LGPD Compliance: Brazil's Data Protection Law for IT Companies

The LGPD (Lei Geral de Proteção de Dados Pessoais) is Brazil's general data protection law. It took effect in September 2020 and closely follows the EU's GDPR, with its own differences in legal bases, deadlines and enforcement. LGPD compliance matters to any company with Brazilian users or clients, because the law applies to foreign organisations that offer goods or services to people in Brazil or process data collected there.

The national data protection authority, the ANPD, has been issuing detailed regulations, including a three business day incident reporting rule in 2024, standard contractual clauses for transfers in 2024, and a mutual adequacy arrangement with the European Union in January 2026. This guide explains the law's scope, legal bases, rights, duties, transfers, sanctions and practical steps for SaaS and IT companies.

What is the LGPD?

Law No. 13,709 of 14 August 2018 regulates the processing of personal data, including in digital media, by individuals and public or private legal entities, to protect fundamental rights of freedom and privacy. It entered into force on 18 September 2020, and its administrative sanctions became applicable on 1 August 2021. Brazil's Constitution was amended in 2022 to recognise personal data protection as a fundamental right.

Key terms mirror the GDPR: controller (controlador) decides about processing; operator (operador) processes on the controller's behalf, equivalent to a processor; encarregado is the data protection officer; data subject (titular) is the individual. Personal data is information related to an identified or identifiable natural person.

Who must comply?

Under Article 3, the LGPD applies to any processing operation, regardless of the country where the organisation is based or where the data is stored, if:

• the processing is carried out in Brazil;
• the processing aims to offer or supply goods or services to, or process data of, individuals located in Brazil; or
• the personal data was collected in Brazil.

Exclusions include purely personal, journalistic, artistic and academic purposes, public security and defence, and data merely transiting Brazil without processing there. Small processing agents, such as micro and small businesses and startups, benefit from simplified rules under ANPD Resolution CD/ANPD No. 2/2022, such as flexibility on appointing an encarregado and extended deadlines, unless they carry out high-risk processing.

Is the LGPD mandatory or voluntary?

Mandatory for anyone within its scope. There is no certification. The ANPD enforces it, and courts, consumer protection bodies and public prosecutors have also brought actions based on it.

Legal bases for processing

Article 7 lists ten legal bases for processing personal data:

1. Consent of the data subject.
2. Compliance with a legal or regulatory obligation.
3. Execution of public policies by the public administration.
4. Studies by research bodies, with anonymisation where possible.
5. Performance of a contract or preliminary procedures at the data subject's request.
6. Regular exercise of rights in judicial, administrative or arbitration proceedings.
7. Protection of life or physical safety.
8. Protection of health by health professionals or services.
9. Legitimate interests of the controller or a third party, except where fundamental rights prevail.
10. Credit protection.

Consent must be free, informed and unambiguous, for specific purposes, and can be revoked at any time. Legitimate interest requires a balancing assessment and transparency, and the ANPD has issued guidance on how to document it. Credit protection is a basis without a GDPR equivalent.

Sensitive data and children's data

Sensitive personal data covers racial or ethnic origin, religious belief, political opinion, union or religious, philosophical or political organisation membership, health or sex life, and genetic or biometric data. Article 11 allows processing only with specific and highlighted consent or under a narrower list of bases, such as legal obligation, health protection, fraud prevention and security in identification and authentication. Children's and adolescents' data must be processed in their best interests; for children, specific and highlighted consent from a parent or guardian is generally required.

Data subject rights

Article 18 gives data subjects the right to obtain from the controller:

• confirmation that processing exists and access to the data;
• correction of incomplete, inaccurate or out-of-date data;
• anonymisation, blocking or deletion of unnecessary, excessive or unlawfully processed data;
• portability to another provider;
• deletion of data processed with consent;
• information about public and private entities with which data was shared;
• information about the possibility of refusing consent and its consequences;
• revocation of consent.

Article 20 adds the right to request review of decisions taken solely on automated processing that affect the data subject's interests, including profiling, and to receive information about the criteria used. Under Article 19, a full response to an access request must be provided within 15 days of the request.

