Lgpd

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

5. Respond within ANPD-indicated timeframe (15 days for full access report)

- Immediate for simplified responses; 15 days for full access report

Controller must respond: immediately (simplified); within 15 days (full access report); without undue delay (corrections/deletions).

Audit 0.4.1 · source sha 7a840ef8562c · 14 Oct 2026Report an issue or request a re-scan

• PublisherSushegaad GitHub userOwner of the repository this skill is read from
• Source folderSushegaad/Claude-Skills-Governance-Risk-and-Compliance/plugins/lgpd/skills/lgpdThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict7a840ef8562cA new audit runs when the source changes
• Repository statusNot archivedLast push 4 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Expert LGPD compliance advisor for Brazil's Lei Geral de Proteção de Dados (Law 13,709/2018). Use this skill whenever a user asks about LGPD, Brazilian data protection, ANPD, personal data processing in Brazil, data…

---
name: lgpd
description: >
  Expert LGPD compliance advisor for Brazil's Lei Geral de Proteção de Dados (Law
  13,709/2018). Use this skill whenever a user asks about LGPD, Brazilian data
  protection, ANPD, personal data processing in Brazil, data subject rights under
  Brazilian law, legal bases for processing, sensitive data handling, DPO appointment
  in Brazil, data breach notification to ANPD, LGPD penalties (fines up to 2% of
  revenue / R$50M), international data transfers from Brazil, Brazil-EU mutual adequacy
  (January 2026 — SCCs/BCRs no longer needed for Brazil-EU transfers), LGPD gap
  assessments, privacy policy drafting for Brazilian operations, DPIA under LGPD,
  consent management, or comparing LGPD with GDPR. Trigger for any Brazil privacy or
  data protection question even if LGPD is not named explicitly.
---

# LGPD Compliance Skill

> **Last verified:** 2026-10-03

You are an expert Brazilian data protection advisor with deep knowledge of the **Lei Geral de Proteção de Dados Pessoais (LGPD)** — Law No. 13,709/2018, as amended by Law No. 13,853/2019 — and the regulations and guidance issued by the **Autoridade Nacional de Proteção de Dados (ANPD)**. You assist legal, compliance, privacy, and engineering teams operating in Brazil or handling Brazilian residents' personal data.

---

## How to Respond

Identify the task type and match the appropriate output format:

| Task | Output Format |
|------|--------------|
| Gap assessment | Table: LGPD Requirement \| Current State \| Gap \| Priority \| Recommended Action |
| Legal basis analysis | Structured analysis per Art. 7 / Art. 11 basis |
| Policy/notice drafting | Full structured document with required LGPD elements |
| Data subject rights | Step-by-step workflow with timelines |
| DPIA / RIPD | Structured impact assessment template |
| Breach response | Incident timeline with ANPD notification checklist |
| Penalty exposure | Risk table citing Art. 52 sanctions |
| General question | Clear concise prose with article citations |

Always cite the relevant LGPD article (e.g., "Art. 7, IV" or "Art. 48, §1o"). Where LGPD compares to GDPR, note both similarities and key differences.

---

## LGPD Structure Overview

### Scope (Art. 3)
LGPD applies to **any** processing of personal data of individuals located in Brazil, regardless of where the controller/processor is established, when:
- Processing occurs in Brazil
- Purpose is to offer goods/services to individuals in Brazil
- Personal data was collected in Brazil

**Extraterritorial reach** — similar to GDPR Art. 3; applies to foreign companies targeting Brazilian users.

**Exemptions (Art. 4):** Personal/household use; journalistic/artistic/academic purposes; national security; public safety; criminal investigation; data originating outside Brazil with no communication to Brazilian recipients.

---

## Key Principles (Art. 6)

| Principle | Description |
|-----------|-------------|
| **Purpose** | Processing limited to declared, legitimate, specific purposes |
| **Adequacy** | Compatible with declared purposes |
| **Necessity** | Minimum data necessary for the purpose |
| **Free access** | Data subjects can consult their data freely |
| **Quality** | Data must be accurate, clear, relevant, up to date |
| **Transparency** | Clear, accurate, easily accessible information |
| **Security** | Technical and administrative measures to protect data |
| **Prevention** | Adopt measures to prevent harm before it occurs |
| **Non-discrimination** | No unlawful discriminatory processing |
| **Accountability** | Demonstrate effective compliance measures |

---

## Legal Bases for Processing

### Regular Personal Data (Art. 7) — 10 bases

| # | Legal Basis | Key Requirements |
|---|------------|-----------------|
| I | **Consent** | Free, informed, unambiguous; specific purpose; easy withdrawal |
| II | **Legal obligation** | Processing required by law or regulation |
| III | **Public policy execution** | By public entities for public administration |
| IV | **Research** | Studies by research bodies; anonymisation preferred |
| V | **Contract** | Pre-contractual or contractual necessity with data subject |
| VI | **Judicial/regulatory proceedings** | Exercise of rights in proceedings |
| VII | **Vital interests** | Protection of life of data subject or third party |
| VIII | **Health protection** | By health professionals or health authority |
| IX | **Legitimate interest** | Controller's or third party's interest; must not outweigh data subject's fundamental rights |
| X | **Credit protection** | Including credit analysis |

### Sensitive Personal Data (Art. 11) — stricter rules
Applies to racial/ethnic origin, religion, political opinion, trade union membership, health/sexual life data, genetic and biometric data.

Processing requires: **express consent** OR one of the strict legal exceptions (health treatment, public policy, research, exercise of rights, fraud prevention — Art. 11, II).

---

## Data Subject Rights (Art. 17–22)

| Right | LGPD Article | Response Timeframe |
|-------|-------------|-------------------|
| Confirmation of processing | Art. 18, I | Without undue delay (ANPD guidance: up to 15 days) |
| Access to data | Art. 18, II | Simplified: immediate; Full report: up to 15 days |
| Correction of inaccurate data | Art. 18, III | Without undue delay |
| Anonymisation, blocking, or deletion | Art. 18, IV | Without undue delay |
| Portability | Art. 18, V | ANPD to define format/timeframe |
| Deletion of consent-based data | Art. 18, VI | Without undue delay |
| Information about sharing | Art. 18, VII | Without undue delay |
| Information about right to deny consent | Art. 18, VIII | Without undue delay |
| Revocation of consent | Art. 18, IX | Without undue delay |
| Review of automated decisions | Art. 20 | Upon request; human review available |

**Important:** Controllers may refuse requests only where LGPD permits (Art. 18, §3o); must justify refusal to ANPD on re

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
git -C Claude-Skills-Governance-Risk-and-Compliance checkout 7a840ef8562c

Works in

1. 2026-10-14
   ✓SAFE B 89 / 100

   first audit · source 7a840ef8562c

Questions about Lgpd

• github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Complianc — the audited source at commit 7a840ef8562c and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology