LGPD Art.18: Arts. 17, 18 and 21: Data subject rights and how requests are handled

On request, at any time, the data subject may obtain from the controller: confirmation that processing exists; access to the data; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or erasure of unnecessary, excessive or unlawfully processed data; portability to another supplier on express request, under ANPD regulation and respecting commercial and industrial secrets (not covering data already anonymised); erasure of data processed with consent, except where Art. 16 allows retention; information on the public and private entities with which data were shared; information on the possibility of refusing consent and its consequences; and revocation of consent. The data subject may oppose processing based on a consent exemption where the law is breached, and may petition the ANPD and consumer protection bodies against the controller. Rights are exercised by express request to a processing agent, free of charge, within the periods set by regulation; if immediate action is impossible the controller must reply stating that it is not the processing agent (naming the agent where possible) or giving the factual or legal reasons preventing immediate action; and the controller must immediately inform agents with whom it shared the data of any correction, erasure, anonymisation or blocking so they repeat it, unless proven impossible or disproportionate. Data relating to the regular exercise of rights may not be used against the data subject.