Legal basis under the LGPD: what it is and how to choose one
Quick facts
- Definition
- Legal justification that authorizes the processing of personal data.
- Provision
- Articles 7 and 11 of the LGPD (Law 13,709/2018, Brazil's data protection law).
- Common in health
- Health protection, legal or regulatory obligation, consent and regular exercise of rights.
- Sensitive data
- Health and biometric data have their own rules and bases.
- Golden rule
- Each purpose needs a basis, and it must be recorded.
A legal basis is the justification that the LGPD (Brazil's General Data Protection Law) requires for anyone to process personal data. Without an adequate basis, the processing is irregular. The law provides a list of bases, and the clinic must identify which one applies to each type of data and each purpose.
Which bases appear most in health and aesthetics?
| Basis | Example in the clinic |
|---|---|
| Health protection | Patient record, medical history and clinical photos of the patient, for care |
| Legal or regulatory obligation | Retention of the patient record for the required period |
| Consent | Use of the image on social media, the website, in teaching or in a study |
| Regular exercise of rights | Keeping records for defense in a lawsuit |
| Performance of a contract | Billing and scheduling data |
Health and biometric data fall into the category of sensitive personal data, which have their own, more restrictive list of bases. A photo of a face used for recognition may be biometric data.
What is the difference between clinical consent and LGPD consent?
The informed consent for the procedure authorizes the clinical conduct. LGPD consent authorizes a purpose of data processing, such as publishing a photo. They are different documents and purposes, and one does not replace the other. For use of an image, the ideal is a specific form.
How to record it?
- Map which data the clinic processes and for what.
- Match each purpose to a legal basis.
- Inform the patient in clear language.
- Keep the forms and allow consent to be revoked when it is the basis.
Image data that is effectively anonymized falls outside the scope of the law, but anonymization of a face is difficult.
Also called: legal ground for processing.
Frequently asked questions
Does every patient photo require consent?
It depends on the purpose. The photo in the patient record can rely on health protection or the obligation to keep records. Use in advertising or teaching usually requires specific consent. Seek legal advice and follow the rules of your professional council in Brazil.