LGPD in the Laboratory: How LIMS Protects Data and Samples

Although it was enacted in 2018, Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, Law 13,709/2018 — LGPD) only took practical effect on September 18, 2020. Since August 1, 2021, the National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD) has also been enforcing the administrative sanctions set out in the legislation.

When people hear LGPD, the first image that comes to mind is usually a bank or an online store processing credit card data. Few laboratories stop to consider that LGPD applies to them too — and that a compliance audit today can already include a question most laboratories don’t know how to answer: “who has access to your customers’ data and samples, and how do you prove it?”

What LGPD Has to Do With the Laboratory

Every laboratory that receives samples for testing handles personal data, even without realizing it. A test request carries the requester’s name, tax ID (CNPJ or CPF), address, email, and phone number.

In a clinical or veterinary laboratory, there’s also patient or animal health data — a category LGPD treats as sensitive, subject to stricter rules.

And there’s the data that links the sample to the person: the chain of custody, which by definition must trace who collected it, who handled it, and who released the result.

Even a laboratory doing industrial quality control, with no health data at all, already handles enough personal data to fall under the law.

This puts the laboratory in the position of data controller (when it decides what to do with the customer’s data) or data processor (when it handles data on behalf of a third party, such as an industrial client that outsources testing).

In both cases, the law requires a legal basis for processing the data, security measures proportional to the risk, and the ability to respond if a breach occurs.

Which Laboratory Data Falls Under LGPD?

In practice, a Laboratory Information Management System (LIMS) holds at least four types of data regulated by LGPD:

• Customer/requester identification data — name, tax ID (CNPJ/CPF), contact details, billing address.
• Chain-of-custody data — who collected, transported, received, and analyzed the sample, with date and time.
• Sensitive data — external customer data and supplier information.
• Employee data — analyst, supervisor, whoever signed off on the report, system access history.

The Risks of Non-Compliance

Failing to comply with LGPD isn’t just a fine risk (which can reach 2% of revenue, capped at R$ 50 million per infraction). For an accredited laboratory, the more immediate risk is audit non-conformance: ISO 17025 already requires access control and record traceability — LGPD simply formalizes, with the force of law, what the technical standard already demands as good practice. A laboratory that can’t show who accessed a result, when, and why fails on both fronts at once.

There’s also reputational risk: industrial clients auditing testing suppliers increasingly include data protection questions in their supplier qualification checklist. Not having a ready answer can cost the contract.

How a LIMS Helps Achieve LGPD Compliance in Practice

A well-configured laboratory information management system covers most of what’s needed for compliance:

• Role-based access control — analysts only see what they need for their role, supervisors and managers have broader visibility, and sensitive data stays restricted to those with a genuine need to access it.
• Audit trail — every access, edit, and result release is logged with user, date, and time, in a way that can’t be deleted. It’s one of the pieces of evidence most commonly required in both LGPD and ISO 17025 audits.
• Automated retention policy — the law requires that personal data not be kept longer than necessary; a LIMS can apply retention and disposal rules by record type, instead of relying on someone remembering to delete it manually.
• Encryption and controlled backup — data protected in transit and at rest, with a recovery plan in case of an incident.
• Controlled export — when a customer requests their own data (the right of access and portability provided for in the law), the system can generate a customer-specific extract without exposing third-party data.

This already covers much of what Good Laboratory Practice (GLP) also requires in terms of data integrity and traceability — in other words, investing in LGPD compliance reinforces the technical conformance the laboratory already needs to maintain.

Steps to Start Achieving Compliance

You don’t need to solve everything at once. Here’s a practical sequence:

• Map which personal data the laboratory currently processes (customer, chain of custody, employee) and where it’s stored.
• Check current access control — who can view or edit each type of data, and whether that’s documented.
• Confirm whether a reliable audit trail exists in the system currently in use (spreadsheets don’t have one; a well-configured LIMS does).
• Define a retention policy — how long each type of record needs to be kept, and when it can be discarded.
• Document the process — LGPD requires proof of compliance, not just compliance itself.

Conclusion

LGPD compliance shouldn’t start when legal counsel sends over a list of requirements, or when an audit asks for evidence. It starts when the laboratory understands that information is an asset just as important as the sample itself.

In practice, much of what LGPD requires should already exist in a laboratory pursuing traceability, reliability, and conformance with standards like ISO 17025. The difference is that this is no longer just good practice — it now carries legal weight.

So it’s worth running a simple exercise: if a customer or an auditor asked you today to show who accessed a given sample or result, for what reason, what changes were made, and how that information is protected, would your laboratory be able to answer with evidence — or would it depend on people’s memory?

Laboratories spend years building credibility around their results. But in a landscape where data also needs to be intact, traceable, and protected, trust no longer depends solely on the quality of the analysis — it now also depends on the quality of the information that accompanies the entire process.

Want to understand how Actiz LIMS can support your laboratory’s LGPD compliance? Request a demo and talk to our team about your specific scenario.