Data subject rights: what they are under the LGPD and how the company responds in practice

Data subject rights are the guarantees that Brazil's General Data Protection Law (LGPD) gives any individual over the information a company holds about them, including confirming whether processing exists, accessing the data, correcting what is wrong, requesting deletion or portability and revoking consent at any time. It sounds like a topic for legal and the DPO. In practice, it is a master record problem.

I have seen a large company freeze in the face of a simple access request. The customer asked to know what data the company had about them. The answer took weeks, not for lack of goodwill, but because nobody could say with confidence in how many systems that person's CPF (Brazil's individual taxpayer ID) appeared. It was in the CRM, it was in the ERP, it was in a spreadsheet from an old campaign, it was in a collections system nobody used anymore but that kept running. Each area answered a part. None answered the whole. And that is exactly the point I want to develop here: data subject rights only work in practice when the company knows where personal data lives.

What the rights provided in the LGPD are

Article 18 of the LGPD lists the data subject's rights, and it is worth understanding each one clearly, because the legal text is short but the operational implications are not.

The first is confirmation of the existence of processing and access to the data. The data subject can ask whether the company processes their personal data and, if so, has the right to a complete copy, with origin, purpose and who the data was shared with. The answer can be immediate, in simplified format, or complete within up to fifteen calendar days.

The second is correction of incomplete, inaccurate or outdated data. If the address changed, if the name is wrong, if the phone belongs to someone else, the data subject can ask for the adjustment, and the company must communicate that correction to all third parties with whom it shared that data.

The third is anonymization, blocking or deletion of unnecessary, excessive data or data processed in non-compliance with the law. Here the data subject chooses the measure, and the company must have a process to carry out any of the three.

The fourth is portability of the data to another provider or service supplier, upon express request, in an interoperable format. It is the right that still depends most on technical regulation, but it is already demanded by data subjects who switch banks, carriers or health plans and want to take their history with them.

The fifth is deletion of data processed with consent as the legal basis, when the data subject revokes that consent, subject to the exceptions in Article 16, which preserve data for compliance with a legal obligation, use by the public authorities, study by a research body or exercise of rights in proceedings.

The sixth is information about the public and private entities with which the company shared the data, and about the possibility of not giving consent and its consequences. The seventh is revocation of consent, at any time, by express and free-of-charge statement, with no need for justification. And there is also the right to review automated decisions that affect the data subject, provided for in Article 20, relevant for companies that use credit models, scores, recommendations or any data-driven decision engine.

None of these rights may carry a charge to the data subject, and the National Data Protection Authority (ANPD) has already signaled progress in regulating specific deadlines and procedures, which reinforces that the topic will keep demanding operational maturity from companies, not just a policy written on paper.

How the company responds in practice

Here comes the point few people connect. Answering a data subject request within the fifteen-day deadline is not a legal task, it is a master data task. To confirm the existence of processing, the company needs to know in which systems that CPF appears. To correct a piece of data, it needs to know how many copies of that record exist and propagate the correction to all of them. To delete, it needs to be sure it will not delete in one system and leave a forgotten copy in another, which in practice means keeping a risk exposure without knowing it.

This is the classic problem of the fragmented record. When each system treats the customer as an isolated entity, with no unique identifier tying the different databases together, the company has no way to respond with confidence to any of the data subject's rights. It may even respond, but it risks responding wrongly, incompletely, and that becomes a liability, because an incomplete answer to an access request is, itself, a new compliance failure.

The operational solution goes through three fronts: an up-to-date personal data inventory, which says in which systems, processes and purposes each category of data is processed; a formal handling process, with an identified channel, verification of the requester's identity, a protocol with a unique number and a controlled deadline; and, where master data governance really comes in, a consolidated customer view that makes it possible to locate, correct or delete a record in all systems at once, instead of depending on manual searching spreadsheet by spreadsheet.

Anyone who works with Master Data Management knows this third front is the one most lacking in companies. It is common to see a company with a well-written privacy policy and a formalized data committee, but with no technical guarantee that a customer's CPF is the same record in all systems. Without that tie, the right of access becomes an exercise of faith.

