prof-ramos LGPD Checklist
Purpose
Build practical LGPD-ready checklists with article-level legal grounding. Prefer operational evidence over generic compliance prose.
This skill is not legal advice. Use it to structure engineering, audit, governance, and vendor-review artifacts; advise legal review for final legal positions.
Workflow
- Identify scope: feature, repo, product area, vendor, audit, release, or organizational process.
- Classify the treatment: data categories, titulares, controlador/operador, finalidade, base legal, sharing, retention, and security controls.
- Load
references/base-legal.mdwhen citing LGPD/ANPD provisions or building a full checklist. - Produce checklist items with explicit evidence requests and legal basis.
- Flag uncertainty instead of overstating compliance. If a legal citation is not certain, mark it as "verificar com jurídico" and cite the nearest likely article.
- Prefer official/current sources when the user asks for legally current output; verify against Planalto and ANPD before presenting final legal claims.
Output Patterns
For operational checklists, use this table:
| Item | Evidencia esperada | Base legal | Status | Risco |
|---|---|---|---|---|
| Descrever a verificacao concreta | Arquivo, tela, log sanitizado, contrato, politica, query, ticket ou decisao | LGPD, art. X; norma ANPD quando aplicavel | Pendente/Parcial/Conforme/Nao aplicavel | Baixo/Medio/Alto + motivo |
For audit summaries, use:
- Escopo: what was reviewed and what was out of scope.
- Achados: ordered by risk, each with evidence and legal basis.
- Lacunas: missing documents, missing proof, or facts needing owner confirmation.
- Proximas acoes: concrete remediation tasks with owners when known.
For repo/product reviews, map checklist items to concrete artifacts:
- Code: routes, server actions, schemas, models, logs, env vars, permissions, tests.
- Docs: privacy policy, runbook, incident process, retention schedule, vendor list.
- Operations: access reviews, backup/restore, incident drills, DSR workflow, consent records.
Checklist Domains
Cover only domains relevant to the request:
- Inventario/ROPA and records of processing.
- Base legal and finalidade.
- Transparencia and privacy notices.
- Consentimento, cookies, and proof/revocation.
- Minimizacao, anonymization, pseudonymization, and logging.
- Dados sensiveis and children/adolescents.
- Seguranca, access control, secrets, backups, and incident response.
- Direitos do titular and response workflow.
- Retencao and secure disposal.
- Terceiros, operadores, subprocessadores, and international transfer.
- Governanca, accountability, audit evidence, and periodic review.
Style
- Write in Portuguese when the user writes in Portuguese.
- Cite legal bases inline:
[LGPD, art. 6º, III],[LGPD, arts. 7º e 11],[Resolucao CD/ANPD nº 2/2022, art. 9º]. - Do not cite non-official blogs as legal authority. Use them only as secondary reading if the user explicitly asks.
- Do not expose secrets, tokens, CPF, SIAPE, emails, or raw provider responses in evidence examples.