LGPD legal bases: what the 10 are and how to choose the right one to process data

Every company processes personal data all the time. It registers customers, qualifies suppliers, hires employees, sends marketing campaigns, keeps the CPF (Brazil's individual taxpayer ID) of whoever issued an invoice. What almost nobody stops to ask is: on what basis? That is exactly what the legal bases of the LGPD (Brazil's General Data Protection Law) define. They answer a simple, uncomfortable question: why your company is allowed to use that data.

I see a lot of people thinking the LGPD means asking for consent and putting a cookie banner on the website. In practice, the problem starts when the company finds out that consent is only one of the ten legal bases in the law, and almost never the most appropriate one for everyday corporate work. Understanding the LGPD legal bases is what separates a company that processes data safely from one that is exposed and doesn't even know it.

What an LGPD legal basis is

A legal basis is the legal justification that authorizes the processing of personal data. The LGPD starts from a direct principle: no personal data can be processed without a legal ground supporting that use. Processing, here, is almost everything you can imagine doing with data: collecting, storing, using, sharing, updating, deleting.

The easiest way to understand it is this. Before using personal data, the company needs to answer two questions: what am I using this data for, and which legal basis allows me to do it. If there is no clear answer, the processing is irregular, even if nobody has complained yet. And each purpose requires its own basis. The email address the customer left to receive the invoice cannot simply become a promotional mailing list. Same data, different purpose, different basis.

What the 10 LGPD legal bases are

Article 7 of the LGPD lists ten legal bases for processing ordinary personal data. Knowing all ten helps you see that there is life beyond consent.

1. Consent of the data subject. The person authorizes freely, with information, and for a specific purpose. It can be withdrawn at any time. 2. Compliance with a legal or regulatory obligation. When another law requires the company to process the data, such as keeping employment, tax and accounting information. 3. Execution of public policies. Applies to public administration, for policies provided for by law. 4. Studies carried out by a research body. Whenever possible with the data anonymized. 5. Performance of a contract. Processing the data needed to fulfill a contract to which the data subject is a party, or for preliminary procedures at the subject's request. 6. Regular exercise of rights in judicial, administrative or arbitration proceedings. 7. Protection of life or physical integrity of the data subject or a third party. 8. Protection of health, in procedures carried out by health professionals, health services or a health authority. 9. Legitimate interest of the controller or a third party, as long as the fundamental rights and freedoms of the data subject do not prevail. 10. Credit protection, such as in queries and records at credit protection bureaus.

Notice that consent is first on the list, but it is only one of ten. In the corporate world, a good share of processing relies on performance of a contract, compliance with a legal obligation and legitimate interest.

How to choose the right legal basis in practice

Choosing the legal basis is not an exercise in fitting in the nicest-sounding term. It starts with the purpose. First you define what the data will be used for, then you look for the basis that supports that use. Reversing the order is the source of half the mistakes I see.

Let me take a few examples that show up in any company. When you register a customer to invoice and deliver a product, the basis is usually performance of a contract, because without that data the contract doesn't move. When HR keeps the employee's data to put them on payroll and pay social charges, the basis is compliance with a legal obligation. When sales uses a buyer's CNPJ (Brazil's company registration number) and contact for a B2B approach, the path is normally legitimate interest, assessing whether the data subject would have expected it. And when the company wants to send marketing to an individual who is not a customer, that is where consent tends to be the appropriate basis.

The point few people notice is that the legal basis must be decided before collection and recorded. Choosing it afterwards, when the problem shows up, doesn't count. A mature company can point out, for each master data field and each use, which purpose and which basis support that processing. This is what the law calls the record of processing operations, and it is where data governance comes in with full force.

Consent is not the rule: the most common mistake

There is a myth that the LGPD is synonymous with asking for consent for everything. That is the costliest mistake I see in companies. Consent is a fragile basis by nature. It must be free, specific and informed, it cannot be a condition for using a service that doesn't depend on that data, and the data subject can withdraw it whenever they want.

Imagine basing a customer's tax record on consent. The day they revoke it, the company has no basis to keep information that tax law requires it to retain. That is a dead end. That is why good practice is to use the basis that reflects the reality of that processing. If there is a contract, it is performance of a contract. If a law requires it, it is a legal obligation. Consent is left for cases where the person truly has the freedom to say yes or no without harm, such as marketing and optional communications.

