LGPD (Lei Geral de Proteção de Dados Pessoais) is Brazil’s General Data Protection Law, enacted in 2018 and effective since September 2020. It is Latin America’s most comprehensive privacy regulation and applies to any organization processing personal data of Brazilian residents, including companies that have never set foot in Brazil. If you serve Brazilian customers or process data of Brazilian residents, LGPD compliance is mandatory, and this guide explains what that takes.
LGPD at a Glance
LGPD was modeled on the GDPR, but it is not a copy. The structure will feel familiar to anyone who knows European privacy law, with a few important twists:
- It protects personal data of people in Brazil, wherever your business is located.
- It is enforced by the ANPD (Autoridade Nacional de Proteção de Dados), Brazil’s data protection authority.
- It applies to digital and offline processing alike.
- Penalties can reach 2% of the revenue your company earned in Brazil in the previous fiscal year, capped at BRL 50 million per violation, plus other sanctions like daily fines and publicizing the violation.
The enforcement reality has matured since 2020. The ANPD published its sanctioning methodology, opened its first administrative proceedings, and now runs a steady inspection agenda. Compliance is no longer optional for companies doing serious business in Brazil.
Who It Applies To
The reach of LGPD is deliberately wide. Article 3 covers any processing operation carried out in Brazil, or aimed at offering goods or services to people in Brazil, or involving data collected in Brazil. In plain terms:
- A SaaS company in the US with Brazilian subscribers is covered.
- An online store anywhere in the world shipping to Brazil is covered.
- An ad campaign targeting Brazilian users is covered.
If your business touches Brazilian consumers, plan for LGPD as one of your core privacy regimes. Our Global Privacy Law Hub shows how it stacks up against GDPR, CCPA, PIPEDA, and the other laws that may apply to the same business.
The 10 Legal Bases: Not the Same List as GDPR
This is the difference that trips up international companies. LGPD Article 7 gives ten legal bases for processing personal data, where GDPR has six. The familiar ones are there, and Brazil adds its own:
- Consent of the data subject
- Compliance with a legal or regulatory obligation of the controller
- Public administration execution and public policy
- Studies by research bodies, with anonymization whenever possible
- Contract performance, at the request of the data subject
- Exercise of rights in legal, administrative, or arbitration proceedings
- Protection of health, in procedures by health professionals or entities
- Legitimate interests of the controller or third parties, except where the data subject’s fundamental rights prevail
- Credit protection, a Brazil-specific basis for credit checks and scoring
- Protection of credit, related provisions under other laws
Notice what is missing compared to GDPR: there is no separate “vital interests” basis for general use, and the credit-related bases are uniquely Brazilian. Sensitive personal data (health, race, religion, biometrics, political opinions) has its own stricter list under Article 11, so do not assume the Article 7 bases apply there.
Data Subject Rights Under LGPD
People in Brazil hold strong rights over their data, and honoring them is a core compliance obligation:
- Access: confirm whether their data is processed and get a copy
- Correction: fix incomplete, inaccurate, or outdated data
- Anonymization, blocking, or deletion: for unnecessary or excessive data, or data processed against the law
- Portability: request data in a structured format for transfer to another provider, subject to regulation
- Information: learn about entities their data is shared with
- Consent management: withdraw consent and be informed about refusal consequences
- Review: challenge automated decisions that affect their interests
You need a working channel for these requests, a process to verify the requester, and reasonable deadlines. LGPD does not set a single explicit clock the way GDPR’s one month works, but the ANPD expects requests to be answered promptly and without unjustified obstacles. Fast is the only safe answer.
DPO and Governance: The Encarregado
LGPD requires controllers to designate an encarregado (the Brazilian equivalent of a DPO), whose name and contact information must be published. The encarregado is the communication channel between your company, data subjects, and the ANPD. Key points:
- You need one, even as a small business. The law does not exempt companies by size from designating an encarregado.
- The role can be internal or outsourced, and one person can serve multiple companies, but the contact must be public and responsive.
- They should accept data subject requests, handle complaints, and cooperate with the ANPD.
- Brazil does not require a local representative the way some laws do, but your published encarregado contact must actually work for people in Brazil, which usually means Portuguese-language support and Brazil-accessible channels.
On top of the encarregado, LGPD expects real governance: a privacy policy in Portuguese, records of processing operations, security measures appropriate to the data, and internal procedures for data subject requests and breaches.
Breach Response Under LGPD
When a security incident affects personal data, the ANPD must be notified within a reasonable time, and the notification must describe the nature of the incident, the data involved, and the measures taken. The law sets a “reasonable time” rather than a fixed hour count, but the practical benchmark is fast, and the ANPD’s guidance and enforcement practice push toward immediate communication when there is risk to data subjects.
Affected individuals should be informed when the incident can cause them significant harm. As with every privacy law, the breach plan matters more than the breach: know who decides, who contacts the ANPD, and how you reach affected users in Portuguese.
LGPD vs GDPR: The Cheat Sheet
- Legal bases: 10 under LGPD, 6 under GDPR. Credit protection is unique to Brazil.
- Fines: LGPD caps at BRL 50 million per violation; GDPR can reach 4% of global turnover or EUR 20 million, whichever is higher.
- DPO: LGPD requires a published encarregado; GDPR requires a DPO only in specific conditions.
- Breach notification: LGPD says “reasonable time”; GDPR says 72 hours.
- Children’s data: both require heightened care and consent mechanisms.
Building GDPR-grade processes gets you most of the way to LGPD, but the legal bases, the encarregado role, and the Portuguese-language public face are not optional extras. They are the difference between compliant and exposed in Brazil.
An Action Plan for International Businesses
- Confirm whether LGPD applies: any offering to or processing of people in Brazil.
- Map Brazilian personal data: customers, prospects, ad audiences, support data.
- Document your legal basis for each activity using the Article 7 list.
- Designate and publish your encarregado with a working Brazil-accessible contact.
- Publish a Portuguese privacy policy covering LGPD rights and bases.
- Build a data subject request process covering all LGPD rights.
- Write a breach plan that notifies the ANPD promptly and affected users when risk is significant.
Work through the list once and LGPD stops being a mystery. Like every serious privacy law, it rewards the businesses that treat it as a set of habits rather than a compliance certificate to hang on the wall.
Managing privacy laws in multiple countries?
The Global Privacy Law Hub compares GDPR, CCPA, PIPEDA, LGPD, Australia, and UK-GDPR side by side, so you can see which laws cover your business and what each one requires.
About The Author
