bmad-plus 0.7.5 → 0.9.0

package/src/bmad-plus/packs/pack-shield/references/lgpd/lgpd-articles.md

@@ -1,271 +1,271 @@
-# LGPD Article-by-Article Reference
-
-## Law No. 13,709/2018 — Lei Geral de Proteção de Dados Pessoais (LGPD)
-*As amended by Law No. 13,853/2019 and subsequent ANPD resolutions*
-
----
-
-## Chapter I — General Provisions (Arts. 1–10)
-
-### Art. 1 — Purpose
-Establishes rules for processing personal data in Brazil to protect fundamental rights of freedom, privacy, and free development of personality.
-
-### Art. 2 — Foundations
-LGPD is based on: respect for privacy; informational self-determination; freedom of expression, information, communication, and opinion; inviolability of honour and image; economic and technological development and innovation; free enterprise; consumer protection; human rights, free development of personality, dignity, and exercise of citizenship.
-
-### Art. 3 — Scope
-Applies to processing in Brazil; offers/provision to individuals in Brazil; data collected in Brazil. Extraterritorial application to controllers and processors outside Brazil.
-
-### Art. 4 — Exemptions
-Does not apply to: personal/household use; journalistic/artistic/academic (with Art. 7 basis); national security, defence, public safety, criminal investigation by public entities; data from outside Brazil with no communication to Brazilian agents.
-
-### Art. 5 — Definitions
-Key terms:
-- **Personal data:** Information related to identified or identifiable natural person
-- **Sensitive personal data:** Racial/ethnic origin, religious belief, political opinion, union membership, religion, health or sex life data, genetic/biometric data
-- **Anonymised data:** Data not identifiable by reasonable means (not personal data)
-- **Data subject (titular):** Natural person to whom data relates
-- **Controller (controlador):** Natural or legal person who determines purposes/means of processing
-- **Processor (operador):** Natural or legal person who processes on behalf of controller
-- **DPO / Encarregado:** Person designated by controller to be contact point with data subjects and ANPD
-- **Processing:** Any operation on personal data (collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation, modification, communication, transfer, diffusion, extraction)
-- **Consent (consentimento):** Free, informed, unambiguous expression of agreement for specific purpose
-- **Blocking (bloqueio):** Temporary suspension of any processing pending review
-- **Anonymisation:** Technical processes making data unable to identify person
-- **Pseudonymisation:** Processing removing identifiability with use of additional information
-- **International data transfer:** Transfer to foreign country or international organisation
-
-### Art. 6 — Principles (10)
-Purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, accountability.
-
-### Art. 7 — Legal Bases (regular personal data — 10)
-I. Consent; II. Legal obligation; III. Public policy by public entity; IV. Research; V. Contract; VI. Exercise of rights in proceedings; VII. Vital interests; VIII. Health protection; IX. Legitimate interest; X. Credit protection.
-
-### Art. 8 — Consent Requirements
-Must be in written or equivalent digital form; burden of proof on controller; may be revoked free of charge at any time; cannot be generic; bundled consents for unrelated processing invalid; cannot condition service on consent unless necessary.
-
-### Art. 9 — Transparency
-Data subjects have right to easy/free access to information about: purposes, duration, identity of controller, DPO contact, shared data and recipients, data subjects' rights.
-
-### Art. 10 — Legitimate Interest (LI)
-LI can only justify processing if: does not prevail over fundamental rights of data subject; limited to legitimate, specific purposes; data subject has a reasonable expectation. Controller must conduct LI assessment (balancing test). Sensitive data cannot use LI.
-
----
-
-## Chapter II — Processing of Sensitive Data & Children's Data (Arts. 11–14)
-
-### Art. 11 — Sensitive Data Processing
-Only permitted when:
-- Express and specific consent from data subject
-- Legal obligation
-- Shared by controller to comply with public policy
-- Studies by research bodies (anonymised)
-- Exercise of rights in proceedings
-- Protection of life/physical safety
-- Health care professionals/services
-- Prevention of fraud/safety of data subject
-- Protection of credit (LI prohibited for sensitive data)
-
-### Art. 12 — Anonymised Data
-Anonymised data is not personal data. Risk of re-identification must be considered in context.
-
-### Art. 13 — Research
-Processing for research permitted; anonymisation preferred; security measures must be adopted; results must be published in anonymised form.
-
-### Art. 14 — Children's and Adolescents' Data
-Processing requires: specific and highlighted consent from parent/guardian; data collected only as necessary; no sharing with third parties without consent; best interests of children prioritised. Controllers must verify parental consent in reasonable manner.
