General Data Protection Law (LGPD)

Brazil's General Data Protection Law, enforced by the ANPD. The EU adopted an adequacy decision for Brazil in January 2026.

Analysis

The Brazilian General Data Protection Law (LGPD) establishes several key requirements for organizations processing personal data:

Lawful Basis for Processing: Organizations must have a valid legal basis for processing personal data, such as consent, legitimate interest, or compliance with legal obligations. LGPD Article 7

Data Subject Rights: The LGPD grants individuals specific rights over their personal data, including the right to access, correct, delete, and port their data. LGPD Article 18

Data Protection Officer (DPO): Organizations must appoint a DPO to oversee data protection compliance and serve as a point of contact for data subjects and the National Data Protection Authority (ANPD). LGPD Article 41

Data Protection Impact Assessments (DPIAs): Organizations must conduct DPIAs for high-risk processing activities. ANPD Resolution CD/ANPD No. 4

Security Measures: Organizations must implement appropriate technical and organizational measures to protect personal data. LGPD Article 46

Data Breach Notification: Organizations must notify the ANPD and affected individuals of data breaches that may result in significant risk or harm. ANPD Resolution CD/ANPD No. 2

Organizations face several challenges in complying with the LGPD:

Lack of Awareness: Many organizations, especially small and medium-sized enterprises, are still unaware of their LGPD obligations. Mattos Filho Technology Report

Data Mapping and Inventory: Organizations struggle to identify and categorize all personal data they process. IAPP-EY Annual Privacy Governance Report

Implementing Data Subject Rights: Establishing efficient processes to handle data subject requests within the required timeframes is challenging. DLA Piper Data Protection Laws of the World

Cross-border Data Transfers: Ensuring compliance with LGPD requirements for international data transfers, especially given the evolving regulatory landscape. ANPD Guidelines on International Data Transfers

To implement LGPD compliance effectively:

Conduct a Data Mapping Exercise: Identify all personal data processing activities and create a data inventory. IAPP Data Mapping Toolkit

Establish a Privacy Governance Structure: Appoint a DPO and create a cross-functional privacy team. ANPD Guidelines on DPO

Implement Privacy by Design: Integrate data protection principles into all data processing activities from the outset. ANPD Guidelines on Privacy by Design

Develop a Data Breach Response Plan: Create procedures for detecting, reporting, and responding to data breaches. ANPD Data Breach Notification Guidelines

Conduct Regular Training: Educate employees on LGPD requirements and data protection best practices. IAPP Training Resources

ANPD Regulatory Agenda 2025-2026: The ANPD has published its regulatory agenda for the next two years, focusing on topics such as AI, children's data, and high-risk processing. ANPD Regulatory Agenda 2025-2026

Enhanced Enforcement: The ANPD has increased its enforcement activities, including initiating supervisory processes against non-compliant companies. ANPD Enforcement Actions

New Regulations: The ANPD has issued new regulations on international data transfers, DPOs, and legitimate interest. ANPD Regulations

EU General Data Protection Regulation (GDPR): The LGPD is heavily inspired by the GDPR and shares many similar principles. GDPR Official Text

California Consumer Privacy Act (CCPA): Another comprehensive data protection law with similarities to the LGPD. CCPA Official Text

Marco Civil da Internet: Brazil's Internet Bill of Rights, which complements the LGPD in regulating online privacy and data protection. Marco Civil da Internet Official Text

The LGPD has significant impacts across various industries:

Technology Sector: Tech companies face challenges in adapting their data-driven business models to comply with LGPD requirements. Brazilian Technology Association (ABES) Report

Healthcare: The healthcare industry must balance LGPD compliance with the need to process sensitive health data for patient care and research. Brazilian Health Informatics Association (SBIS) Guidelines

Financial Services: Banks and financial institutions must adapt their data processing practices to meet LGPD requirements while maintaining compliance with existing financial regulations. Brazilian Federation of Banks (FEBRABAN) LGPD Guide

2026-01-15 — The European Commission adopted an adequacy decision for Brazil, allowing EEA personal data to flow to Brazil without additional safeguards. (source)
2025-11-06 — The ANPD released official English translations of the LGPD and International Data Transfer Regulation on November 6, 2025, aiding global compliance and accessibility for non-Portuguese speakers. (source)

Brazilian Artificial Intelligence Act — Brazil, Proposed
UK Data Protection Act 2018 — United Kingdom, Active
Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
COPPA (Children's Online Privacy Protection Act) — United States, Active
Oregon Consumer Privacy Act (OCPA) — Oregon, Active, effective 2024-07-01
Montana Consumer Data Privacy Act (MCDPA) — Montana, Active, effective 2024-10-01
New Hampshire Privacy Act (NHPA) — New Hampshire, Active, effective 2025-01-01
Nebraska Data Privacy Act (NDPA) — Nebraska, Active, effective 2025-01-01