I - by obtaining consent from the data subject;

II - for the fulfillment of legal or regulatory obligation by the controller;

III - by the public administration, for the processing and shared use of data necessary for the execution of public policies provided for in laws and regulations or supported by contracts, agreements or similar instruments, subject to the provisions of Chapter IV of this Law;

IV - to carry out studies by research body, ensuring, whenever possible, anonymization of personal data;

V - when necessary for the performance of a contract or preliminary procedures related to the contract to which the data subject is party, at the request of the data subject;

VI - for the regular exercise of rights in judicial, administrative or arbitral proceedings, the latter pursuant to Law No. 9,307, of September 23, 1996 (Arbitration Law);

VII - to protect the life or physical safety of the data subject or third party;

VIII - for the protection of health, exclusively, in a procedure performed by health professionals, health services or health authority;

IX - when necessary to meet the legitimate interests of the controller or third party, except in case the fundamental rights and freedoms of the data subject that require the protection of personal data prevail; or

X - for credit protection, including the provisions of the relevant legislation.

• 1. (Repealed).
• 2. (Repealed).
• 3. The processing of personal data whose access is public shall consider the purpose, good faith and public interest that justified its availability.
• 4. The consent required provided for in the caput of this article is not applicable for data made manifestly public by the data subject, safeguarding the rights of the data subject and the principles provided for in this Law.
• 5. The controller who obtained the consent referred to in item I of the caput of this article who needs to communicate or share personal data with other controllers shall obtain specific consent from the data subject for this purpose, except in the case of waiver of consent provided for in this Law.
• 6. Any waiver of the consent requirement does not relieve processing agents of other obligations provided for in this Law, especially the observance of the general principles and the guarantee of the rights of the data subject.
• 7. The further processing of personal data referred to in §§ 3 and 4 of this article may be carried out for new purposes, provided that the legitimate and specific purposes for the further processing and preservation of the rights of the data subject, as well as the grounds and principles set forth in this Law.