General Data Protection Law (LGPD)

· About General Data Protection Law (LGPD)

Key Takeaways

  • Brazil’s General Data Protection Law (LGPD) applies to personal data processing in Brazil and to offshore controllers or processors when the activity targets individuals in Brazil, uses data collected in Brazil, or the data was collected in Brazil. The law is enforced by the ANPD.[]
  • The LGPD’s main sanctions regime is in force and can include warnings, publicizing the violation, blocking or deletion of personal data, and fines of up to 2% of the company’s revenue in Brazil, capped at BRL 50 million per infraction.[]
  • International transfers from Brazil to the EU now have a specific adequacy pathway after ANPD Resolution CD/ANPD No. 32/2026 recognized the EU as adequate for LGPD purposes on 26 January 2026.[]
  • The adequacy decision does not cover transfers made exclusively for public security, national defense, state security, or criminal investigation and prosecution, so those transfers still require a separate legal basis and analysis.[]
  • Controllers must maintain a lawful basis, transparency, security, and governance controls, including a DPO contact channel and breach response procedures, because ANPD can investigate and sanction noncompliance under the LGPD.[]
  • Where organizations operate under mature security and privacy programs, LGPD controls map cleanly to ISO 27001, NIST CSF 2.0, and ISO/IEC 42001, especially for risk management, access control, incident response, and AI governance.[]

What It Is

The Lei Geral de Proteção de Dados Pessoais (LGPD) is Brazil’s federal personal data protection law, Law No. 13.709/2018, which sets rules for processing personal data, sensitive personal data, children’s data, data subject rights, security, and international transfers.[] The law is enforced by the Autoridade Nacional de Proteção de Dados (ANPD), Brazil’s national data protection authority, which issues regulations, supervises compliance, and applies administrative sanctions.[] The LGPD was adopted on 14 August 2018, most provisions entered into force on 18 September 2020, and the administrative sanctions chapter became enforceable on 1 August 2021.[] ANPD’s regulatory program for 2025–2026 confirms ongoing rulemaking and prioritization, but no 2025–2026 amendment has replaced the core LGPD framework itself as of 6 September 2026.[] A major 2026 development is the mutual adequacy framework for Brazil and the EU: ANPD’s Resolution CD/ANPD No. 32/2026 was published on 26 January 2026, making the EU an adequate destination for LGPD international transfer purposes.[]

Who Must Comply

The LGPD applies to any processing operation carried out by a natural person or legal entity, public or private, where the processing is performed in Brazil, the purpose is to offer or supply goods or services to people in Brazil, or the personal data was collected in Brazil.[] This reach is extraterritorial: companies outside Brazil can be in scope if they target the Brazilian market or collect Brazilian personal data, even if they lack a local establishment.[] The law also applies to processors acting on behalf of controllers, not only to controllers deciding the purposes and means of processing.[] The LGPD contains limited exemptions for processing by a natural person for purely private and non-economic purposes, journalistic and artistic activities, academic research under specified conditions, public safety and national security activities, and criminal investigation and prosecution activities.[] For international transfers, the EU adequacy decision now covers transfers between Brazil and EU Member States, EEA EFTA states that are part of the EEA, and EU institutions, bodies, and agencies, but it does not apply to the public-security and criminal-justice carve-outs.[] Public bodies remain subject to the LGPD, but some processing by public authorities is governed by special public-law rules and sectoral legislation, so the applicability analysis must be done carefully for each activity.[]

Core Requirements

  1. Lawful basis and purpose limitation — Processing must be grounded in one of the LGPD’s legal bases, tied to a legitimate, specific purpose, and limited to what is necessary for that purpose.[]
  2. Transparency and notice — Controllers must provide clear information about processing activities, data sharing, rights, and contact details for the responsible point of contact, especially for data subject requests and complaints.[]
  3. Data subject rights handling — Controllers must support rights such as confirmation of processing, access, correction, anonymization, blocking, deletion, portability where regulated, information about sharing, and review of automated decisions where applicable.[]
  4. Security and incident response — Controllers and processors must adopt technical and administrative security measures and have a breach handling process proportionate to the risks presented by the processing.[]
  5. Governance and accountability — Organizations should maintain records, internal policies, role assignment, vendor oversight, and a privacy governance structure that can demonstrate compliance if ANPD investigates.[]
  6. International transfer controls — Cross-border transfers require an LGPD mechanism, such as adequacy, contractual clauses, corporate rules, consent in limited cases, or other bases recognized by the LGPD and ANPD.[]
  7. Special-category safeguards — Sensitive personal data and children’s data require heightened legal justification and additional safeguards, with stricter restrictions on use and sharing.[]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | LGPD adopted | 14 August 2018 | Law No. 13.709/2018 was enacted. | | Main provisions in force | 18 September 2020 | Core LGPD obligations became applicable. | | Sanctions chapter enforceable | 1 August 2021 | ANPD administrative penalties began to apply. | | EU adequacy resolution | 26 January 2026 | ANPD Resolution CD/ANPD No. 32/2026 recognized the EU as adequate for LGPD transfer purposes. |

