BR LGPD ECA Digital Art. 27 - serious-violation reporting and protected preservation

Where this comes from

Who it applies to

What engineering work it implies

Evidence an auditor expects

• Assessment documentDocument review

  ECA Digital scoped safeguards and conditional Article 39 assessment

  Assess Lei 15.211/2025 Article 39's service-specific modulation and conditional dispensation. Record the exact eligible editorial-control or previously licensed-content provider class and every cumulative §1 condition: applicable classification rules (or required alternative age adequacy and harmful-content signalling), transparent age classification, accessible parental mediation restricting age-based content, personal data processed, interaction with other users and commercial transactions, and accessible reporting channels for misclassified or rights-violating content. A generic service label, a single safeguard or an asserted exemption is insufficient. Do not extend relief beyond the listed provisions, actual provider/service scope and established conditions. Record qualified review of current implementing criteria; synthetic checks and minimized records must preserve replacement safeguards and unresolved gaps. Record the assessed Brazil-available provider role under Article 27 and Article 2. A conditional response process does not depend on child-account labels, messaging, an Article 29 editorial exclusion or an existing reported incident. For directly or indirectly detected qualifying violations, perform immediate removal of identified criminal material from availability and preserve the required material, account content, user data and metadata in strictly confidential authorized custody for competent transfer. Verify the operational Federal Police or competent international channel and current MJSP report requirements/deadlines, secure transfer and receipt handling. Decree Art. 42 qualifying referrals require automated systems with safeguards against dissemination and investigation fragmentation. Reconcile the six-month Article 27/Marco Civil Art. 15 preservation reference and lawful extensions with Decree Art. 39 §2: after confirmed receipt, delete sexual-exploitation/abuse content from servers subject to ECA 241-B §2, while preserving remaining account/user data and metadata under applicable periods, holds and international obligations. Record separate removal, custody, receipt, deletion and remaining-data states; a general log-retention policy must not override those states. Use Decree Art. 37 duplicate-report relief only after verifying an identical legally required foreign report is available to Brazilian authorities and the applicable conditions are met; do not suppress all Brazilian reporting. Keep other urgent-risk reporting under Decree Art. 39 §3 conditional on reasonable necessity, proportionality and minimization; it is optional, not an instruction to forward every concern. Use synthetic fixtures to exercise intake, immediate removal, secure transfer failure/retry, confirmed receipt, deletion and lawful-hold paths. Keep illegal material, victim identities, full reports and raw communications out of ordinary task attachments, exports and general logs; store only scoped process evidence and opaque authorized case references.

Questions people ask

Does BR LGPD ECA Digital Art. 27 - serious-violation reporting and protected prese… apply to my service?

It applies when Brazil ECA Digital assessed fact Q_BR_ECA_BRAZIL_PROVIDER: YES. It does not apply where Brazil ECA Digital assessed fact Q_BR_ECA_ART39_SERVICE_CLASS: YES.

From when does this apply?

BR LGPD ECA Digital Art. 27 - serious-violation reporting and protected prese… applies from 17 March 2026. Its current status is: in force.

What evidence does an auditor expect?

ECA Digital scoped safeguards and conditional Article 39 assessment.