I –with the consent of the data subject;
II –for compliance with a legal or regulatory obligation by the controller;
III –by the public administration, for the processing and shared use of data which are necessary for the execution of public policies provided in laws or regulations, or based on contracts, agreements or similar instruments, subject to the provisions of Chapter IV of this Law;
IV –for carrying out studies by research entities, ensuring, whenever possible, the anonymization of personal data;
V –when necessary for the execution of a contract or preliminary procedures related to a contract of which the data subject is a party, at the request of the data subject;
VI –for the regular exercise of rights in judicial, administrative or arbitration procedures, the last pursuant to Law No. 9,307, of September 23, 1996 (the “Brazilian Arbitration Law”);
VII –for the protection of life or physical safety of the data subject or a third party;
VIII –to protect health, in a procedure carried out by health professionals or by health entities;
IX –when necessary to fulfill the legitimate interests of the controller or a third party, except when the data subject’s fundamental rights and liberties which require personal data protection prevail; or
X –for the protection of credit, including as provided in the pertinent legislation.
§1When the provisions of Items II and III of the lead sentence of this article are applicable, and except in the situations provided in Art. 4 of this Law, the data subject shall be informed of the situations in which processing of her/his data will be allowed.
§2The way in which information is made available as provided in §1 and Item I of the lead sentence of Art. 23 of this Law may be specified by the national authority.
§3The processing of publicly accessible personal data shall consider the purpose, the good faith and the public interest that justify its being made available.
§4The consent requirement provided in the lead sentence of this article is waived for data manifestly made public by the data subject, safeguarding the rights of the data subject and the principles provided in this Law.
§5The controller who has obtained the consent referred to in Item I of the lead sentence of this article that needs to communicate or share personal data with other controllers shall obtain specific consent from the data subject for this purpose, except when the need for such consent is waived as provided in this Law.
§6Any eventual waiver of the consent requirement does not release processing agents from the other obligations provided in this Law, especially that of obeying the general principles and guarantees of the data subject’s rights.