-
----
-
-## Chapter III — Data Subject Rights (Arts. 17–22)
-
-### Art. 17 — Right of Ownership
-Every natural person has ownership of their personal data and guaranteed fundamental rights.
-
-### Art. 18 — Rights List
-Data subjects may request from controller at any time:
-- **I** — Confirmation of processing
-- **II** — Access to data
-- **III** — Correction (inaccurate/incomplete/outdated)
-- **IV** — Anonymisation, blocking, or deletion of unnecessary/excessive/non-compliant data
-- **V** — Portability to another provider (ANPD to define format)
-- **VI** — Deletion of consent-based data (unless Art. 16 retention exception applies)
-- **VII** — Information about public/private entities with whom data was shared
-- **VIII** — Information about possibility of not providing consent and consequences
-- **IX** — Revocation of consent (Art. 8)
-
-Controller must respond: immediately (simplified); within 15 days (full access report); without undue delay (corrections/deletions).
-
-### Art. 19 — Response Format
-Simplified response or through a complete declaration within 15 days from data subject's request. Must be free of charge.
-
-### Art. 20 — Automated Decisions
-Data subject may request review of decisions made solely by automated processing (profiling, credit assessment, etc.). Controller must provide clear and adequate information about criteria and procedures. Human review must be available on request.
-
-### Art. 21 — Protected Data
-Data subject data used to exercise rights cannot be used against the data subject.
-
-### Art. 22 — Defence of Interests
-Rights may be exercised via consumer protection entities, agencies, ANPD, or judicially.
-
----
-
-## Chapter IV — Processing by Public Entities (Arts. 23–32)
-
-### Art. 23
-Public entities may process personal data for public interest; must inform purpose and necessity; cannot transfer to private entities except for specific Art. 26 reasons.
-
-### Art. 26
-Sharing with private sector only where: indispensable for service delivery; for regulatory purpose; or research (anonymised).
-
-### Art. 27
-International transfers by public entities for international cooperation: follow applicable treaties and ANPD guidance.
-
----
-
-## Chapter V — International Transfer (Arts. 33–36)
-
-### Art. 33 — Transfer Mechanisms
-Personal data may only transfer internationally to:
-- Countries/org with adequate protection (ANPD adequacy decision)
-- Agreements/standard contractual clauses (Art. 35)
-- Binding corporate rules (BCRs) — Art. 35, I
-- Specific consent for the transfer — Art. 33, VIII
-- ANPD authorisation — Art. 33, IX
-
-### Art. 34 — Adequacy Assessment
-ANPD evaluates: rule of law; protection of human rights; independence of supervisory body; effective remedies; reciprocity; international conventions ratified by Brazil.
-
-### Art. 35 — Contractual Clauses and BCRs
-Specific or standard contractual clauses must provide adequate protection level. BCRs authorised by ANPD. ANPD may publish standard contractual clauses (not yet done as of 2025).
-
-### Art. 36 — Complementary Transfers
-Even where Art. 33 applies, ANPD may impose additional requirements for sensitive data or large-scale transfers.
-
----
-
-## Chapter VI — Controllers and Processors (Arts. 37–45)
-
-### Art. 37 — Record of Processing Activities (RoPA)
-Controllers and processors must maintain RoPA. ANPD may require disclosure. ANPD Resolution No. 2/2022 made RoPA mandatory for agents that: process data at large scale; are public authorities; or process sensitive data.
-
-### Art. 38 — DPIA / RIPD (Relatório de Impacto à Proteção de Dados)
-ANPD may require DPIA for high-risk processing. Content defined by ANPD. Must be considered by the controller before processing begins.
-
-### Art. 39 — Processor Instructions
-Processors must act per controller instructions. Processors may only act independently if legally required.
-
-### Art. 40 — Standards
-ANPD may establish operational standards for controllers and processors.
-
-### Art. 41 — DPO (Encarregado)
-Controllers must appoint a DPO. DPO must:
-- Receive complaints and communications from data subjects
-- Communicate with data subjects and ANPD
-- Guide internal employees and contractors
-- Perform other tasks as defined by controller or ANPD
-
-Controller must publish DPO identity and contact. ANPD may exempt certain controllers (ANPD Resolution No. 2/2022 exempts small/micro companies with limited scope).
-
-### Art. 42 — Liability
-Controllers or processors causing damage by LGPD violation are liable to repair (individual or collective). Joint/several liability where multiple parties involved.