Sensitive data: a stricter regime

The LGPD treats sensitive personal data separately: data about racial or ethnic origin, religious belief, political opinion, health, sex life, genetic and biometric data. For these, Article 11 brings its own list of grounds, narrower than the one for ordinary data.

The practical difference that catches companies most is this: legitimate interest does not apply to sensitive data. If your operation deals with health data, biometrics for access control or any sensitive information, you cannot lean on the most comfortable basis in the corporate world. The level of requirement goes up, consent, when used, must be specific and highlighted, and the care with security and purpose has to be greater. A word of warning: before defining the basis for processing sensitive data, sit down with legal or with the data protection officer (DPO), because the cost of getting it wrong here is high.

Where data governance comes in

Here is the part that really interests me. The legal basis looks like a topic for the legal team alone, but it doesn't hold up without organized data. To say which legal basis applies, the company needs to know which personal data it has, where it is, what it is used for and who is responsible for each item. That is data governance, not a legal brief.

Anyone who has taken part in an LGPD compliance project knows where it gets stuck. It doesn't get stuck on interpreting the law, it gets stuck when mapping the data, because the same customer is registered in five systems with five different versions, nobody knows which record is the correct one, and the CPF is in a free-text notes field. Without organized master data, mapping becomes guesswork, and a legal basis assigned on top of messy data protects no one.

That is why master data management and the LGPD go hand in hand. When the company has a single view of the customer, a supplier master without duplicates and a dictionary that says what each field means, assigning purpose and legal basis stops being a puzzle. As I discuss in the book Master Data Management: Fundamentos e Aplicações, published by Editora Brasport (book in Portuguese), reliable data is a prerequisite for anything serious you want to do with data, and compliance is one of them.

Who is responsible for the legal basis

Defining the legal basis is a shared decision, and that is where many companies get lost, each one thinking it is someone else's problem. Legal and the data protection officer (DPO) answer for interpreting the law and choosing the ground. But the one who knows the real purpose of the processing is the business area, the one who knows where the data lives is the data and IT area, and the one who guarantees that the data is reliable is data governance. The right legal basis on top of wrong data doesn't solve anything, and right data without a defined basis doesn't either.

Main questions about the LGPD legal bases

How many legal bases does the LGPD have? Ten for ordinary personal data, set out in Article 7. For sensitive personal data, Article 11 has its own, narrower list of grounds.

Is consent mandatory to process data? No. Consent is only one of the bases. In many corporate cases, performance of a contract, compliance with a legal obligation and legitimate interest are more appropriate and more stable than consent.

Can I use more than one legal basis for the same data? For the same purpose, you choose the basis that best supports it. What happens is that the same data can have different purposes over time, and each purpose requires its own basis. Invoicing a customer and sending them marketing are distinct purposes.

What is legitimate interest and when does it apply? It is the basis that allows processing data for a legitimate purpose of the controller or a third party, as long as the data subject's rights do not prevail. It requires an assessment that the processing is expected and proportionate, and it cannot be used for sensitive data.

What happens if the company has no legal basis for a processing activity? The processing is considered irregular. Besides the risk of sanctions from the ANPD (Brazil's data protection authority), there is reputational risk and exposure in the event of an incident. In practice, processing data without a basis is operating with a liability that only shows up when it blows up.

MDM Academy

MDM Academy is 4MDG's school of data governance and master data. It was born from a simple perception: the market needs people who understand data in practice, not only in theory, and who know how to connect technical concepts with business impact. LGPD, data quality, master records, MDM and governance are topics that, in the end, meet, and that is what the program sets out to show.

If you work with master data, take care of customer, supplier or material data, work in compliance, or want to build a career in an area that only grows, it is worth getting to know MDM Academy and joining the Data Club. It is where we exchange real experience about governance, master data and the problems that show up every day inside companies.

Conclusion

An LGPD legal basis is not legal bureaucracy, it is the underlying question of why your company is allowed to use each piece of data it collects. The ten bases in Article 7 show the way, and consent, contrary to what many people think, is the exception and not the rule in the corporate environment. What holds all of this up is organized data. Without knowing which data you have, where it is and what it is for, choosing a legal basis is guessing. With data governance and master data in order, compliance stops being a project that scares people and becomes the natural consequence of doing the homework well. And in your company, today, can anyone say on what basis each piece of personal data is processed?