits of the activities,Art. 17 - All natural person is assured ownership of her/his personal data, with the fundamental rights of freedom, intimacy and privacy beingArt. 18 - The personal data subject has the right to obtain the following from the controller, regarding the data subject’s data beingArt. 19 - Confirmation of the existence of or access to personal data shall be provided by means of request by the dataArt. 20 - The data subject has the right to request review, by a natural person, of decisions taken solely on the basesArt. 21 - Personal data concerning the regular exercise of rights by the data subject cannot be used to her/his detriment.Art. 22 - The defence of the interests and rights of data subjects may be carried out in court, individually or collectively, as
Section I - Rules
Art. 23 - Processing of personal data by legal entities of public law referred to in sole paragraph of Art. 1 of LawArt. 24 - Public companies and mixed-capital companies that operate in the competing market, subject to the provisions of Art. 173 of theArt. 25 - Data shall be kept in an interoperable format and structured for shared use intended for the execution of public policies,Art. 26 - The shared use of personal data by public authorities shall fulfill the specific purposes of execution of public policies andArt. 27 - Communication or shared use of personal data from a legal entity of public law to a legal entity of privateArt. 28 - (vetoed)Art. 29 - The national authority may request, at any time, that entities of the public authority carry out operations of processing ofArt. 30 - The national authority may establish complementary rules for communication or shared used of personal data activities.Section II - Accountability
Art. 31 - When there is an infringement of this Law as a result of personal data processing by public agencies, the nationalArt. 32 - The national authority may request agents of the public authorities to publish impact reports on protection of personal data andArt. 33 - International transfer of personal data is only allowed in the followingArt. 34 - The level of data protection in the foreign country or international organisation referred to in Item I of the leadArt. 35 - The definition of the content of standard contractual clauses, as well as the verification of specific contractual clauses for aArt. 36 - Changes to guarantees presented as sufficient for compliance with the general principles of protection and of the data subject’s rights
Section I - Controller and Processor
Art. 37 - The controller and the processor shall keep records of personal data processing operations carried out by them, especially when basedArt. 38 - The national authority may determine that the controller must prepare an impact report on protection of personal data, including sensitiveArt. 39 - The processor shall carry out the processing according to the instructions provided by the controller, which shall verify the obedienceArt. 40 - The national authority may provide standards of interoperability for purposes of portability, free access to data and security, as wellSection II - Data Protection Officer
Art. 41 - The controller shall appoint an officer to be in charge of processing personal data. §1 The identity and contact informationSection III - Liability and Loss Compensation
Art. 42 - The controller or the processor that, as a result of carrying out their activity of processing personal data, cause material,Art. 43 - Processing agents shall only not be held liable when they prove that:Art. 44 - Processing of personal data shall be irregular when it does not obey the legislation or when it does not provideArt. 45 - When there is violation of data subject’s right in the scope of consumer relations, the rules of liability provided inSection I - Security and Secrecy of Data
Art. 46 - Processing agents shall adopt security, technical and administrative measures able to protect personal data from unauthorised accesses and accidental orArt. 47 - Processing agents or any other person that intervenes in one of the processing phases undertake to ensure the security ofArt. 48 - The controller must communicate to the national authority and to the data subject the occurrence of a security incident thatArt. 49 - The systems used for processing personal data shall be structured in order to meet the security requirements, standards of goodSection II - Good Practice and Governance
Art. 50 - Controllers and processors, within the scope of their competences, concerning processing of personal data, individually or in associations, may formulateArt. 51 - The national authority shall encourage the adoption of technical standards that facilitate data subjects’ control of their personal data.Section I - Administrative Sanctions
Art. 52 - Data processing agents that commit infractions of the rules provided in this Law are subject to the following administrative sanctions,Art. 53 - The national authority shall define the methodologies that will be used for the calculation of the base value for fines,Art. 54 - The amount of daily fines applied to infractions of this Law shall be subject to the severity of the infractionSection I - The National Authority for Protection of Data (“ANPD”)
Art. 55 - (vetoed)Art. 56 - (vetoed)Art. 57 - (vetoed)Section II - The National Board for the Protection of Personal Data and Privacy
Art. 58 - (vetoed)Art. 59 - (vetoed)Art. 60 - Law No. 12,965, of April 23, 2014 (the “Brazilian Internet Law”), shall henceforth contain the following alterations: “Art. 7 …Art. 61 - The foreign company shall be notified and summonsed of all procedural acts provided in this Law, irrespective of power ofArt. 62 - The national authority and the Anísio Teixeira National Institute for Educational Studies and Research (Inep), within the scope of theirArt. 63 - The national authority shall establish rules on the progressive suitability of databases established up to the date this Law comesArt. 64 - The rights and principles expressed in this Law do not exclude others provided in the Brazilian legal system related toArt. 65 - This Law shall come into force eighteen (18) months following its official publication.
X – processing: any operation carried out with personal data, such as collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation or control of the information, modification, communication, transfer, dissemination or extraction;
IV – free access: guarantee to the data subjects of facilitated and free of charge consultation about the form and duration of the processing, as well as about the integrity of their personal data;
VI – transparency: guarantee to the data subjects of clear, precise and easily accessible information about the carrying out of the processing and the respective processing agents, subject to commercial and industrial secrecy;
VII – security: use of technical and administrative measures which are able to protect personal data from unauthorised accesses and accidental or unlawful situations of destruction, loss, alteration, communication or dissemination; VIII – prevention: adoption of measures to prevent the occurrence of damages due to the processing of personal data;
§3 The processing of publicly accessible personal data shall consider the purpose, the good faith and the public interest that justify its being made available.