-
-### Art. 43 — Exemptions
-Exempt if: did not carry out processing; processing not at fault; damage caused exclusively by data subject or third party.
-
-### Art. 44 — Irregular Processing
-Processing irregular if: does not comply with law or security regulations; does not achieve stated purpose; does not meet transparency/security/data quality obligations.
-
-### Art. 45 — Consumer Code
-Processing subject to LGPD does not exclude application of Consumer Protection Code where applicable.
-
----
-
-## Chapter VII — Security, Good Practices, and Governance (Arts. 46–51)
-
-### Art. 46 — Security Measures
-Technical and administrative security measures proportional to risk must be adopted by controllers and processors. ANPD may define minimum standards.
-
-### Art. 47 — Internal Practices
-Agents must adopt policies, procedures, and governance mechanisms to: demonstrate effective compliance; implement data subject rights; assess effectiveness of measures; mitigate risks.
-
-### Art. 48 — Incident Notification
-Security incidents that may cause relevant risk or harm to data subjects must be notified to ANPD and data subjects:
-- **Preliminary notification:** 3 working days from awareness (ANPD Resolution CD/ANPD No. 15/2024)
-- **Full report:** Within 20 working days
-- Must include: nature of data; number of affected subjects; technical measures taken/planned; risks of incident; reasons for delay (if any)
-
-### Art. 49 — System Design
-Systems must be designed with security measures from conception (privacy by design) and default settings protective of privacy.
-
-### Art. 50 — Good Practices
-Controllers and processors may develop good practice programmes; ANPD may accredit entities to manage complaints and promote standards.
-
-### Art. 51 — National Strategy
-National data protection strategy for government entities.
-
----
-
-## Chapter VIII — ANPD (Arts. 55-A to 55-L)
-
-### Art. 55-A
-ANPD is a federal government body with technical autonomy, own budget, and decision-making authority. Part of the Presidency.
-
-### Art. 55-J — ANPD Competencies
-- Issue regulations and guidance
-- Conduct inspections and audits
-- Apply administrative sanctions
-- Promote knowledge of LGPD
-- Cooperate with data protection authorities internationally
-- Require DPIAs
-- Define standards for international transfer mechanisms
-
----
-
-## Chapter IX — Administrative Sanctions (Arts. 52–54)
-
-### Art. 52 — Sanctions
-ANPD may apply (after investigation and opportunity to respond):
-| Sanction | Details |
-|----------|---------|
-| Warning | With deadline to adopt corrective measures |
-| Simple fine | Up to 2% of revenue in Brazil (previous FY); group cap R$50M per violation |
-| Daily fine | To compel compliance; same cap |
-| Publicisation | Public disclosure of violation after completion of investigation |
-| Blocking | Temporary blocking of personal data involved |
-| Deletion | Erasure of personal data related to violation |
-| Suspension | Partial suspension of processing up to 6 months (renewable once) |
-| Prohibition | Total prohibition of personal data processing activities |
-
-### Art. 52, §1º — Aggravating/Mitigating Factors
-Gravity; intent; recurrence; good faith; cooperation; financial advantage; vulnerability of data subjects; internal controls; timely adoption of corrective measures; proportionality.
-
-### Art. 53 — Financial Sanctions Methodology
-ANPD to define criteria for calculating fines, including: nature of violation; controller size; number of data subjects; economic advantage.
-
-### Art. 54 — Statute of Limitations
-Administrative violations time-bar after 5 years. Count from date ANPD becomes aware of violation.
-
----
-
-## Key ANPD Resolutions (as of 2025)
-
-| Resolution | Subject |
-|-----------|---------|
-| CD/ANPD No. 1/2021 | Internal regulation of ANPD |
-| CD/ANPD No. 2/2022 | RoPA requirements; DPO exemptions for small entities |
-| CD/ANPD No. 4/2023 | Simplified LGPD applicability for micro/small enterprises |
-| CD/ANPD No. 15/2024 | Security incident notification — 3 working day preliminary requirement |
-| Normative Instruction No. 1/2021 | DPO reporting requirements |
-
----
-
-## LGPD Timeline
-| Date | Event |
-|------|-------|
-| 14 Aug 2018 | Law 13,709/2018 signed |
-| 9 Jul 2019 | Law 13,853/2019 — created ANPD, amended provisions |
-| 18 Sep 2020 | LGPD entered into force (except sanctions) |
-| 1 Aug 2021 | Administrative sanctions entered into force |
-| 2022 | ANPD Resolution No. 2 — RoPA/DPO rules |
-| 2024 | ANPD Resolution No. 15 — 3-day breach notification |
+# LGPD Article-by-Article Reference
+
+## Law No. 13,709/2018 — Lei Geral de Proteção de Dados Pessoais (LGPD)
+*As amended by Law No. 13,853/2019 and subsequent ANPD resolutions*
+
+---
+
+## Chapter I — General Provisions (Arts. 1–10)
+
+### Art. 1 — Purpose
+Establishes rules for processing personal data in Brazil to protect fundamental rights of freedom, privacy, and free development of personality.
