What is the legal basis under the LGPD?

The legal provision that authorizes each processing of personal data.

Definition

Legal basis is the hypothesis foreseen in the LGPD (Brazilian General Data Protection Law) that authorizes the processing of personal data; without an applicable legal basis, the processing is unlawful, even if the purpose seems legitimate.

Consent is only one of the ten bases in Article 7. In most business operations, the appropriate basis is another: performance of a contract, legal obligation, legitimate interest, or regular exercise of rights.

What does the LGPD say?

Article 7 of LGPD The list outlines the legal bases for personal data: consent, legal or regulatory obligation, public policies, studies by research bodies, contract execution, regular exercise of rights, protection of life, protection of health, legitimate interest, and credit protection. Article 11 provides the more restricted hypotheses for sensitive data. The ANPD (National Data Protection Authority) has published a guidance document on the legal hypotheses, available at [link to document]. ANPD website.

In practice

Choose a legal basis by purpose, not by system or area.
Register the base in ROPA and inform her of this in the privacy policy.
If the basis is legitimate interest, document it. LIA.
If the basis is consent, keep the proof and allow for revocation.

How Privacy Tools it deals with the topic

No Data Mapping Each treatment activity is given a legal basis and a purpose; Consent Management keep the evidence when the basis is consent; Diagnoses and Assessments They produce the LIA.

Updated October 3th, 2026.

Want to see this concept applied in practice?

Request a demo and see how... Privacy Tools It organizes mapping, legal bases, rights holder applications, and evidence all in one place.