The maximum administrative fine under the LGPD is 2% of the company’s revenue in Brazil in its last fiscal year, capped at BRL 50 million per infraction.[] ANPD may also impose a daily fine subject to the same overall legal framework, along with warnings, public disclosure of the violation, blocking or deletion of personal data, and partial suspension of processing activities.[] For serious or repeated violations, the combined effect of blocking, deletion, and suspension can be more disruptive than the monetary fine, especially where the processing is core to the business model.[] Civil, consumer, labor, and sectoral enforcement risks can apply in parallel, so the LGPD penalty is often only one layer of exposure.[]

How to Comply

  1. Map processing and classify data — Build a complete data inventory, identify controller/processor roles, map transfers, and tag sensitive and children’s data. This is the foundation for ISO 27001 Annex A controls and NIST CSF 2.0 Identify.[]
  2. Document lawful bases and notices — For each processing purpose, record the legal basis, retention period, sharing, and cross-border transfer mechanism, then align privacy notices to those records.[]
  3. Implement rights-management workflows — Set service levels, identity verification, decision trees, and ticketing for access, deletion, correction, and objection requests so requests are trackable and auditable.[]
  4. Strengthen security controls — Apply access control, encryption where appropriate, logging, vendor security reviews, and incident response playbooks. These controls align well with ISO 27001 and NIST CSF 2.0 Protect and Respond.[]
  5. Build vendor and transfer governance — Re-paper contracts with processors, assess onward transfers, and use adequacy or other Article 33 mechanisms for international data transfers. For AI systems, incorporate ISO/IEC 42001 governance where models ingest personal data.[]
  6. Assign accountability and training — Designate the responsible privacy contact, train staff on data handling, and maintain evidence of periodic reviews, audits, and corrective actions.[]
  7. Test breach and escalation procedures — Run tabletop exercises for security incidents and privacy complaints, including ANPD notification decision-making and evidence preservation.[]

Related Regulations

Brazil’s Marco Civil da Internet overlaps with the LGPD on online services, logs, and user rights, but the LGPD is the main general privacy statute for personal data processing.[] Brazil’s consumer protection law can add disclosure, fairness, and service-quality obligations where personal data use affects consumers, creating parallel enforcement risk.[] The EU GDPR is the closest comparator and matters directly for companies operating in both regimes, especially now that Brazil and the EU have mutual adequacy decisions for transfers.[] Brazil’s sector-specific telecom, finance, health, and labor rules can impose stricter retention, secrecy, or notification duties, and those rules may control over the LGPD on specific points.[] Brazil’s AI governance developments do not replace the LGPD; where AI uses personal data, LGPD obligations still apply alongside model-risk and governance controls.[]

FAQ

Does the LGPD apply to companies outside Brazil?

Yes, if the company offers goods or services to people in Brazil or processes personal data collected in Brazil.[] The test is functional, not formal: absence of a Brazilian subsidiary does not remove LGPD exposure. Cross-border SaaS, e-commerce, adtech, and cloud vendors are common examples.

Does the EU adequacy decision mean transfers to Europe are unrestricted?

Not completely. The adequacy decision means Brazil-to-EU transfers can rely on adequacy under LGPD Article 33, but the transfer still has to fit the LGPD’s broader requirements and the decision’s scope.[] It does not apply to transfers exclusively for public security, national defense, state security, or criminal investigation and prosecution activities.[]

What is the maximum LGPD fine?

The LGPD maximum administrative fine is 2% of the company’s revenue in Brazil, capped at BRL 50 million per infraction.[] ANPD can also impose non-monetary sanctions such as public disclosure, blocking, deletion, or suspension of processing, which may be more operationally damaging than the fine itself.[]

Does the LGPD require a DPO?

Yes, controllers must appoint a person responsible for processing, commonly called the encarregado, although ANPD rules allow flexibility in how that function is structured for certain entities.[] The practical expectation is that organizations maintain a clear privacy contact point for data subjects and ANPD communications, whether internally staffed or outsourced.

Are there 2025–2026 LGPD amendments that change the core law?

As of 6 September 2026, the major change is regulatory and international-transfer related, not a wholesale rewrite of the LGPD.[] ANPD’s 2025–2026 agenda shows continued rulemaking, and the 2026 EU adequacy decision materially changed transfer practice, but the underlying statute remains Law No. 13.709/2018.[]

Sources

Put it into practice

More compliance guides