+
+### Art. 2 — Foundations
+LGPD is based on: respect for privacy; informational self-determination; freedom of expression, information, communication, and opinion; inviolability of honour and image; economic and technological development and innovation; free enterprise; consumer protection; human rights, free development of personality, dignity, and exercise of citizenship.
+
+### Art. 3 — Scope
+Applies to processing in Brazil; offers/provision to individuals in Brazil; data collected in Brazil. Extraterritorial application to controllers and processors outside Brazil.
+
+### Art. 4 — Exemptions
+Does not apply to: personal/household use; journalistic/artistic/academic (with Art. 7 basis); national security, defence, public safety, criminal investigation by public entities; data from outside Brazil with no communication to Brazilian agents.
+
+### Art. 5 — Definitions
+Key terms:
+- **Personal data:** Information related to identified or identifiable natural person
+- **Sensitive personal data:** Racial/ethnic origin, religious belief, political opinion, union membership, religion, health or sex life data, genetic/biometric data
+- **Anonymised data:** Data not identifiable by reasonable means (not personal data)
+- **Data subject (titular):** Natural person to whom data relates
+- **Controller (controlador):** Natural or legal person who determines purposes/means of processing
+- **Processor (operador):** Natural or legal person who processes on behalf of controller
+- **DPO / Encarregado:** Person designated by controller to be contact point with data subjects and ANPD
+- **Processing:** Any operation on personal data (collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation, modification, communication, transfer, diffusion, extraction)
+- **Consent (consentimento):** Free, informed, unambiguous expression of agreement for specific purpose
+- **Blocking (bloqueio):** Temporary suspension of any processing pending review
+- **Anonymisation:** Technical processes making data unable to identify person
+- **Pseudonymisation:** Processing removing identifiability with use of additional information
+- **International data transfer:** Transfer to foreign country or international organisation
+
+### Art. 6 — Principles (10)
+Purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, accountability.
+
+### Art. 7 — Legal Bases (regular personal data — 10)
+I. Consent; II. Legal obligation; III. Public policy by public entity; IV. Research; V. Contract; VI. Exercise of rights in proceedings; VII. Vital interests; VIII. Health protection; IX. Legitimate interest; X. Credit protection.
+
+### Art. 8 — Consent Requirements
+Must be in written or equivalent digital form; burden of proof on controller; may be revoked free of charge at any time; cannot be generic; bundled consents for unrelated processing invalid; cannot condition service on consent unless necessary.
+
+### Art. 9 — Transparency
+Data subjects have right to easy/free access to information about: purposes, duration, identity of controller, DPO contact, shared data and recipients, data subjects' rights.
+
+### Art. 10 — Legitimate Interest (LI)
+LI can only justify processing if: does not prevail over fundamental rights of data subject; limited to legitimate, specific purposes; data subject has a reasonable expectation. Controller must conduct LI assessment (balancing test). Sensitive data cannot use LI.
+
+---
+
+## Chapter II — Processing of Sensitive Data & Children's Data (Arts. 11–14)
+
+### Art. 11 — Sensitive Data Processing
+Only permitted when:
+- Express and specific consent from data subject
+- Legal obligation
+- Shared by controller to comply with public policy
+- Studies by research bodies (anonymised)
+- Exercise of rights in proceedings
+- Protection of life/physical safety
+- Health care professionals/services
+- Prevention of fraud/safety of data subject
+- Protection of credit (LI prohibited for sensitive data)
+
+### Art. 12 — Anonymised Data
+Anonymised data is not personal data. Risk of re-identification must be considered in context.
+
+### Art. 13 — Research
+Processing for research permitted; anonymisation preferred; security measures must be adopted; results must be published in anonymised form.
+
+### Art. 14 — Children's and Adolescents' Data
+Processing requires: specific and highlighted consent from parent/guardian; data collected only as necessary; no sharing with third parties without consent; best interests of children prioritised. Controllers must verify parental consent in reasonable manner.