Controller and operator duties

• Principles (Article 6): purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination and accountability.
• Records of processing by controllers and operators, particularly where based on legitimate interest.
• Data protection impact report (Relatório de Impacto à Proteção de Dados Pessoais) when the ANPD requests it, especially for sensitive data and legitimate interest processing.
• Security measures, technical and administrative, to protect data from unauthorised access and incidents, from design stage to execution (privacy by design).
• Governance programs and good practice rules are encouraged and taken into account in sanctions.
• Operators must follow the controller's lawful instructions and are jointly liable for damages when they breach the law or the instructions.

The encarregado (data protection officer)

Controllers must appoint an encarregado to accept complaints from data subjects, communicate with the ANPD, guide staff and perform other assigned tasks. The identity and contact details must be publicly disclosed, preferably on the website. Resolution CD/ANPD No. 18/2024 details the role, including that the encarregado can be an employee or external person or company, must be able to communicate clearly in Portuguese with data subjects and the ANPD, and must avoid conflicts of interest. Small processing agents are generally exempt but must provide a communication channel.

Security incident reporting

Under the Security Incident Communication Regulation (Resolution CD/ANPD No. 15/2024), a controller must notify the ANPD and affected data subjects of a security incident that may cause relevant risk or damage to data subjects within three business days of becoming aware that the incident affected personal data. Relevant risk exists where the incident may significantly affect data subjects' interests and involves, for example, sensitive data, children's data, financial data, authentication data, data protected by confidentiality or large-scale data. Controllers must keep a record of all incidents, reportable or not, for at least five years. Operators must notify the controller promptly so it can meet the deadline. In practice this means vendor contracts should set a notice period of 24 to 48 hours at most.

International data transfers

Article 33 allows transfers only in specified cases, including:

• to countries or international organisations recognised by the ANPD as providing an adequate level of protection;
• using ANPD standard contractual clauses, binding corporate rules or specific contractual clauses approved by the ANPD;
• with specific and highlighted consent; and other cases such as international legal cooperation or protection of life.

Resolution CD/ANPD No. 19/2024 approved standard contractual clauses that must be incorporated without changes, with a period for organisations to update existing contracts. In January 2026, the European Commission adopted an adequacy decision for Brazil, and the ANPD issued Resolution CD/ANPD No. 32/2026 recognising the EU and EEA as adequate. Transfers between Brazil and the EU and EEA can therefore rely on adequacy instead of contractual clauses, while transfers to other countries, such as the US or India, still need clauses or another mechanism.

Sanctions

Article 52 allows the ANPD to impose warnings, simple fines of up to 2 percent of the revenue of the company or group in Brazil in its last financial year, limited to R$50 million per infraction, daily fines, publication of the infraction, blocking or deletion of the data concerned, and partial or total suspension of processing activities or databases. Resolution CD/ANPD No. 4/2023 sets out how fines are calculated. Data subjects can also seek damages in court, and collective actions are common in Brazil.

How to comply, step by step

1. Confirm scope: do you offer services to people in Brazil, or process data collected there?
2. Map processing and assign a legal basis to each purpose, documenting legitimate interest assessments.
3. Appoint an encarregado and publish contact details in Portuguese.
4. Publish a Portuguese privacy notice covering purposes, bases, sharing, transfers and rights.
5. Build rights handling with a 15-day access response.
6. Implement security measures and an incident process that meets the three business day deadline.
7. Put transfer mechanisms in place: adequacy for the EU, ANPD clauses for other destinations.
8. Sign operator contracts with Brazilian and foreign vendors.
9. Prepare impact reports for high-risk processing.

Documentation you will need

• Records of processing activities.
• Legal basis analysis and legitimate interest assessments.
• Privacy notice in Portuguese.
• Consent records.
• Data subject request log.
• Data protection impact reports.
• Incident register for five years and ANPD communications.
• Transfer clauses and operator contracts.
• Encarregado appointment.

Timeline and cost considerations

A company already compliant with the GDPR can usually adapt to the LGPD in one to three months: adding legal bases such as credit protection, Portuguese notices, an encarregado, ANPD transfer clauses and the shorter incident and access deadlines. Starting from scratch, three to six months is more realistic. Costs include legal review, translation, an encarregado service, tooling for requests and consent, and security work.

