There is a widespread misconception about Brazil's data protection law that needs to be addressed directly: the LGPD does not require consent for every use of personal data.
This surprises many people — and it is often exploited by companies who present privacy notices as though checking a box is all that matters. In reality, the LGPD establishes a nuanced framework in which consent is just one of ten valid legal bases for data processing, and in some important contexts — particularly financial services — it is not even the primary one.
Understanding when companies can process your data without your consent is not a legal loophole to worry about. It is essential knowledge that helps you understand your actual rights, recognize when processing is legitimate, and identify when it is not.
Before addressing the specific cases, the fundamental principle must be clear: the LGPD does not permit arbitrary data processing. Every single instance of data collection, storage, use, sharing, or deletion must be justified by one of the legal bases explicitly listed in Article 7 (for regular personal data) or Article 11 (for sensitive personal data) of the law.
Consent is one legal basis. But the law recognizes that in many legitimate situations, requiring consent would either be impractical, contrary to the public interest, or would give one party disproportionate power to withhold cooperation from legitimate processes.
The key question is never just "did the person consent?" — it is "is there a valid legal basis for this processing?"
What it means: A company may process personal data — without consent and regardless of the individual's preferences — when processing is necessary to comply with a legal or regulatory obligation.
Why it matters for consumers: Financial institutions in Brazil are subject to extensive regulatory requirements from the Banco Central do Brasil (BACEN), the Receita Federal, COAF (the financial intelligence unit), and other bodies. These requirements mandate that institutions:
When a digital bank asks for your CPF and a selfie during onboarding, or when a payment platform retains your transaction history for years after you close your account, it is not acting against the LGPD — it is fulfilling regulatory obligations under this legal basis.
What this means for you: You cannot prevent this processing by refusing consent, because consent is not the legal basis being used. However, you can verify that the processing is genuinely necessary for regulatory compliance (not just convenient for the company), and you can complain to regulators if data is retained beyond the legally required period.
What it means: Data may be processed when it is necessary to fulfill a contract you have with the company, or to take the preliminary steps you requested before entering into one.
Why it matters for consumers: When you open a payment account, authorize a transfer, or purchase a product online, a contract is formed. Processing your account number, transaction details, and payment information to execute that transaction is not only permitted — it is required to deliver what you asked for.
This legal basis also covers pre-contractual processing: credit assessments, identity verification during the application process, and quote generation.
What this means for you: Processing under this basis is legitimate, but it must be genuinely necessary for the contract. A company cannot use contract performance as a basis to process data that goes beyond what is needed — for example, collecting your browsing history or location data is unlikely to be necessary for processing a payment, and would need a separate justification.
What it means: In genuine emergencies where someone's life or physical integrity is at risk, personal data may be processed without consent — even sensitive data.
Why it matters in practice: This basis is narrow and exceptional. It covers situations like a financial institution sharing account information with emergency services in a documented crisis, not routine processing.
What this means for you: This basis provides an important safeguard but should not be invoked broadly. If a company claims this basis for non-emergency processing, that is a red flag.
Despite the existence of multiple valid non-consent legal bases, many companies default to consent collection as their primary compliance strategy — and this creates problems for consumers.
The consent checkbox problem: When a company uses consent as a catch-all basis for processing that should be justified under legal obligation or contract performance, it creates a false impression that the consumer controls the processing. In reality, refusing consent may simply cause the company to invoke a different legal basis — or worse, it may prevent you from accessing a service that you should be able to access without surrendering unnecessary consent.
Bundled consent: Some companies present a single consent request that covers multiple, unrelated processing purposes. The LGPD requires that consent be specific — you should be able to consent to some purposes and not others. Bundled consent that cannot be disaggregated is not legally compliant under the LGPD.
Consent as a precondition: The LGPD explicitly states that consent cannot be required as a condition for receiving a service if the processing is not strictly necessary for that service. A payment platform cannot make consent to marketing emails a condition for accessing payment services.
Withdrawal difficulties: Companies are required to make consent withdrawal as easy as the original consent. Hiding the opt-out mechanism behind multiple menus, requiring written requests for what was done with a single click, or failing to honor withdrawal requests are all LGPD violations.
When the data being processed falls into the LGPD's special categories — racial or ethnic origin, religious beliefs, health data, biometric data, political opinions — the rules are stricter.
For sensitive data, non-consent processing is only permitted in more limited circumstances:
The biometric data implication: For payment platforms that collect facial recognition data or fingerprints during KYC, this is particularly relevant. Biometric data is sensitive under the LGPD. Its collection must be justified by a specific legal basis — typically legal obligation for regulatory KYC compliance — and must be protected by heightened security measures.
One additional non-consent basis deserves separate explanation: legitimate interest.
Unlike legal obligation or contract performance — which have clear, objective justifications — legitimate interest requires a subjective balancing test. The company must assess whether its interest in processing the data outweighs your rights and freedoms.
The LGPD requires this assessment to consider:
In financial services, legitimate interest might justify processing your transaction history to detect fraud patterns that protect other customers — a genuine public benefit that likely outweighs the privacy impact. It would not justify using your transaction data to build marketing profiles for third parties, where the company's commercial interest does not obviously outweigh your privacy interests.
Your right to object: When legitimate interest is the legal basis, you have the right to object to the processing. The company must then demonstrate that its legitimate interests genuinely outweigh your rights — or stop the processing.
When you encounter a privacy notice or question how a company is using your data, use this framework:
If you believe a company is processing your data without a valid legal basis:
The LGPD's approach to consent is more sophisticated than most people realize: it is not a universal requirement, but one important legal basis among several. Understanding the full picture — when consent is needed, when it is not, and what protections apply regardless — gives you a more accurate and more useful understanding of your actual rights.
In financial services, where processing under legal obligation is common and legitimate, this understanding prevents you from expecting control you do not have while ensuring you exercise the very real rights you do have.
The goal of the LGPD is not to make data processing impossible — it is to ensure that when data is processed, it is for legitimate purposes, with appropriate transparency, and with genuine respect for your interests as a person.
OneKey Payments processes personal data only on valid LGPD legal bases, with full documentation of processing activities, transparent privacy policies, and a designated DPO available to handle all data subject requests.
Read OneKey's Privacy Policy → Compliance & Regulation
.jpg)
.jpg)
.jpg)