The data subject has the right to facilitated access to information concerning the processing of her/his data, which much be made available in a clear, adequate and ostensible manner, concerning, among other characteristics provided in regulation for complying with the principle of free access:
When carrying out public health studies, research entities may have access to personal databases, which shall be processed exclusively within the entity and strictly for the purpose of carrying out studies and research and shall be kept in a controlled and secure environment, in accordance with security practices provided in specific regulation and that include, whenever possible, anonymisation or pseudonymization of the data, as well as taking into account the proper ethical standards related to studies and research.
§3 Access to data as provided in this article shall be the object of regulation by the national authority and of the authorities in the area of health and sanitation, within the scope of their competences.
§6 Information on the processing of data referred to in this article shall be provided in a simple, clear and accessible manner, taking into account the physical-motor, perceptive, sensorial, intellectual and mental characteristics of the user, using audiovisual resources when appropriate, in order to provide the necessary information to the parents or the legal representative and that is appropriate for the children’s understanding.
IV – exclusive use of the controller, with access by third parties being prohibited, and provided the data has been anonymised.
I – confirmation of the existence of the processing; II – access to the data;
Confirmation of the existence of or access to personal data shall be provided by means of request by the data subject:
§1 Personal data shall be stored in a format that facilitates the exercise of the right to access.
Processing of personal data by legal entities of public law referred to in sole paragraph of Art. 1 of Law No. 12,527, of November 18, 2011 (the “Brazilian Access to Information Law”), shall be done in fulfillment of its public purpose, in benefit of the public interest, for the purpose of performing legal competences or discharging legal attributions of the public service, provided that:
I – they communicate the situations in which, in the exercise of their competences, they carry out processing of personal data, supplying clear and up-to-date information about the legal base, purpose, procedures and practices used to carry out these activities in easily accessible media, preferably on their websites;
§2 The provisions of this Law do not release the legal entities mentioned in the lead sentence of this article from establishing the authorities as provided in Law No. 12,527, of November 18, 2011 (the “Brazilian Access to Information Law”).
§3 The time periods and procedures for exercising data subjects’ rights before the public authorities shall obey the provisions of specific legislation, especially the provisions of Law No. 9,507, of November 12, 1997 (the “Brazilian Habeas Data Law”), of Law No. 9,784, of January 29, 1999 (the “Federal Administrative Procedure Law”), and of Law No. 12,527, of November 18, 2011 (the “Brazilian Access to Information Law”).
§5o Notarial and registry bodies shall provide access to data by electronic means to the public administration, in view of the purposes mentioned in the lead sentence of this article.
Data shall be kept in an interoperable format and structured for shared use intended for the execution of public policies, provision of public services, decentralization of public activity, dissemination and access to information by the general public.
The shared use of personal data by public authorities shall fulfill the specific purposes of execution of public policies and legal attributions by agencies and public entities, subject to the principles of personal data protection listed in Art. 6 of this Law. §1 It is forbidden for public authorities to transfer to private entities personal data contained in databases to which they have access, except: I – in cases of decentralized execution of public activity that requires transfer, exclusively for this specific and distinct purpose, subject to the provisions of Law No. 12,527, of November 18, 2011 (the “Brazilian Access to Information Law”); II – (vetoed); and II – in cases in which the data are publicly accessible, subject to the provisions of this Law. §2 Contracts and agreements as mentioned in §1 of this article shall be communicated to the national authority.
IX – when it is necessary to satisfy the situations provided in Items II, V and VI of Art. 7 of this Law. Sole paragraph. For purposes of Item I of this article, the legal entities of public law referred to in the sole paragraph of Art. 1 of Law No. 12,527, of November 18, 2011 (the “Brazilian Access to Information Law”), within their legal competences, and those parties accountable, within the scope of their activities, may request the national authority to evaluate the level of protection of personal data provided by a country or international organisation.
The national authority may provide standards of interoperability for purposes of portability, free access to data and security, as well as regarding time records must be kept, especially in view of the need and the transparency.
Processing agents shall adopt security, technical and administrative measures able to protect personal data from unauthorised accesses and accidental or unlawful situations of destruction, loss, alteration, communication or any type of improper or unlawful processing.
§3 When judging the severity of the incident, eventual demonstration that adequate technical measures were adopted to render the affected personal data unintelligible will be analysed, within the scope and the technical limits of the services, to third parties who were not authorised to access them.
§3 The provisions of Items I, IV, V, VI, VII, VIII and IX of the lead sentence of this article may be applied to public entities and bodies, without prejudice to the provisions of Laws Nos. 8,112, of December 11, 1990 (the “Legal Framework for Public Servants”), 8,429, of June 2, 1992 (the “Administrative Improbity Law”), and 12,527, of November 18, 2011 (the “Brazilian Access to Information Law”).
The national authority and the Anísio Teixeira National Institute for Educational Studies and Research (Inep), within the scope of their competences, shall enact specific regulations for accessing data processed by the Union for compliance with the provisions of §2 of Art. 9 of Law No. 9,394, of December 20, 1996 (the “Directive and Bases of National Education Act”), and those relating to the National Higher Education Evaluation System (Sinaes), as provided in Law No. 10,861, of April 14, 2004.
