LGPD, rights of the data subject

Lei nº 13.709, de 2018 (LGPD), arts. 17-22 (rights of the data subject)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 18 September 2020.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Let a data subject confirm that processing exists, access their data, correct it, or have it anonymized, blocked, deleted, or ported to another provider, on request.
Give a data subject a way to request review, by a natural person, of any decision made solely on automated processing of their personal data, including a decision that defines their personal, professional, consumer, or credit profile, and explain on request the criteria and procedures used for it.
Answer a confirmation-of-processing or access request immediately in simplified form, or within 15 days with a complete, clear statement of the data's origin, the criteria used, and the purpose of the processing.
Tell a data subject which public and private entities you shared their data with, let them object to processing carried out under a consent exemption where it violates this law, and let them revoke consent at any time through a free and easy procedure.
Let a data subject or their legal representative bring an individual or collective judicial action to defend their personal-data rights.

What it reaches

Obligation class

Data subject rights, Disclosure, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 17 assures every natural person title to their own personal data and the fundamental rights of liberty, intimacy and privacy that the LGPD protects.

Article 18 gives the data subject the right to confirm processing exists, access, correct, anonymize, block, delete, or port their data to another provider, learn which public and private entities the controller shared their data with, learn the consequences of withholding consent, and revoke consent at any time through a free and easy procedure, and article 19 requires the controller to answer a confirmation or access request immediately in simplified form or within 15 days with a full, clear statement of the data's origin, the criteria used, and the treatment's purpose.

Article 20 gives the data subject the right to request review, by a natural person, of a decision taken solely on automated processing of their personal data that affects their interests, including a decision defining their personal, professional, consumer, or credit profile, and requires the controller to explain, on request, the criteria and procedures behind the automated decision.

Article 21 bars using data about a data subject's exercise of their own rights to their detriment, and article 22 lets the data subject or a representative defend these rights in an individual or collective judicial action.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions

Read the law

Official compiled text of Lei nº 13.709/2018, Presidência da República

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app