BR LGPD Art. 16 sole paragraph I-II - controller risk and impact report
Assess child-data risks and prepare the controller impact, monitoring and evaluation report
Where this comes from
Provision: Art. 16 sole paragraph I-II - controller risk and impact report
Instrument: ECA Digital (Lei nº 15.211/2025)
Citation: Lei nº 15.211/2025, Art. 16 sole paragraph I-II - controller risk and impact report; Articles 1-3, 7 and 41; Lei nº 15.352/2026
Text version: Lei nº 15.211, de 17 de setembro de 2025, Articles 16-19 and 39; commencement amended by Lei nº 15.352/2026
Checked against the source: 6 September 2026
Who it applies to
It applies when all of these are true:
- Brazil ECA Digital assessed fact Q_BR_ECA_CHILD_ACCESS: YES
- Brazil ECA Digital assessed fact Q_BR_ECA_CHILD_DATA_CONTROLLER: YES
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Assess both the Article 16 product/service child-access scope and the actual controller role processing personal data of children or adolescents. The sole paragraph applies especially to nonessential processing, not only to nonessential processing; necessary service-operation processing does not itself remove these controller duties.
- Map risks to children and adolescents and make efforts to mitigate them under Article 16 sole paragraph (I). Preserve the assessed processing purposes, roles, affected categories, risk analysis, proportionate measures, responsible review and unresolved gaps without treating a generic privacy-policy statement as the assessment.
- Prepare the personal-data protection impact, monitoring and evaluation report required by Article 16 sole paragraph (II), and provide it on request of the competent child/adolescent digital-rights authority under the applicable regulation. This is not a requirement to publish the raw report publicly or a new universal fixed filing interval.
- Article 16 is not listed in Article 39. Do not infer this controller role from generic tracking, an existing impact-assessment flag or an editorial service label, and do not turn purpose necessity into an exemption.
- Use synthetic or sanitized assessment cases and minimized configuration, access, control and review evidence. Exclude real child identities, conversations, images, recordings, precise locations and raw personal-data reports from ordinary task attachments, exports and general logs. Keep any legally necessary sensitive operational material in a separately authorized, purpose-limited process with assessed access and retention. This is an engineering evidence-minimization safeguard, not a prescribed fixed log schema or retention period.
Evidence an auditor expects
- Assessment documentDocument review
Assess child-data risks and prepare the controller impact, monitoring and evaluation report — scoped assessment and minimized evidence
Assess both the Article 16 product/service child-access scope and the actual controller role processing personal data of children or adolescents. The sole paragraph applies especially to nonessential processing, not only to nonessential processing; necessary service-operation processing does not itself remove these controller duties. Map risks to children and adolescents and make efforts to mitigate them under Article 16 sole paragraph (I). Preserve the assessed processing purposes, roles, affected categories, risk analysis, proportionate measures, responsible review and unresolved gaps without treating a generic privacy-policy statement as the assessment. Prepare the personal-data protection impact, monitoring and evaluation report required by Article 16 sole paragraph (II), and provide it on request of the competent child/adolescent digital-rights authority under the applicable regulation. This is not a requirement to publish the raw report publicly or a new universal fixed filing interval. Article 16 is not listed in Article 39. Do not infer this controller role from generic tracking, an existing impact-assessment flag or an editorial service label, and do not turn purpose necessity into an exemption. Use synthetic or sanitized assessment cases and minimized configuration, access, control and review evidence. Exclude real child identities, conversations, images, recordings, precise locations and raw personal-data reports from ordinary task attachments, exports and general logs. Keep any legally necessary sensitive operational material in a separately authorized, purpose-limited process with assessed access and retention. This is an engineering evidence-minimization safeguard, not a prescribed fixed log schema or retention period. Verify current ANPD implementing requirements and qualified Portuguese source review. Lei 15.211/2025 commenced on 17 March 2026 following Lei 15.352/2026; do not infer all historical legal outcomes or full ECA Digital compliance from this record.
Questions people ask
- Does BR LGPD Art. 16 sole paragraph I-II - controller risk and impact report apply to my service?
- It applies when Brazil ECA Digital assessed fact Q_BR_ECA_CHILD_ACCESS: YES; Brazil ECA Digital assessed fact Q_BR_ECA_CHILD_DATA_CONTROLLER: YES.
- From when does this apply?
- BR LGPD Art. 16 sole paragraph I-II - controller risk and impact report applies from 17 March 2026. Its current status is: in force.
- What evidence does an auditor expect?
- Assess child-data risks and prepare the controller impact, monitoring and evaluation report — scoped assessment and minimized evidence.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.