+
+---
+
+## Chapter III — Data Subject Rights (Arts. 17–22)
+
+### Art. 17 — Right of Ownership
+Every natural person has ownership of their personal data and guaranteed fundamental rights.
+
+### Art. 18 — Rights List
+Data subjects may request from controller at any time:
+- **I** — Confirmation of processing
+- **II** — Access to data
+- **III** — Correction (inaccurate/incomplete/outdated)
+- **IV** — Anonymisation, blocking, or deletion of unnecessary/excessive/non-compliant data
+- **V** — Portability to another provider (ANPD to define format)
+- **VI** — Deletion of consent-based data (unless Art. 16 retention exception applies)
+- **VII** — Information about public/private entities with whom data was shared
+- **VIII** — Information about possibility of not providing consent and consequences
+- **IX** — Revocation of consent (Art. 8)
+
+Controller must respond: immediately (simplified); within 15 days (full access report); without undue delay (corrections/deletions).
+
+### Art. 19 — Response Format
+Simplified response or through a complete declaration within 15 days from data subject's request. Must be free of charge.
+
+### Art. 20 — Automated Decisions
+Data subject may request review of decisions made solely by automated processing (profiling, credit assessment, etc.). Controller must provide clear and adequate information about criteria and procedures. Human review must be available on request.
+
+### Art. 21 — Protected Data
+Data subject data used to exercise rights cannot be used against the data subject.
+
+### Art. 22 — Defence of Interests
+Rights may be exercised via consumer protection entities, agencies, ANPD, or judicially.
+
+---
+
+## Chapter IV — Processing by Public Entities (Arts. 23–32)
+
+### Art. 23
+Public entities may process personal data for public interest; must inform purpose and necessity; cannot transfer to private entities except for specific Art. 26 reasons.
+
+### Art. 26
+Sharing with private sector only where: indispensable for service delivery; for regulatory purpose; or research (anonymised).
+
+### Art. 27
+International transfers by public entities for international cooperation: follow applicable treaties and ANPD guidance.
+
+---
+
+## Chapter V — International Transfer (Arts. 33–36)
+
+### Art. 33 — Transfer Mechanisms
+Personal data may only transfer internationally to:
+- Countries/org with adequate protection (ANPD adequacy decision)
+- Agreements/standard contractual clauses (Art. 35)
+- Binding corporate rules (BCRs) — Art. 35, I
+- Specific consent for the transfer — Art. 33, VIII
+- ANPD authorisation — Art. 33, IX
+
+### Art. 34 — Adequacy Assessment
+ANPD evaluates: rule of law; protection of human rights; independence of supervisory body; effective remedies; reciprocity; international conventions ratified by Brazil.
+
+### Art. 35 — Contractual Clauses and BCRs
+Specific or standard contractual clauses must provide adequate protection level. BCRs authorised by ANPD. ANPD may publish standard contractual clauses (not yet done as of 2025).
+
+### Art. 36 — Complementary Transfers
+Even where Art. 33 applies, ANPD may impose additional requirements for sensitive data or large-scale transfers.
+
+---
+
+## Chapter VI — Controllers and Processors (Arts. 37–45)
+
+### Art. 37 — Record of Processing Activities (RoPA)
+Controllers and processors must maintain RoPA. ANPD may require disclosure. ANPD Resolution No. 2/2022 made RoPA mandatory for agents that: process data at large scale; are public authorities; or process sensitive data.
+
+### Art. 38 — DPIA / RIPD (Relatório de Impacto à Proteção de Dados)
+ANPD may require DPIA for high-risk processing. Content defined by ANPD. Must be considered by the controller before processing begins.
+
+### Art. 39 — Processor Instructions
+Processors must act per controller instructions. Processors may only act independently if legally required.
+
+### Art. 40 — Standards
+ANPD may establish operational standards for controllers and processors.
+
+### Art. 41 — DPO (Encarregado)
+Controllers must appoint a DPO. DPO must:
+- Receive complaints and communications from data subjects
+- Communicate with data subjects and ANPD
+- Guide internal employees and contractors
+- Perform other tasks as defined by controller or ANPD
+
+Controller must publish DPO identity and contact. ANPD may exempt certain controllers (ANPD Resolution No. 2/2022 exempts small/micro companies with limited scope).
+
+### Art. 42 — Liability
+Controllers or processors causing damage by LGPD violation are liable to repair (individual or collective). Joint/several liability where multiple parties involved.
+
+### Art. 43 — Exemptions
+Exempt if: did not carry out processing; processing not at fault; damage caused exclusively by data subject or third party.
