The LGPD (General Data Protection Law) was established to regulate the guidelines that organizations must follow when handling personal data and to ensure the rights of data subjects.

As the law is already in force, Brazilians can not only exercise, but also demand their rights. On the other hand, it is necessary to emphasize that people must be prepared to handle requests.

Before delving into the topic of this article, it is necessary to reinforce that, within the LGPD, personal data consists of any information capable of identifying a person.

According to the law, the data provided always belongs to the individual, and not to the company that collects or controls it. Therefore, when we mention "data subject", we refer to the person to whom the data relates. Indeed, this point is reinforced in Article 17 of the LGPD, which highlights:

“Every natural person is assured ownership of their personal data and guaranteed the fundamental rights of freedom, intimacy, and privacy, under the terms of this Law.” Subsequently, the law specifically presents the rights of data subjects, which we will discuss now.

LGPD: discover what the rights of data subjects are.

1. Confirmation of the existence of processing

First of all, it is necessary to clarify that data processing refers to any activity related to personal data, such as collection, storage, use, and classification.

According to the rules of the law, the data subject has the right to confirm whether a company carries out the processing of their personal information.

In addition, the LGPD also establishes that the response can be made immediately, through a complete declaration that informs the origin of the data, the criteria used, and the purpose of the processing. In the latter case, the organization has a period of 15 days to respond to the user, starting from the date of the request.

2. Access to data

It is also the subject's right to request access to their data. In other words, it is possible to obtain copies of the personal information that the company stores in its files. Just like the confirmation of processing, this request can also be fulfilled in a simplified manner or through a complete declaration, within a period of 15 days, starting from the date of the request.

3. Rectification of data

The subject can request the organization to correct outdated, incomplete, or inaccurate personal data, such as changes in mailing address, telephone number, or marital status.

4. Anonymization, blocking, or elimination of data

If they wish, the subject has the right to request the anonymization of the data (a process that prevents information from being linked to an individual), as well as the blocking or elimination of data when it is considered excessive, unnecessary, or treated in non-compliance with the rules established by the Law.

5. Data portability

The LGPD also provides that the subject can request data portability or the transfer of the provided information to another service provider or product supplier.

However, for this to occur, an express request is required, following a regulation that must be established by the ANPD (National Data Protection Authority).

It is also important to mention that portability does not cover data that has already been anonymized by the controller, since this type of information is not included in the scope of the LGPD.

6. Elimination of data processed with consent

If the data subject consented to the processing, but later changed their mind, they can request the elimination of this data.

However, this right cannot be exercised in all situations, such as, for example, when the organization needs to preserve the data to comply with a legal or regulatory obligation.

7. Information about data sharing

Above all, the LGPD values transparency. Therefore, it establishes that the subject has the right to complete information about the controller sharing their data, and this covers public and private entities, which must be duly named and not just generically mentioned.

8. Information on the choice to withhold consent

Considering that consent is only effective if the information is requested and granted in a clear, transparent, and completely free manner, the LGPD determines that the data subject has the right to be informed about the possibility of not providing it, and also the consequences if consent is denied.

This occurs, for example, when a user chooses whether or not to consent to the use of cookies within a website. If the withholding of consent affects their browsing experience or prevents access to certain tools, the user must be properly informed.

9. Revocation of consent

Lastly, any consent directed to the processing of personal data can be revoked. This is a right of the subject, who can make a request to revoke the consent.

However, it is worth noting that for the data processed up to that point to be truly eliminated, a specific request must be made.

10. Other rights

In addition to the nine main rights of the subject provided in its Article 18, the LGPD mentions others, such as, for example:

• The right to lodge a complaint against the controller with the ANPD and consumer protection agencies.

•  The right to object to processing carried out without consent, if it is not in compliance with the law.

However, it is necessary to emphasize that none of the rights are fully absolute, meaning there are situations where organizations cannot meet the subject's rights. In such cases, they must state the reasons for the denials, such as compliance with legal or regulatory obligations.

Anyway, did you enjoy discovering the main rights of data subjects according to the LGPD?

If this article was useful to you, share its content on your social networks and bring this information to more people who might be interested.

In addition, keep an eye on the CodeBit Blog. Soon, we will have news here.

A big hug, and see you in the next post!