Flag of Brazil



Article 8

Consent of the Personal Data Holder

The consent provided for in item I of art. 7 of this Law shall be provided in writing or by other means demonstrating the data subject's manifestation of will.

  • 1. If consent is given in writing, it shall be included in a clause highlighted among other contractual clauses.
  • 2. The controller shall bear the burden of proving that consent was obtained in accordance with the provisions of this Law.
  • 3. The processing of personal data through defected consent is forbidden.
  • 4. Consent shall be for specified purposes, and generic authorizations for the processing of personal data shall be void.
  • 5. Consent may be revoked at any time by express expression of the data subject, through a free and facilitated procedure, being the processing activities carried out under the consent previously expressed ratified as long as there is no request for elimination, pursuant to item VI of the caput of art. 18 of this Law.
  • 6. In case of alteration of information referred to in items I, II, III or V of art. 9 of this Law, the controller shall inform the data subject, with specific emphasis on the content of the changes, and the data subject may, in cases where his consent is required, revoke it if he disagrees with the change.