Brazil’s LGPD, data protection for Brazil
Understand legal bases, rights and the role of the ANPD if you serve people in Brazil.
Official sources
Use these official places to read the text and find the latest version.
Get the document
The law and ANPD guidance are free online. Some pages are in Portuguese.
Open the official page ↗What LGPD Brazil is
The Lei Geral de Proteção de Dados is Brazil’s general data protection law, closely modelled on the GDPR. It sets legal bases, individual rights and security duties.
It applies to anyone processing data of people in Brazil.
How LGPD Brazil got to where it is today
The milestones that changed what organisations have to do.
LGPD passed
Law 13.709 is enacted in August 2018.
In force
Takes effect in September 2020.
Penalties apply
ANPD can issue sanctions from August 2021.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
You have customers in Brazil.
You process Brazilian employee data.
You use Brazilian vendors.
You need a local contact.
What it asks of you
The requirements fall into six areas.
Legal bases
A valid reason to process data.
Data subject rights
Access, correction, deletion.
Data protection officer
Appoint an encarregado.
Security
Protect data and report incidents.
International transfers
Conditions for sending data abroad.
Sanctions
ANPD fines and orders.
The 9 chapter groups, 16 article clusters and 68 obligations of the LGPD
The LGPD is Brazil's general data protection law, close in spirit to the GDPR, with ten legal bases and enforcement by the ANPD. This page paraphrases the operative obligations by chapter.
16 article groups · 68 obligations
l1Chapter I: Preliminary provisionsScope, definitions and the ten principles.2 article groups · 13 obligations
- Art. 3
Apply the law to any processing carried out in Brazil, aimed at offering goods or services to people in Brazil, or on data collected in Brazil, regardless of where your organisation sits.
What you do
- Map your Brazilian customers and data flows
- Record the scoping decision
- Art. 4
Check the listed exceptions (such as purely personal use, journalism, public security and national defence) before relying on one.
What you do
- Document why an exception applies
- Review with counsel
- Art. 5
Use the statutory definitions, including personal data, sensitive data, controller, operator, encarregado (data protection officer), anonymisation and consent.
What you do
- Adopt a glossary
- Train staff
Evidence to keep
- Applicability assessment
- Glossary
- Art. 6, I
Process for legitimate, specific and explicit purposes communicated to the person, without incompatible later use (purpose).
What you do
- Write purposes at collection
- Block reuse without review
- Art. 6, II
Make processing compatible with the purposes communicated, in line with context (adequacy).
What you do
- Compare use with notice
- Fix mismatches
- Art. 6, III
Limit processing to the minimum necessary, with relevant and proportional data (necessity).
What you do
- Remove unneeded fields
- Review data sets
- Art. 6, IV
Give holders easy and free consultation on the form and duration of processing and on their complete data (free access).
What you do
- Provide self-service access
- Publish how to request
- Art. 6, V
Keep data accurate, clear, relevant and up to date (data quality).
What you do
- Enable corrections
- Run data quality checks
- Art. 6, VI
Give clear, precise and easily accessible information about processing and the agents involved (transparency).
What you do
- Publish a privacy notice in Portuguese
- Update when practices change
- Art. 6, VII
Use technical and administrative measures to protect data from unauthorised access and accidental or unlawful destruction, loss, alteration or disclosure (security).
What you do
- Apply security controls
- Test them
- Art. 6, VIII
Adopt measures to prevent damage from processing (prevention).
What you do
- Assess risks early
- Remediate
- Art. 6, IX
Do not process for unlawful or abusive discriminatory purposes (non-discrimination).
What you do
- Review models and rules for bias
- Document checks
- Art. 6, X
Be able to show effective measures that prove compliance (accountability).
What you do
- Keep policies and logs
- Assign an owner
Evidence to keep
- Records of processing
- Purpose register
- Retention schedule
- Accountability file
l2Chapter II: Processing of personal dataLegal bases, sensitive data, children and end of processing.4 article groups · 19 obligations
- Art. 7, I
Process with the holder's consent where no other basis fits.
What you do
- Capture clear consent
- Record proof
- Art. 7, II
Process to meet a legal or regulatory obligation of the controller.
