Flag of Brazil



Article 18

The holder of personal data has the right to obtain from the controller, in relation to the data of the holder processed by him, at any time and upon request:

  • I - confirmation of the existence of treatment;
  • II - access to data;
  • III - correction of incomplete, inaccurate or outdated data;
  • IV - anonymization, blocking or deletion of unnecessary, excessive or treated data in violation of the provisions of this Law;
  • V - portability of data to another service or product provider, upon express request, in accordance with the regulations of the national authority, subject to commercial and industrial secrets;
  • VI - deletion of personal data processed with the consent of the holder, except in the cases provided for in art. 16 of this Law;
  • VII - information on public and private entities with which the controller made shared use of data;
  • VIII - information about the possibility of not giving consent and about the consequences of the refusal;
  • IX - revocation of consent, pursuant to § 5 of art. 8 of this Law.
  • 1. The holder of personal data has the right to petition against his data against the controller before the national authority.
  • 2. The holder may oppose treatment based on one of the hypotheses of waiver of consent, in case of non-compliance with the provisions of this Law.
  • 3. The rights provided for in this article shall be exercised upon the express request of the holder or legally constituted representative, the processing agent.
  • 4. In the event of impossibility of immediate adoption of the measure referred to in paragraph 3 of this article, the controller shall send the holder an answer in which he may:
    • I - communicate that he is not a data processing agent and indicate, whenever possible, the agent; or
    • II - indicate the reasons of fact or law that prevent the immediate adoption of the measure.
  • 5. The request referred to in paragraph 3 of this article shall be met at no cost to the holder, within the time limits and under the terms provided for in the regulation.
  • 6. The responsible person shall immediately inform the treatment agents with whom he has made shared use of data the correction, deletion, anonymization or blocking of the data, so that they repeat the same procedure. This provision does not apply in cases that the communication is manifestly impossible or result of a desproportional effort.
  • 7. The portability of the personal data referred to in item V of the caput of this article does not include data that has already been anonymized by the controller.
  • 8. The right referred to in paragraph 1 of this article may also be exercised before consumer protection organizations.