Brazil LGPD (Lei Geral de Proteção de Dados)

Why does it matter?

The LGPD gives people in Brazil enforceable rights over their personal data and gives the ANPD power to fine organizations up to 2% of their revenue in Brazil for the prior year, capped at R$50 million per infraction, in addition to warnings, publicity of the infraction, data blocking or deletion and suspension of processing (article 52).

Key benefits include:

• Extraterritorial reach

A foreign company that offers services to people in Brazil, or whose data was collected in Brazil, falls under the law (article 3).

• Ten legal bases, not just consent

Article 7 lists ten grounds for processing, including legitimate interest and credit protection, so organizations must document which one applies.

• Rights with a clock

A data subject can request confirmation of processing, access, correction, portability, deletion and more, and a full access declaration is due within fifteen days (articles 18 and 19).

• Accountability is a principle

Processing agents must be able to show that their measures are effective, not only that they exist (article 6, item X).

• Named sanctions

The ANPD can warn, fine, publicize, block, delete data, or suspend processing after an administrative procedure with the right of defense (article 52).

How does it work?

The law is built around ten principles (article 6): purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, and accountability and responsibility. Every processing operation needs a legal basis from article 7, or from article 11 when the data is sensitive, such as health, biometric or genetic data or data revealing racial origin, religion or political opinion.

People hold the rights listed in article 18: confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary data, portability, deletion of consent-based data, information on sharing, information on refusing consent and withdrawal of consent. Article 20 adds the right to review decisions made solely by automated processing, and children's data must be processed in their best interest with specific consent from at least one parent or guardian (article 14).

On the organization side, the controller decides how data is processed and the operator processes it on the controller's behalf. Controllers keep records of processing (article 37), name an encarregado whose contact details are public (article 41), may be required by the ANPD to produce a data protection impact report, the relatório de impacto à proteção de dados pessoais, or RIPD (article 38), and must secure data from the design phase onward (article 46).

Key Elements

• Legal bases and consent (articles 7, 8 and 11)

Consent must be given in writing or by another means that shows the person's will, tied to specific purposes. The controller bears the burden of proving it, and generic authorizations are void. Sensitive data has its own, narrower list of bases, including specific and prominent consent.

• Data subject rights (articles 18 to 20)

The controller answers requests for access, correction, anonymization, portability and deletion. Simplified confirmation or access is immediate; a complete declaration stating the origin of the data, the criteria used and the purpose is due within fifteen days. Rights are exercised by express request to the controller, and the person can also petition the ANPD.

• The encarregado (article 41)

The controller appoints an encarregado to take complaints from data subjects, receive communications from the ANPD, advise staff and contractors on data protection practices and carry out other duties the controller sets. The ANPD may issue further rules, including exemptions from appointing one based on the size of the entity or volume of processing.

• Security and incident notification (articles 46 to 49)

Processing agents adopt technical and administrative measures against unauthorized access and accidental or unlawful loss. The controller notifies the ANPD and the data subject of an incident that may cause relevant risk or damage within a reasonable period defined by the ANPD, describing the data, the people involved, the risks and the measures taken.

• International transfers (article 33)

Personal data may leave Brazil only on specified grounds: to a country with adequate protection, with guarantees such as specific contractual clauses, standard contractual clauses, global corporate rules or approved seals and codes, with ANPD authorization, or with the person's specific and prominent consent, among others.

• Good practice and governance (article 50)

Controllers and operators may formulate governance programs that set rules on organization, complaints, security standards, internal supervision and risk mitigation, taking account of the nature and scale of the processing. Adopting a good-practice and governance policy is one of the criteria the ANPD weighs when applying sanctions (article 52, paragraph 1).

What does it cover?

The LGPD covers any processing operation by a natural person or a public or private legal entity, in any medium, if the processing takes place in Brazil, aims to offer goods or services to people in Brazil, or concerns data collected in Brazil (article 3). It does not cover purely private non-economic use, journalistic, artistic or academic purposes (with limits), or public security, defense and criminal investigation, which need their own laws (article 4).

What are its objectives?

The law protects fundamental rights of freedom and privacy and the free development of personality.

Respect privacy, informational self-determination and freedom of expression (article 2).

Process personal data only on a legal basis and for specific, legitimate purposes (articles 6 and 7).

Give data subjects clear information and effective rights over their data (articles 9 and 18).

Protect data through security measures and governance from design to disposal (articles 46 and 50).

Make processing agents accountable and liable for damage caused (articles 6, 42 and 52).

Place a single national authority, the ANPD, in charge of supervision and sanctions (article 55-J).

Framework in Context

The LGPD is a national statute that borrows many concepts from the EU GDPR, such as lawful bases, data subject rights and international transfer rules, but uses its own terms: titular for the data subject, encarregado instead of a data protection officer, and the RIPD for impact assessment. Its fine ceiling is a share of Brazilian revenue with a fixed cap rather than the GDPR's worldwide turnover formula. Sector rules, such as those for financial institutions, apply alongside it.

Common Framework Mappings

Organizations map LGPD to global privacy and security standards to harmonize obligations, simplify controls, and facilitate cross-border data transfers and regulatory alignment.

Mapped frameworks include:

APEC Privacy Framework

EU General Data Protection Regulation (GDPR)

ISO/IEC 27001

ISO/IEC 27701

NIST Privacy Framework

UK Data Protection Act 2018 and UK GDPR