LGPD Article 7: the legal bases for processing personal data, including consent (I) and the controller's legitimate interest (IX) (Lei Geral de Proteção de Dados, Law No. 13,709 of 14 August 2018, Art. 7, I and IX (ANPD English translation))
A Brazilian holder needs one of the ten Article 7 bases for each use of personal data. For a licence to an AI buyer the realistic bases are the data subject's consent or the legitimate interest of the holder or the buyer (a third party); there is no general business-improvement or compatible-purpose exception beyond these.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“Processing of personal data shall only be carried out under the following circumstances: I - with the consent of the data subject; ... IX - when necessary to meet the legitimate interests of the controller or a third party, except when the data subject’s fundamental rights and liberties that require personal data protection prevail”
Where it was read
Also read from the same source
- LGPD Article 33: the only cases in which personal data may be transferred abroad (Lei Geral de Proteção de Dados, Law No. 13,709 of 14 August 2018, Art. 33, I, II and VIII (ANPD English translation))
- LGPD Article 12: anonymised data is not personal data unless the anonymisation can be reversed with reasonable efforts (Lei Geral de Proteção de Dados, Law No. 13,709 of 14 August 2018, Art. 12 and Art. 12, par. 1 (ANPD English translation))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide