IAPP Certified Data Protection Officer — Brazil (CDPO/BR)

Brazil's Lei Geral de Proteção de Dados (LGPD) was originally enacted as which federal law?

• ALei nº 13.709/2018
• BLei nº 12.965/2014
• CLei nº 13.853/2019
• DDecreto nº 8.771/2016

Which of the following activities is explicitly EXCLUDED from the LGPD's scope of application?

• AProcessing of personal data by a private company to offer services to Brazilian residents
• BProcessing of employee data by an employer in Brazil
• CProcessing carried out exclusively for journalistic, artistic, or literary purposes
• DCross-border transfer of personal data from a Brazilian controller to an overseas process…

Under the LGPD, how many legal bases exist for the lawful processing of personal data?

• ASix, the same as the GDPR
• BEight
• CTen
• DTwelve

A company needs to process personal data to fulfill a purchase contract entered into by a data subject. Which LGPD legal basis applies?

• ALegitimate interest
• BLegal or regulatory obligation
• CExecution of a contract or preliminary procedures at the data subject's request
• DConsent

Under the LGPD, consent as a legal basis for processing personal data must meet which standard?

• AIt must be free, informed, and unequivocal, expressed in writing or by other means that d…
• BIt must be implied from the data subject's conduct and need not be explicit
• CA single broad consent covers all future processing activities regardless of purpose
• DConsent for general marketing is sufficient to cover sensitive data processing as well

The LGPD recognises a legal basis called 'legitimate interest.' Which constraint applies specifically to this basis?

• AIt may be used freely without any balancing test
• BIt applies only to government entities processing data for public administration
• CIt cannot be invoked to justify processing sensitive personal data
• DIt requires prior approval from the ANPD before processing begins

Which category of data qualifies as 'sensitive personal data' under the LGPD?

• ARacial or ethnic origin, religious belief, health data, and biometric data used for indiv…
• BName, address, and email address combined in a single record
• CTransactional purchase history linked to a loyalty card
• DPublic professional biographical information posted on a company website

Under the LGPD, which legal bases may be used to process sensitive personal data? (Select the BEST answer.)

• AOnly consent and legal obligation — legitimate interest, credit protection, and contract…
• BAny of the ten bases listed in Article 7 apply equally to sensitive data
• CSensitive data cannot be processed under any basis; it requires full anonymization first
• DOnly legitimate interest and consent are available for sensitive data

A data subject submits a request to access all personal data held about them by a company. What does the LGPD require the controller to do?

• AConfirm the existence of processing and provide access to the data in a simplified or com…
• BRespond within 30 calendar days with a summary of categories of data held
• CRoute the request to the ANPD, which will then respond to the data subject
• DAcknowledge the request and respond only when the data is related to financial transactio…

Which of the following is a data subject right recognized under LGPD Article 18?

• ARight to demand compensation directly from the ANPD for any data breach
• BRight to have all their data deleted regardless of the legal basis used for processing
• CRight to prevent any processing of their data by asserting an objection
• DRight to portability of their personal data to another service or product provider upon e…

How many distinct rights does LGPD Article 18 grant to data subjects?

• ASix
• BEight
• CNine
• DEleven

A data subject asks a controller to stop processing their personal data that was collected with consent. The controller has verified the withdrawal request. Which LGPD right does this exercise?

• ARight to anonymization
• BRight to correction
• CRight to deletion of personal data processed with consent
• DRight to portability

Under the LGPD, which entity is defined as the 'controller' (controlador)?

• AThe natural or legal person who makes decisions regarding the processing of personal data
• BAny natural or legal person that processes personal data on behalf of and under the instr…
• CThe ANPD, acting as the supervisory body for all processing activities
• DA data subject who consents to the use of their own data

Under the LGPD, the 'operator' (operador) is best described as which of the following?

• AThe individual within the organization who is responsible for approving the data protecti…
• BThe ANPD official assigned to oversee a specific company's compliance
• CAny data subject who actively uses a digital service
• DA natural or legal person that processes personal data on behalf of the controller

The LGPD's role of 'encarregado' is equivalent to which role in the GDPR?

• AData Protection Officer (DPO)
• BData subject representative
• CSupervisory authority commissioner
• DProcessor representative

Which of the following is a mandatory duty of the encarregado under the LGPD?

• AIntermediating communications between the controller and data subjects, and between the c…
• BServing as the company's legal representative in civil courts for data-related claims
• CApproving all new data processing activities before they commence
• DPublishing an annual transparency report to the public stock exchange

The LGPD requires that the identity and contact information of the encarregado be made public. What is the PRIMARY purpose of this requirement?

• ATo allow competitors to identify the organization's privacy compliance strategy
• BTo comply with anti-corruption disclosure requirements under Brazilian corporate law
• CTo satisfy the stock-exchange listing rules for data-intensive companies
• DTo enable data subjects and the ANPD to contact the responsible person for privacy matter…

The Autoridade Nacional de Proteção de Dados (ANPD) was formally established by which legislation?

• ALei nº 13.709/2018 (original LGPD text)
• BDecreto Presidencial nº 9.696/2019
• CLei nº 13.853/2019, which amended the LGPD and created the ANPD
• DLei nº 12.965/2014 (Marco Civil da Internet)

Which of the following best describes the ANPD's three primary institutional functions?

• ARegulation, investigation/sanctioning, and education/guidance
• BInvestigation, taxation, and criminal prosecution
• CLegislation, adjudication, and immigration control
• DCertification, auditing, and insurance of data protection compliance

The LGPD empowers the ANPD to impose a simple fine for violations. What is the maximum amount per infraction?

• A2% of global annual revenue, capped at R$50 million per infraction
• B4% of global annual revenue, up to €20 million (following the GDPR model)
• C1% of Brazilian revenue, capped at R$10 million per infraction
• D2% of the entity's annual revenue in Brazil, excluding taxes, capped at R$50 million per…

Which of the following sanctions under LGPD Article 52 may only be applied AFTER a lighter sanction has already been imposed in the same case?

• AWarning
• BSimple fine
• CPartial suspension of database operations
• DDaily fine

A Brazilian company becomes aware of a security incident affecting personal data. Under ANPD Resolution CD/ANPD 15/2024, within what timeframe must it notify the ANPD if significant risk or damage to data subjects may result?

• A3 working days from the moment the controller becomes aware the incident affected persona…
• B72 hours from discovery of the breach, regardless of scope
• C7 calendar days from the start of the investigation
• D30 days from the end of the incident containment phase

Which of the following BEST describes the risk-based threshold that triggers mandatory incident reporting to the ANPD under the LGPD?

• AAny security incident involving personal data must be reported, regardless of impact
• BOnly incidents affecting more than 1,000 data subjects require reporting
• CIncidents that may lead to significant risk or damage to data subjects must be reported
• DReporting is voluntary and at the discretion of the controller's legal team

If a controller cannot determine the full scope of a reportable incident within the LGPD notification deadline, what should it do?

• AWait until the investigation is complete before filing any report
• BReport only to data subjects and delay the ANPD notification until full facts are known
• CRequest a 6-month extension from the ANPD before filing
• DSubmit a preliminary report and complete the information within 20 working days

Under the LGPD, international transfers of personal data to a country without an ANPD adequacy recognition may proceed under which mechanism?

• AStandard Contractual Clauses (SCCs) issued or recognized by the ANPD
• BInformal notification to the ANPD within 30 days after the transfer
• CSelf-certification on the ANPD public register as a compliant transfer agent
• DVerbal assurances from the recipient that they follow LGPD principles

The ANPD issued its Standard Contractual Clauses (SCCs) regulation in 2023. What obligation applies to controllers using SCCs for international transfers?

• AThe SCCs may be adapted and customized by each controller to reflect commercial preferenc…
• BThe SCCs only apply to transfers from Brazil to EU member states
• CThe SCCs must be adopted in full and without modifications; partial adoption is not permi…
• DSCCs expire after 12 months and must be renewed annually with the ANPD

An ANPD adequacy decision for an international transfer means which of the following?

• AThe destination country's privacy law has been deemed equivalent to the LGPD, and transfe…
• BThe destination country must additionally sign a bilateral treaty with Brazil
• CThe ANPD has certified that the recipient company's internal controls meet LGPD requireme…
• DThe transfer is still prohibited until a data subject impact assessment is completed

Binding Corporate Rules (BCRs) under the LGPD are primarily used in which scenario?

• ABy independent companies transferring data to unrelated business partners in third countr…
• BBy data subjects to set personal privacy preferences that bind the controller
• CBy multinational corporate groups to authorize intra-group transfers across borders
• DBy the ANPD to bind multiple controllers operating in the same industry sector

The LGPD establishes which of the following as a general principle for data processing?

• APurpose limitation — data must be processed for specified, explicit, and legitimate purpo…
• BMaximization — controllers should collect as much data as possible to ensure service qual…
• CData sharing — controllers must share all collected data with government authorities on r…
• DPerpetual retention — data must be retained indefinitely unless the data subject requests…

The LGPD's principle of 'accountability' (responsabilização e prestação de contas) requires controllers to do which of the following?

• APublish quarterly data processing audits on the ANPD public portal
• BSubmit all processing activities to the ANPD for pre-approval before collection begins
• CObtain ISO 27001 certification within one year of starting operations
• DDemonstrate adoption of effective measures to ensure compliance with data protection rules

How does the LGPD's approach to legitimate interest as a legal basis differ from the GDPR?

• ALegitimate interest under the LGPD may not be used to process sensitive personal data; th…
• BThe LGPD requires legitimate interest to be registered with the ANPD before use; the GDPR…
• CThe LGPD allows legitimate interest for any purpose without a balancing test; the GDPR re…
• DBoth the LGPD and GDPR prohibit legitimate interest for commercial purposes

Which statement accurately describes the penalty structure difference between the LGPD and the GDPR?

• AThe LGPD imposes higher maximum fines than the GDPR because it uses global revenue
• BBoth laws use a 4% global revenue cap with identical currency limits
• CThe LGPD does not permit monetary fines; it relies solely on warnings and database suspen…
• DThe GDPR caps fines at 4% of global annual revenue; the LGPD caps fines at 2% of Brazilia…

The LGPD provides a 'right to review of automated decisions.' This right is MOST comparable to which GDPR right?

• ARight to erasure (right to be forgotten)
• BRight to object to processing
• CRight to explanation and human review of decisions based solely on automated processing
• DRight to data portability

A key difference between the LGPD and the GDPR regarding breach notification timelines is:

• ABoth require notification within 72 hours of becoming aware of the breach
• BThe GDPR does not require breach notification; only the LGPD does
• CThe LGPD requires notification within 24 hours; the GDPR allows 72 hours
• DThe LGPD requires notification within 3 working days based on a risk threshold; the GDPR…

Unlike the GDPR, the LGPD does not include which of the following data subject rights?

• ARight to access personal data
• BRight to correct inaccurate data
• CRight to object to processing of personal data
• DRight to withdraw consent

Article 6 of the LGPD lists ten data processing principles. Which of the following is NOT among them?

• ANecessity (necessidade)
• BNon-discrimination (não discriminação)
• CProfitability (lucratividade)
• DFree access (livre acesso)

Under the LGPD, personal data of children (under 12 years old) requires which special treatment?

• AProcessing requires specific and highlighted consent from at least one parent or legal gu…
• BProcessing is prohibited for all purposes
• CProcessing may proceed without consent if the purpose is educational
• DProcessing only requires consent from the child's school or educational institution

The LGPD applies to processing of personal data that occurs in Brazil or is carried out by organizations established in Brazil. It also applies to processing when which of the following conditions is met?

• AThe controller is headquartered in a country that has an adequacy agreement with Brazil
• BThe processing involves any digital technology regardless of location
• CThe data involves financial transactions worth more than R$10,000
• DThe data subjects are located in Brazil at the time of collection, regardless of where th…

Under the LGPD, 'personal data' is defined as:

• AInformation relating to an identified or identifiable natural person
• BOnly data that directly identifies a natural person, such as full name and national ID nu…
• CAny data stored in a digital format by a company or government agency
• DData collected under formal consent agreements; unilaterally collected data is excluded

A technology company anonymizes customer data by applying irreversible techniques such that re-identification is not reasonably possible. Under the LGPD, how is this anonymized data classified?

• AAs sensitive personal data requiring heightened protection
• BAs personal data because it was originally personal before anonymization
• CAs non-personal data, falling outside the LGPD's scope
• DAs pseudonymous data subject to the full requirements of the LGPD

The LGPD requires that consent for processing personal data be specific. What does this mean in practice?

• AConsent may cover broad categories of processing as long as it is in writing
• BConsent is automatically specific if obtained via an electronic checkbox
• CConsent must relate to a specific purpose; one consent cannot cover unrelated future proc…
• DSpecific consent requires a notarized signature from the data subject

The LGPD permits processing personal data to protect the life or physical safety of the data subject or a third party. This legal basis applies in which scenario?

• AA hospital shares a patient's medical data with emergency responders when the patient is…
• BA marketing team shares customer data with a business partner for promotional campaigns
• CAn employer monitors employee productivity using location tracking to improve revenue
• DA retailer processes purchase history to predict future buying preferences

Under the LGPD, what is the legal basis referred to as 'tutela da saúde' (health tutelage)?

• AProcessing needed for health insurance pricing models
• BProcessing of health data for commercial pharmaceutical research by private companies
• CProcessing carried out by health professionals, hospitals, or health entities for the del…
• DProcessing by employers to track employee sick days and reduce absenteeism

The LGPD includes a legal basis for processing related to credit protection. Which type of organization is MOST likely to rely on this basis?

• AA hotel storing guest preferences for personalized service
• BA streaming service recommending content based on viewing history
• CA social media platform tracking user engagement metrics
• DA financial institution running credit bureau checks to assess a loan applicant's creditw…

The LGPD's principle of 'prevention' (prevenção) requires controllers to:

• APrevent all third-party processors from accessing personal data
• BPrevent data from leaving Brazilian borders under any circumstances
• CAdopt measures to prevent damage to data subjects resulting from personal data processing
• DPrevent employees from accessing any personal data unless they are in the IT department

A data subject contacts a company asking what data it holds about them. The company must respond in which timeframe under the LGPD?

• AWithin 15 days from the date of the request
• BWithin 72 hours
• CWithin 30 business days
• DWithin 60 calendar days if the request is complex

Which LGPD right allows a data subject to know with which third parties their personal data has been shared?

• ARight to correction
• BRight to anonymization
• CRight to information about third-party sharing
• DRight to erasure