Brazil LGPD Request: Ask a Company Where It Got Your Data

If a Brazilian company holds your personal information and gives only a generic privacy-policy response, send a specific request to the controller that asks about the processing of your data. Under Brazil’s Lei Geral de Proteção de Dados Pessoais (LGPD), a data subject may request confirmation and access, correction, information about public and private entities with which the controller shared data, and other rights listed in art. 18. Article 19 provides for a simplified immediate response or a clear and complete declaration within up to 15 days, including information such as source, criteria and purpose. Rights are not absolute, and consent is not the only lawful basis for processing.

Start with the company, not the regulator. The ANPD’s official titular-petition guidance says the person should first request the right from the controller and preserve proof of that request. Its current complaint and petition instructions point to the online Requerimentos system. ANPD states that petitions may be reviewed in aggregate, so submitting one does not guarantee an individualized decision about the underlying dispute.

Identify the controller and the data at issue

Before writing, identify the company that appears to decide why and how your data is used. A service provider may process information on behalf of another company, while a controller makes the relevant decisions. If the source of the data is unclear, write to the organization that contacted you or appears in the notice, then ask it to identify the responsible controller and the appropriate privacy channel.

Be specific about the data and event. “Tell me everything about my privacy” can lead to a broad answer. Instead, identify the phone number, email address, account, date of a call, transaction, customer relationship, or marketing contact. Ask for the categories and records relevant to that data. A focused request is easier to authenticate, route and answer.

Do not begin from the assumption that the company must have obtained consent. LGPD includes multiple legal bases in arts. 7 and 11. If a company relies on a basis other than consent, the question is not necessarily whether it can produce a consent checkbox. Ask for information about the treatment, source, purpose, legal basis where applicable, retention and sharing. The applicable response depends on the request, the company’s role and legal context.

Make a request that is easy to answer and prove

Use the controller’s official privacy or data-subject channel. Keep a copy of the request and a delivery record. If the company needs identity verification, provide only what is reasonably required through a secure channel and ask why additional information is necessary. Do not send a full identity document through an unverified link simply because a generic email asks for it.

A request can be organized as a numbered list:

1. Confirm whether the company processes the identified personal data.
2. Provide access to the data or explain the available access format.
3. Identify the source or origin of the data and relevant collection or receipt records.
4. Explain the purposes and criteria used for the processing, subject to applicable statutory limits.
5. Identify the legal basis relied upon for each relevant purpose, where the response requires it.
6. Identify categories of recipients or entities with which the data was shared and the purpose of sharing.
7. Correct inaccurate or outdated information, if applicable.
8. Explain whether the information is retained and whether a deletion request can be honored, including any legal-retention limitation.
9. Confirm the channel and deadline for the response and provide a protocol number.

Keep the request factual. Explain why you believe the data relates to you, state the contact channel you want the controller to use, and ask it to identify the controller if the recipient is only an operator or service provider. Do not demand unrestricted internal documents, trade secrets, or other people’s data when a statutory right can be addressed with a narrower answer.

Track the response against the law and ANPD guidance

LGPD art. 19 distinguishes an immediate simplified answer from a complete declaration, which should be clear and indicate origin, absence of records, criteria and purpose within up to 15 days. The law includes rules about how data and information may be delivered and permits different deadlines for specific sectors if the authority provides for them. Check the current text and any sector-specific rule before calculating a deadline or describing a missed deadline as a violation.

The controller may need to verify identity, locate records across systems, protect other individuals’ information, or explain a lawful retention reason. If it refuses deletion because records must be retained under another legal obligation, that does not automatically mean the request was mishandled. Ask for the applicable reason and whether the data can be restricted, corrected or otherwise handled while retention continues.

If the response is incomplete, reply in a structured way. Quote the request number, identify the unanswered question, state what was answered, and ask for the missing information. Keep the response and dates. The ANPD explains that a data subject should first contact the controller; the subject must submit evidence of that attempt when filing a petition. The current page also instructs users to use the online system and notes that a petition is not anonymous. Confirm the portal’s live steps immediately before filing.

Hypothetical: an unfamiliar business-only phone number

Imagine Camila uses a phone number only for urgent client calls. A telecom company calls that number about an overdue account, although it does not appear in the account profile. Camila emails the company’s privacy contact, asking where it obtained the number. The response repeats a general policy describing data use but says nothing about the number’s source.