Who is responsible inside the company

The response to a data subject request normally passes through many hands. The data protection officer (DPO) is the one who formally receives the request and ensures it is handled within the deadline and with the rigor the law requires. But the DPO doesn't carry out the technical search alone. They depend on IT and data to locate the record in the systems, depend on the data steward responsible for the customer domain to validate whether that is in fact the same data subject across different databases, and depend on the business areas, such as service, sales or collections, to confirm the context of the relationship.

That means data subject rights are not a topic isolated in legal. Purchasing also processes personal data, when it deals with the contact of an individual who is a supplier. HR processes all the time. Customer service processes in practically every contact. Each of those areas needs to know a process exists, and needs to be clear that personal data scattered without control is a risk that only shows up when someone asks to exercise a right, or worse, when it leaks.

Which tools help

On the market, two families of tools complement each other to support this process. Master Data Management platforms, such as SAP MDG, Informatica, Reltio, Semarchy, Profisee or Stibo Systems, help consolidate and deduplicate the customer master, ensuring a single, reliable record to respond accurately to any access, correction or deletion request. Data catalog platforms, such as Collibra, Alation or Microsoft Purview, help map where each category of personal data is stored, in which system and under which legal basis, which supports the personal data inventory the LGPD requires in practice. Neither replaces the process: without a defined data owner and the discipline to keep the record correct every day, the problem comes back.

How to learn and prepare

Those who want to specialize in this intersection of privacy and master data have a structured path. DAMA's CDMP certification covers data governance and quality broadly, including the fundamentals that support a data subject request program. Specific LGPD courses and data protection officer training go deeper on the regulatory side. The most valuable learning, in my experience, comes from taking part in a real handling of a data subject request, because that is where the person understands where the process actually gets stuck.

The career opportunities

Demand for professionals who understand privacy and master data at the same time is growing. Companies of all sizes have been structuring privacy and data governance areas, and roles such as data protection officer, privacy analyst, data steward and MDM specialist appear increasingly integrated. Those who can move between the legal requirement and the technical data solution become a rare piece, because most professionals master only one of the two sides.

Main questions

What is the deadline to respond to a data subject request? Confirmation of the existence of processing can be immediate, in simplified format. A complete answer, with origin, purpose and recipients of the data, has a deadline of up to fifteen calendar days.

Can the company charge to fulfill a data subject right? No. Exercising the rights provided in the LGPD is free of charge, and charging for it is a violation of the law.

Can the company refuse a data deletion request? Yes, in specific situations, such as compliance with a legal or regulatory obligation, exclusive use by the public authorities, study by a research body or exercise of rights in judicial or administrative proceedings. The refusal must be justified in writing, with the specific legal basis.

What happens if the company can't locate all the systems where a piece of personal data is stored? It risks answering a data subject request incompletely, which is considered a compliance failure, besides keeping a risk exposure in forgotten systems, off the radar of security and governance.

Are data steward and DPO the same function? No. The DPO answers for legal compliance and is the official channel with the data subject and with the ANPD. The data steward takes care of the quality and integrity of the data within a specific domain, such as customers or suppliers, and is the one who makes it technically possible for the DPO to answer accurately.

MDM Academy

This is exactly the kind of topic MDM Academy, 4MDG's school of data governance and master data, exists to go deeper on. The training doesn't treat privacy and MDM as separate subjects, but shows how a mature master data program supports, in practice, LGPD compliance, customer trust and the company's agility to respond to any request without taking risks.

If you deal with master records, customer, supplier or privacy data day to day, it is worth getting to know MDM Academy or joining the Data Club, a community of professionals who discuss these real problems every day and exchange experience about what really works in Brazilian companies.

Conclusion

Data subject rights exist to protect the individual, but the one who first feels their weight day to day is the company that hasn't organized its own master records. Every time an access request takes long, every time a correction doesn't propagate to all systems, every time a deletion leaves a forgotten trace in some corner of the database, the problem is not the law. It is the lack of governance over the customer's master data. A company that treats this as a master record priority, and not just a legal requirement, responds faster, runs less risk and builds the trust that sustains any long-term relationship with those who hand over their own personal data.