LGPD Art.7: Art. 7: Legal bases for processing personal data

Personal data may be processed only on one of ten legal bases: consent of the data subject; compliance with a legal or regulatory obligation of the controller; execution of public policies by the public administration (subject to Chapter IV); studies by a research body, with anonymisation wherever possible; performance of a contract or preliminary procedures at the data subject's request; regular exercise of rights in judicial, administrative or arbitral proceedings; protection of the life or physical safety of the data subject or a third party; health protection, exclusively in a procedure carried out by health professionals, health services or a health authority; legitimate interests of the controller or a third party, unless the data subject's fundamental rights and freedoms prevail; and credit protection. Processing of data whose access is public must respect the purpose, good faith and public interest that justified making it available; consent is not needed for data the data subject has manifestly made public, but their rights and the principles still apply; a controller relying on consent that wants to share data with other controllers needs specific consent for that; waiving consent does not waive the other duties; and later processing of public or manifestly public data for new purposes must have legitimate, specific purposes and preserve the data subject's rights.