+
+### Art. 44 — Irregular Processing
+Processing irregular if: does not comply with law or security regulations; does not achieve stated purpose; does not meet transparency/security/data quality obligations.
+
+### Art. 45 — Consumer Code
+Processing subject to LGPD does not exclude application of Consumer Protection Code where applicable.
+
+---
+
+## Chapter VII — Security, Good Practices, and Governance (Arts. 46–51)
+
+### Art. 46 — Security Measures
+Technical and administrative security measures proportional to risk must be adopted by controllers and processors. ANPD may define minimum standards.
+
+### Art. 47 — Internal Practices
+Agents must adopt policies, procedures, and governance mechanisms to: demonstrate effective compliance; implement data subject rights; assess effectiveness of measures; mitigate risks.
+
+### Art. 48 — Incident Notification
+Security incidents that may cause relevant risk or harm to data subjects must be notified to ANPD and data subjects:
+- **Preliminary notification:** 3 working days from awareness (ANPD Resolution CD/ANPD No. 15/2024)
+- **Full report:** Within 20 working days
+- Must include: nature of data; number of affected subjects; technical measures taken/planned; risks of incident; reasons for delay (if any)
+
+### Art. 49 — System Design
+Systems must be designed with security measures from conception (privacy by design) and default settings protective of privacy.
+
+### Art. 50 — Good Practices
+Controllers and processors may develop good practice programmes; ANPD may accredit entities to manage complaints and promote standards.
+
+### Art. 51 — National Strategy
+National data protection strategy for government entities.
+
+---
+
+## Chapter VIII — ANPD (Arts. 55-A to 55-L)
+
+### Art. 55-A
+ANPD is a federal government body with technical autonomy, own budget, and decision-making authority. Part of the Presidency.
+
+### Art. 55-J — ANPD Competencies
+- Issue regulations and guidance
+- Conduct inspections and audits
+- Apply administrative sanctions
+- Promote knowledge of LGPD
+- Cooperate with data protection authorities internationally
+- Require DPIAs
+- Define standards for international transfer mechanisms
+
+---
+
+## Chapter IX — Administrative Sanctions (Arts. 52–54)
+
+### Art. 52 — Sanctions
+ANPD may apply (after investigation and opportunity to respond):
+| Sanction | Details |
+|----------|---------|
+| Warning | With deadline to adopt corrective measures |
+| Simple fine | Up to 2% of revenue in Brazil (previous FY); group cap R$50M per violation |
+| Daily fine | To compel compliance; same cap |
+| Publicisation | Public disclosure of violation after completion of investigation |
+| Blocking | Temporary blocking of personal data involved |
+| Deletion | Erasure of personal data related to violation |
+| Suspension | Partial suspension of processing up to 6 months (renewable once) |
+| Prohibition | Total prohibition of personal data processing activities |
+
+### Art. 52, §1º — Aggravating/Mitigating Factors
+Gravity; intent; recurrence; good faith; cooperation; financial advantage; vulnerability of data subjects; internal controls; timely adoption of corrective measures; proportionality.
+
+### Art. 53 — Financial Sanctions Methodology
+ANPD to define criteria for calculating fines, including: nature of violation; controller size; number of data subjects; economic advantage.
+
+### Art. 54 — Statute of Limitations
+Administrative violations time-bar after 5 years. Count from date ANPD becomes aware of violation.
+
+---
+
+## Key ANPD Resolutions (as of 2025)
+
+| Resolution | Subject |
+|-----------|---------|
+| CD/ANPD No. 1/2021 | Internal regulation of ANPD |
+| CD/ANPD No. 2/2022 | RoPA requirements; DPO exemptions for small entities |
+| CD/ANPD No. 4/2023 | Simplified LGPD applicability for micro/small enterprises |
+| CD/ANPD No. 15/2024 | Security incident notification — 3 working day preliminary requirement |
+| Normative Instruction No. 1/2021 | DPO reporting requirements |
+
+---
+
+## LGPD Timeline
+| Date | Event |
+|------|-------|
+| 14 Aug 2018 | Law 13,709/2018 signed |
+| 9 Jul 2019 | Law 13,853/2019 — created ANPD, amended provisions |
+| 18 Sep 2020 | LGPD entered into force (except sanctions) |
+| 1 Aug 2021 | Administrative sanctions entered into force |
+| 2022 | ANPD Resolution No. 2 — RoPA/DPO rules |
+| 2024 | ANPD Resolution No. 15 — 3-day breach notification |