CriticalFile-scopeJavaScript / TypeScript Plug & play

Require explicit consent before processing sensitive data

Before handling sensitive personal data (e.g., health, biometric), verify a valid consent record and attach its ID to the processing context. Provide a path to revoke consent and stop further processing.

Add to Mesrai Open workspace

Why this matters

Consent is a lawful basis under LGPD for sensitive data; traceability reduces unlawful processing risk.

Bad vs. good

Side-by-side examples engineers can pattern-match during review.

Avoid

app.post('/health-metrics', (req,res)=>{ save(req.body); res.sendStatus(204); })

Prefer

app.post('/health-metrics', requireConsent(['health']), (req,res)=>{ save(req.body, { consentId: req.consentId }); res.sendStatus(204); })\nfunction requireConsent(scopes){ return (req,res,next)=>{ const id=req.header('x-consent-id'); if(!id||!ConsentStore.valid(id,scopes)) return res.status(403).end(); req.consentId=id; next(); } }

More snippets

Good

fetch('/health-metrics',{ headers:{'x-consent-id': cid }})

Bad

fetch('/health-metrics') // missing consent

Related rules

From the same buckets as this rule.

Critical
Children's data: verify age and parental consent
If data subject is a child/adolescent, require age verification and parental/legal guardian consent prior to processing; deny processing otherwise and do not store the payload.
compliance-lgpdapi-conventions+1
Critical
Deletion requests: anonymize or hard-delete PII irreversibly
On LGPD deletion, remove or irreversibly anonymize PII and purge dependent caches. Keep minimal audit metadata (timestamp, request ID) not linkable back to the subject.
compliance-lgpdmigrations-backward-compat+1
Critical
Encrypt PII at rest with AES-GCM and managed keys
For fields like CPF, birth_date, and address, use AES-256-GCM with envelope encryption. Keys must come from a managed KMS; rotate data keys at least annually and store key IDs with the ciphertext.
compliance-lgpdsecurity-hardening

Bad vs. good

Side-by-side examples engineers can pattern-match during review.

Avoid

app.post('/health-metrics', (req,res)=>{ save(req.body); res.sendStatus(204); })

Prefer

app.post('/health-metrics', requireConsent(['health']), (req,res)=>{ save(req.body, { consentId: req.consentId }); res.sendStatus(204); })\nfunction requireConsent(scopes){ return (req,res,next)=>{ const id=req.header('x-consent-id'); if(!id||!ConsentStore.valid(id,scopes)) return res.status(403).end(); req.consentId=id; next(); } }

More snippets

Good

fetch('/health-metrics',{ headers:{'x-consent-id': cid }})

Bad

fetch('/health-metrics') // missing consent

Related rules

From the same buckets as this rule.

Critical

Children's data: verify age and parental consent

If data subject is a child/adolescent, require age verification and parental/legal guardian consent prior to processing; deny processing otherwise and do not store the payload.

compliance-lgpdapi-conventions+1

Critical

Deletion requests: anonymize or hard-delete PII irreversibly

On LGPD deletion, remove or irreversibly anonymize PII and purge dependent caches. Keep minimal audit metadata (timestamp, request ID) not linkable back to the subject.

compliance-lgpdmigrations-backward-compat+1

Critical

Encrypt PII at rest with AES-GCM and managed keys

For fields like CPF, birth_date, and address, use AES-256-GCM with envelope encryption. Keys must come from a managed KMS; rotate data keys at least annually and store key IDs with the ciphertext.

compliance-lgpdsecurity-hardening