What you do
- Cite the law
- Limit data to what the law requires
- Art. 7, III
Allow the public administration to process data needed for public policies under laws or contracts.
What you do
- Document the authority
- Limit use
- Art. 7, IV
Allow research bodies to process data, anonymising where possible.
What you do
- Use anonymisation
- Document research governance
- Art. 7, V
Process when needed to perform a contract or preliminary procedures at the holder's request.
What you do
- Link to contract scope
- Do not stretch to marketing
- Art. 7, VI
Process for the regular exercise of rights in judicial, administrative or arbitration proceedings.
What you do
- Keep only case data
- Restrict access
- Art. 7, VII-VIII
Process to protect life or physical safety, or to protect health in procedures by health professionals or entities.
What you do
- Document emergency use
- Limit to need
- Art. 7, IX
Process on legitimate interest of the controller or a third party, unless the holder's fundamental rights and freedoms prevail.
What you do
- Run a documented balancing test
- Offer opt-out
- Art. 7, X
Process for credit protection, according to the relevant law.
What you do
- Follow credit-sector rules
- Keep records
- Art. 8
Where consent is the basis, obtain it in writing or another demonstrable form, with clear clauses, for specified purposes, and allow free revocation.
What you do
- Use separate consent clauses
- Provide a revoke option
- Art. 9
Give the holder facilitated access to information on purpose, form and duration, identity and contact of controller, sharing, responsibilities and rights.
What you do
- Publish a layered notice
- Update on change
- Art. 10
Use legitimate interest only for concrete situations such as supporting activities and protecting the holder's services, and process only data strictly necessary.
What you do
- Record purposes
- Be ready to give the ANPD your impact report
Evidence to keep
- Legal basis register
- Legitimate interest assessment
- Consent records
- Notices
- Art. 11, I
Process sensitive data with specific, highlighted consent for specific purposes.
What you do
- Use a separate consent for sensitive data
- Explain the purpose
- Art. 11, II
Process sensitive data without consent only in listed cases such as legal obligation, research, legal proceedings, life protection, health protection or fraud prevention in identity verification.
What you do
- Record the condition used
- Restrict access
- Art. 12-13
Treat anonymised data as outside the law only if it cannot reasonably be re-identified, and apply public health study safeguards.
What you do
- Test re-identification risk
- Document anonymisation
Evidence to keep
- Sensitive data inventory
- Consent forms
- Condition register
- Art. 14
Process children's data in their best interest, with specific and highlighted consent from at least one parent or guardian, and publish clear information in an age-appropriate way.
What you do
- Verify consent proportionately
- Use simple language
- Art. 14 §4
Do not make participation in games or apps conditional on providing more data than strictly necessary.
What you do
- Reduce data for children
- Review sign-up flows
Evidence to keep
- Parental consent records
- Child-friendly notices
- Art. 15
End processing when the purpose is achieved, data is no longer needed, the holder revokes consent or the ANPD orders it.
What you do
- Set triggers
- Record the end date
- Art. 16
Delete data after processing ends, except where needed to meet a legal obligation, for studies with anonymisation, for transfer to a third party within the law, or for exclusive controller use if anonymised.
What you do
- Automate deletion
- Document retention exceptions
Evidence to keep
- Retention schedule
- Deletion records
l3Chapter III: Rights of the data holderWhat individuals can ask of you.1 article group · 10 obligations
- Art. 18, I-II
Confirm whether you process the holder's data and give access to it.
What you do
- Search all systems
- Respond in time
- Art. 18, III
Correct incomplete, inaccurate or outdated data.
What you do
- Provide a correction route
- Notify recipients
- Art. 18, IV
Anonymise, block or delete unnecessary, excessive or unlawfully processed data.
What you do
- Define a runbook
- Record actions
- Art. 18, V
Provide portability to another service provider on express request, following ANPD rules.
What you do
- Offer exports
- Test them
- Art. 18, VI
Delete personal data processed with consent, unless a retention exception applies.
What you do
- Process deletion
- Note exceptions
- Art. 18, VII-VIII
Tell the holder which public and private entities you shared data with, and what happens if consent is refused.
