Sensitive health data

Short answer Under Brazil’s LGPD, sensitive health data is a special category requiring explicit consent and heightened security measures; the Federal Council of Medicine (CFM) further mandates specific clinical documentation and access controls for health professionals handling such data. TL;DR Health data is classified as “sensitive personal data” under LGPD Art. 5, §II and Art. 11. Processing requires at least one legal basis from LGPD Art. 7, with explicit consent (Art. 8) or necessity for healthcare provision (Art. 7, IX) being most common. CFM Resolution No. 2.299/2021 requires electronic medical records to ensure audit trails, encryption, and role-based access. Data subjects retain rights to access, correction, deletion, and data portability (LGPD Arts. 18–21), enforceable via ANPD complaints. Health data transfers abroad require adequacy decisions or appropriate safeguards (LGPD Art. 33), with no current EU-Brazil adequacy agreement. Violat