LGPD Canvas
The visual board for an activity, the rules engine that runs on it, and what it can and cannot assert.
A board, not another registry
The Canvas is a visual way to work the same processing activity: blocks such as personal data, legal basis, and security, filled with notes. It writes to the same table as the form — it is not a parallel record, it is another surface over the same data.
The rules engine
Compliance rules run over the activity and raise findings — undefined retention, missing security measures, sensitive data with no encryption recorded, legitimate interest with no LIA. Evaluation can be triggered for the whole organization, not only on saving a canvas.
That detail is what separated a module that informs from one that misleads: while evaluation only happened on canvas save, activities created through the form were never evaluated and appeared clean.
What a rule can assert about an activity with no notes
When an activity has no notes at all, rules are evaluated against the form's fields. That works well for presence and category — whether there is personal data, whether it is sensitive — because those are equivalent across both vocabularies.
But not everything survives the trip. The form stores free text where the canvas stores structured choices, so a rule asking about a specific measure over a free-text field is reported as not evaluated — never answered by deduction. The one exception is not a guess: an empty block cannot contain anything, so "no encryption recorded" is a fact when nothing was recorded.
When the activity does have notes, they win over the form. The reason is simple: the canvas is the richer record, and whoever emptied a block meant to empty it.