Camila can submit a follow-up that identifies the exact number and call date, asks whether the company processes it, requests the source and relevant origin information, asks what purpose and legal basis apply, and asks whether it was shared with a collection provider. She should keep the outgoing request, protocol number and full response. If the company asks for identity verification, she can use its official secure channel and avoid sending unrelated data. If the complete response remains absent or unsatisfactory, she can review ANPD’s current petition criteria and attach proof of the original contact and follow-up. This example does not establish that the company violated the LGPD or that the ANPD will decide her individual matter.

Decision table: request, follow-up or petition?

Common mistakes

• Treating the LGPD as a consent-only statute. Processing may rely on other statutory legal bases.
• Asking only whether the company has consent rather than asking what data it processes, where it came from, why it is used and whether it is shared.
• Sending a broad demand for all internal records when a focused rights request is more likely to be answerable.
• Assuming a privacy notice answers a specific question about the source of a particular data item.
• Treating a delayed or unsatisfactory response as automatic proof of a violation without checking the precise right, deadline and facts.
• Demanding deletion without considering legal retention, public-record obligations or other exceptions.
• Filing at ANPD before contacting the controller or losing proof of that contact.
• Expecting an individual regulator petition to function as a private damages award or immediate case-specific ruling.
• Sending excessive identity information to an unverified contact channel.

For internal request operations, use a legal intake and triage workflow, document naming and version control, and metadata cleaning before sharing. These organize the response; the official Brazilian sources above establish the applicable rights. The Brazil electronic-signature guide explains secure document evidence practices that may also support a request record.

Data-request checklist

• Identify the controller and use its official contact channel.
• Specify the data item, context, contact date and right requested.
• Ask separately about confirmation/access, origin, purposes, criteria, sharing and correction where relevant.
• Avoid assuming that consent is the only legal basis.
• Provide only necessary identity verification through a secure channel.
• Save the request, protocol, delivery proof, response, attachments and dates.
• Check the 15-day complete-response rule and any applicable sector exception.
• Ask for the specific legal reason if deletion or access is limited.
• Follow up on unanswered questions in a concise, numbered format.
• Before petitioning, verify current ANPD filing instructions and attach proof of prior contact.

Frequently asked questions

Can I ask a company in Brazil where it got my phone number?

You may request information about processing and, under art. 19, a complete response can include the origin of the data, criteria and purpose, subject to the law and applicable limits. Identify the specific number and context and contact the controller through its official channel.

Does the company have to prove that I consented?

Consent is one possible legal basis, not the only one. The company’s obligations depend on the basis and purpose of processing. Ask which basis applies and how the data is used; do not assume absence of a consent record alone resolves legality.

How long does the controller have to respond?

Article 19 provides an immediate simplified response or a clear and complete declaration within up to 15 days for the described confirmation/access request. The law permits different periods for specific sectors if established by the authority. Verify current rules for the organization and request before asserting a deadline violation.

Is an answer that links to a privacy policy enough?

It may provide general information, but a policy link may not answer a specific request for source, purpose, criteria or sharing details. Follow up with numbered questions about the identified data and preserve both messages.

Can I require the company to delete the data?

Not in every circumstance. LGPD provides rights to request deletion in specified situations, but art. 16 permits retention for listed purposes, including legal or regulatory obligations. Ask which basis applies and whether another remedy, such as correction or restriction, is available.

Do I need to contact the controller before ANPD?

ANPD’s current guidance says the data subject should first submit the request to the controller and retain proof. The petition process asks for evidence of that prior attempt. Review the current ANPD portal instructions before filing.

Will ANPD decide my individual dispute?

Not necessarily. ANPD says titular petitions may be analyzed in aggregate to inform oversight and regulation. A petition is not a guarantee of individualized adjudication, compensation or immediate deletion.

Can I ask for the data source if the company says it is a processor?

Ask the recipient to identify the controller and the responsible channel. The controller and processor have different roles under the LGPD. Whether a specific entity must answer a specific request depends on its role and the legal framework.

What if I do not know which company shared the data?

Start with the company that contacted you and ask for the relevant source and recipient information. Keep the request narrow enough to identify the data and event, then use any response to clarify the next controller or entity to contact.

To organize privacy-request evidence and response workflows, explore Gotham’s legal workflows or contact the team. This is workflow support, not a determination that a controller violated the LGPD.

General information, not legal advice. LGPD rights and controller duties are subject to statutory limits, applicable rules and the facts of the processing.
How Gotham researches and reviews field guides