Article 5
Definitions
For the purposes of this Law, the following shall be considered:
- I - personal data: information related to an identified or identifiable natural person;
- II - sensitive personal data: personal data on racial or ethnic origin, religious conviction, political opinion, union affiliation or religious, philosophical or political organization, health or sexual life data, genetic or biometric data, when linked to a natural person;
- III - anonymized data: data relating to the holder that cannot be identified, considering the use of reasonable technical means available at the time of processing;
- IV - database: structured set of personal data, established in one or more places, in electronic or physical support;
- V - data subject: natural person to whom the personal data being processed refer;
- VI - controller: natural or legal person, whether public or private, to whom decisions regarding the processing of personal data are made;
- VII - operator: natural or legal person, whether public or private, that processes personal data on behalf of the controller;
- VIII - person in charge: person appointed by the controller and operator to act as a communication channel between the controller, the data subjects and the National Data Protection Authority (ANPD);
- IX - processing agents: the controller and the operator;
- X - processing: any operation performed with personal data, such as those regarding the collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation or control of information, modification , communication, transfer, diffusion or extraction;
- XI - anonymization: use of reasonable and available technical means at the time of treatment, by which a given data loses the possibility of direct or indirect association with an individual;
- XII - consent: free, informed and unambiguous expression by which the data subject agrees to the processing of his personal data for a determined purpose;
- XIII - blockade: temporary suspension of any processing operation, through the blockage of personal data or the database;
- XIV - deletion: deletion of data or dataset stored in database, regardless of the procedure employed;
- XV - international data transfer: transfer of personal data to a foreign country or international body of which the country is a member;
- XVI - shared use of data: communication, dissemination, international transfer, interconnection of personal data or shared processing of personal databases by public bodies and entities in compliance with their legal powers, or between these and private entities, reciprocally, with specific authorization, for one or more processing modalities allowed by these public entities, or between private entities;
- XVII - Impact Report on the Protection of Personal Data: controller's documentation containing a description of personal data processing activities that may pose risks to civil liberties and fundamental rights, as well as risk mitigation measures, safeguards and mechanisms;
- XVIII - research body: a direct or indirect public administration body or entity or a non-profit private entity legally constituted under Brazilian law, with headquarters and jurisdiction in the national territory, which includes in its institutional mission or in its social or statutory basic or applied research of a historical, scientific, technological or statistical nature; and
- XIX - national authority: public administration body responsible for ensuring, implementing and supervising compliance with this Law throughout the national territory.