Common mistakes for SaaS and IT companies

• Assuming GDPR compliance is enough, missing the three business day incident deadline, 15-day access deadline and ANPD transfer clauses.
• No Portuguese-language notice or encarregado contact.
• Relying on consent where another basis fits better, or failing to make consent revocable.
• Using EU SCCs alone for transfers from Brazil to countries other than the EU.
• No incident register for non-reportable incidents.

Best practices, tools and technologies

• Run a single global privacy program and add an LGPD layer for Brazil-specific rules.
• Localise consent and privacy interfaces into Portuguese.
• Automate incident triage so legal can decide on notification within one business day.
• Use a data subject request portal with tracking to meet 15-day deadlines.
• Encrypt and pseudonymise data, and minimise collection.
• Structure the program with ISO/IEC 27701.

We build consent, data subject request and incident logging features into web and SaaS platforms through our web application development service.

LGPD compared with the GDPR

Topic	LGPD	GDPR
Legal bases	Ten, including credit protection and health protection	Six
Incident reporting	Three business days to ANPD and data subjects	72 hours to authority
Access response	15 days for a full response	One month
DPO	Generally required for controllers	Required in specific cases
Maximum fine	2% of Brazilian revenue, up to R$50 million per infraction	Up to 4% of worldwide turnover or EUR 20 million
Transfers	ANPD adequacy or ANPD clauses	EU adequacy or EU clauses

How the LGPD fits with other laws and frameworks

Companies serving the Americas often handle the LGPD alongside Canada's PIPEDA and US laws such as the CCPA/CPRA. The LGPD is closer to the GDPR than either: it needs a legal basis for every processing purpose, while US state laws mostly rely on notice and opt-outs. Security measures under the LGPD are principle-based, so many organisations evidence them with an ISO/IEC 27001 management system, and use the NIST Privacy Framework or ISO/IEC 27701 to organise privacy controls across countries. Brazilian consumer protection law also applies to online services and is frequently cited together with the LGPD in complaints and court cases.

Real-world example

A European e-learning SaaS, developed with an Indian engineering partner, expands to Brazil. It appoints an external encarregado, translates its privacy notice and consent flows into Portuguese, relies on adequacy for EU to Brazil data flows, adds ANPD standard clauses to its contract with the Indian partner for support access, shortens its incident escalation so the encarregado is informed within 24 hours, and adds the credit protection basis analysis for its payment checks.

Next steps

1. Confirm whether you offer services to people in Brazil.
2. Map processing and legal bases.
3. Appoint an encarregado and publish Portuguese notices.
4. Set up three business day incident reporting.
5. Review transfer mechanisms for non-EU destinations.

Frequently asked questions

Does the LGPD apply to companies outside Brazil?

Yes, if they offer goods or services to people in Brazil, process data of people located there or process data collected in Brazil.

How many legal bases does the LGPD have?

Ten, listed in Article 7, including consent, contract, legal obligation, legitimate interest and credit protection.

How quickly must incidents be reported?

Within three business days to the ANPD and affected data subjects, when the incident may cause relevant risk or damage.

Is a DPO required under the LGPD?

Controllers must generally appoint an encarregado; small processing agents have simplified rules.

What are the maximum fines?

Up to 2 percent of the company or group's revenue in Brazil, limited to R$50 million per infraction.

Can data be transferred from Brazil to the EU?

Yes. Since January 2026, the ANPD recognises the EU and EEA as adequate, and the EU recognises Brazil.

Can EU standard contractual clauses be used for transfers from Brazil?

Not on their own for other destinations; transfers need ANPD-approved clauses or another LGPD mechanism.

How fast must access requests be answered?

A full response must be provided within 15 days of the request.

Is the LGPD the same as the GDPR?

It is closely modelled on the GDPR but has different legal bases, deadlines, penalties and transfer rules.

Does the LGPD cover B2B contacts?

Yes. It covers any personal data of individuals, including employees and business contacts.

Who enforces the LGPD?

The ANPD, with courts, consumer bodies and public prosecutors also active.