What you do
- List recipients
- Add to notices
- Art. 18, IX
Allow revocation of consent through a free and easy route.
What you do
- Provide a revoke link
- Stop processing
- Art. 19
Respond immediately in simplified form, or within 15 days with a full declaration of origin, existence of records, criteria and purpose.
What you do
- Track deadlines
- Use a ticket system
- Art. 20
Review, on request, decisions made solely by automated processing that affect the holder's interests, and provide clear information on criteria.
What you do
- Document algorithms and criteria
- Offer a review route
- Art. 22
Allow holders to defend their interests individually or collectively in court.
What you do
- Keep defence records
- Notify legal early
Evidence to keep
- Request log
- Response templates
- Identity verification
- Review of automated decisions record
l4Chapter IV: Public authoritiesSpecial rules for government processing.1 article group · 2 obligations
- Arts. 23-30
Public bodies process for public purposes and legal competences, publish processing information and follow rules on sharing and on the private sector.
What you do
- Publish information on processing
- Control sharing with private entities
- Arts. 31-32
Where the ANPD asks, public bodies must report and may be told to adopt corrective measures.
What you do
- Prepare for ANPD inquiry
- Keep response records
Evidence to keep
- Public purpose records
- Shared-use agreements
l5Chapter V: International transferMoving data out of Brazil.1 article group · 4 obligations
- Art. 33, I
Transfer to countries or international bodies with an adequate level of protection, as recognised by the ANPD.
What you do
- Check the ANPD list
- Record the basis
- Art. 33, II
Use contractual safeguards such as specific clauses, standard clauses, global corporate rules or approved seals and codes.
What you do
- Sign standard clauses approved by the ANPD
- Keep copies
- Art. 33, VIII
Use specific, highlighted consent for the transfer after clear information about its international nature, where no other mechanism applies.
What you do
- Draft a clear notice
- Record the consent
- Arts. 34-36
Rely on the ANPD for adequacy, clause approval and updates, and notify it when safeguards change.
What you do
- Monitor ANPD resolutions
- Revise contracts
Evidence to keep
- Transfer map
- SCC copies
- Adequacy references
- Consent evidence
l6Chapter VI: Processing agentsController, operator, DPO and liability.3 article groups · 8 obligations
- Art. 37
Keep records of processing operations, especially where relying on legitimate interest.
What you do
- Maintain a register
- Update each quarter
- Art. 38
Prepare a data protection impact report on request by the ANPD, covering processing types, methodology, risk analysis and mitigation.
What you do
- Keep a template ready
- Document risk analysis
- Art. 39
As operator, process only in line with the controller's instructions.
What you do
- Use written instructions
- Monitor compliance
- Art. 40
Follow ANPD standards on interoperability and portability.
What you do
- Track standards
- Align systems
Evidence to keep
- Records of processing
- Processor contracts
- Instruction logs
- DPIA reports
- Art. 41
Appoint an encarregado who is the contact point for holders and the ANPD, accepts complaints, advises staff and carries out other duties, and publish their identity and contact clearly, unless the ANPD exempts you.
What you do
- Name and publish the contact
- Check any ANPD exemptions for smaller agents
Evidence to keep
- Encarregado appointment
- Published contact details
- Art. 42
Repair material, moral, individual or collective damage caused by processing in breach of the law, with joint liability for operators who ignore instructions and controllers directly involved.
What you do
- Review contractual liability
- Keep evidence of compliance
- Art. 43
Prove defences, such as not carrying out the processing, no violation, or exclusive fault of the holder or a third party.
What you do
- Retain logs
- Preserve evidence
- Art. 45
Note that violations in consumer relations are also subject to consumer law liability.
What you do
- Align consumer terms
- Review complaint handling
Evidence to keep
- Contract liability clauses
- Incident case files
l7Chapter VII: Security and good practicesSafeguards, incidents and governance.2 article groups · 6 obligations
- Art. 46
Adopt security, technical and administrative measures from design to execution to protect data from unauthorised access and accidental or unlawful events.
What you do
- Apply access control and encryption
- Test regularly
- Art. 47
Ensure everyone involved in processing, even after it ends, observes the security obligations.
