Flag of Brazil



Article 7

The processing of personal data may only be performed in the following cases:

  • I - by providing consent by the holder;

  • II - for the fulfillment of legal or regulatory obligation by the controller;

  • III - by the public administration, for the processing and shared use of data necessary for the execution of public policies provided for in laws and regulations or supported by contracts, agreements or similar instruments, subject to the provisions of Chapter IV of this Law;

  • IV - to carry out studies by research body, ensuring, whenever possible, anonymization of personal data;

  • V - when necessary for the performance of the contract or preliminary procedures related to the contract to which the holder is party, at the request of the data subject;

  • VI - for the regular exercise of rights in judicial, administrative or arbitral proceedings, the latter pursuant to Law No. 9,307, of September 23, 1996 (Arbitration Law) ;

  • VII - to protect the life or physical safety of the holder or third party;

  • VIII - for the protection of health, exclusively, in a procedure performed by health professionals, health services or health authority;

  • IX - when necessary to meet the legitimate interests of the controller or third party, except in case the fundamental rights and freedoms of the holder that require the protection of personal data prevail; or

  • X - for credit protection, including the provisions of the relevant legislation.

    • 1 (Repealed) .
    • 2 (Repealed) .
    • 3. The processing of personal data whose access is public shall consider the purpose, good faith and public interest that justified its availability.
    • 4 The requirement of consent provided for in the caput of this article is waived for data made manifestly public by the holder, safeguarding the rights of the holder and the principles provided for in this Law.
    • 5. The controller who obtained the consent referred to in section I of the caput of this article who needs to communicate or share personal data with other controllers shall obtain specific consent from the holder for this purpose, except in the case of waiver of consent provided for in this Law.
    • 6. Any waiver of the requirement of consent does not relieve agents of treatment of other obligations provided for in this Law, especially the observance of the general principles and the guarantee of the rights of the holder.
    • 7. The further processing of personal data referred to in paragraphs 3 and 4 of this article may be carried out for new purposes, provided that the legitimate and specific purposes for the further processing and preservation of the rights of the holder, as well as the grounds and principles set forth in this Law.