Articles 17 to 22 of the LGPD (Brazilian General Data Protection Law) grant data subjects a series of rights over their personal data, including access, rectification, erasure and portability. Companies need efficient channels to receive and fulfill these requests.
Data Subject Rights Under the LGPD
The LGPD establishes the following rights for personal data subjects:
- Confirmation of processing: Knowing whether their data is being processed
- Access: Obtaining a copy of the data processed
- Rectification: Updating incomplete or outdated data
- Anonymization: Requesting the anonymization of unnecessary data
- Portability: Transferring data to another provider
- Erasure: Requesting the deletion of data processed on the basis of consent
- Withdrawal of consent: Withdrawing previously given consent
- Objection: Contesting processing based on legitimate interests
Why Have a Dedicated Channel
The ANPD (Brazilian Data Protection Authority) recommends that companies maintain a specific channel to receive and process data subject requests. A dedicated portal offers:
- Complete traceability of requests
- Control of response deadlines (15 business days)
- Verification of the requester's identity
- Recording of evidence of request handling
- Generation of reports for audits
Legal deadline: The LGPD requires simplified access requests to be fulfilled immediately and complete requests within 15 business days. Failure to comply may lead to sanctions.
How to Implement the Portal
Essential Requirements
An efficient data subject portal should include:
- An intuitive form for submitting requests
- A field for selecting the type of right
- Identity verification (documents, multi-factor authentication)
- A secure communication channel between the data subject and the DPO
- A dashboard for tracking the status of the request
- Multilingual support where applicable
Best Practices
- Publish the portal link in the privacy policy and in the website footer
- Use QR codes on printed materials that collect data
- Train the service team on LGPD rights
- Automate deadline notifications to avoid non-compliance
Integrated portal: The DPO Privacy Data Subject Portal module includes identity verification, secure communication with the data subject, a compliance seal, QR code generation and complete traceability, all without the need for custom development.