What you do
- Include confidentiality in contracts
- Train staff
- Art. 48
Tell the ANPD and the holder about security incidents that may cause relevant risk or damage, describing the nature, data affected, measures taken and risks, within a reasonable time defined by ANPD (recent ANPD rules set short deadlines).
What you do
- Prepare notification templates
- Define internal escalation
- Art. 49
Structure systems so that they meet security requirements, good practice standards and the principles.
What you do
- Include in architecture reviews
- Document design choices
Evidence to keep
- Security policy
- Incident response plan
- Incident register
- ANPD and holder notification copies
- Art. 50
Formulate good practice and governance rules, including conditions of organisation, procedures, complaints, training, supervision and risk mitigation, and be ready to show them to the ANPD.
What you do
- Build a privacy programme
- Review it annually
- Art. 51
Develop interoperable formats for data access in support of portability and transparency.
What you do
- Follow ANPD guidance
- Pilot with partners
Evidence to keep
- Governance programme
- Risk assessment
- Training logs
- Policies
l8Chapter VIII: Supervision and sanctionsANPD enforcement.1 article group · 4 obligations
- Art. 52, I-II
Expect warnings with a deadline to fix, and simple fines up to 2 percent of the legal entity's revenue in Brazil, up to BRL 50 million per infraction.
What you do
- Treat deadlines seriously
- Document mitigation
- Art. 52, III-VI
Expect daily fines, publicity of the infraction after confirmation, blocking and deletion of the data to which the infraction relates.
What you do
- Prepare communications
- Be able to isolate data
- Art. 52, X-XII
Expect suspension of the database for up to six months, suspension of the processing activity for up to six months, and partial or total prohibition of processing.
What you do
- Plan business continuity
- Escalate to the board
- Art. 52 §1
Know the ANPD weighs severity, good faith, advantage obtained, financial condition, recidivism, cooperation, mitigation, adoption of good practice, compliance with corrective measures and proportionality.
What you do
- Keep evidence of each
- Self-report where advisable
Evidence to keep
- Risk register entry
- Remedial plan
- Evidence of cooperation
l9Chapters IX-X: ANPD and final provisionsThe regulator and effective dates.1 article group · 2 obligations
- Arts. 55-A to 55-L
Follow regulations and guidance of the Autoridade Nacional de Proteção de Dados, which regulates, supervises and sanctions.
What you do
- Subscribe to ANPD updates
- Adapt policies
- Art. 65
Note the law took effect in stages, with the sanction provisions applicable from 1 August 2021.
What you do
- Treat sanctions as in force
- Keep a legal register
Evidence to keep
- Regulatory watch log
Nothing matches. Clear the search or pick another chapter.
Outcomes and implementation examples are from Lei Geral de Proteção de Dados Pessoais, Lei 13.709/2018, Planalto, published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
Map data
Brazilian people.
- 2
Pick legal bases
Document each.
- 3
Name the encarregado
Publish contact.
- 4
Set up rights and incidents
Clear process.
- 5
Review transfers
Out of Brazil.
How Optimus GRC helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus GRC |
|---|---|
| Legal bases | Processing register |
| Data subject rights | Request tracker |
| Data protection officer | Role records |
| Security | Controls and incident log |
| International transfers | Transfer register |
| Sanctions | Evidence pack |
Free LGPD Brazil readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- Processing register
- Rights request form
- Incident plan
- Transfer checklist
Share or cite this page
Writing about LGPD Brazil? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/lgpd-brazil/">LGPD Brazil explained in plain English - Optimus CyberX</a>Common questions
Is it like GDPR?
Very similar in structure. Both are built around legal bases, individual rights and security duties, though the details and fines differ.
Do we need a local DPO?
Yes. The law requires a named contact for data subjects and the ANPD, called the encarregado.
Who enforces it?
The ANPD, Brazil’s national data protection authority. It can issue warnings and fines.
What are the fines?
Up to 2% of the company’s revenue in Brazil, capped at 50 million reais per violation.
Related frameworks
See how ready you are for LGPD Brazil
Answer questions across every area. We email you a report showing where you comply and where you do not.