Brazil Privacy Law (LGPD): Legal Bases, Rights, and Penalties

Brazil’s LGPD privacy law (Lei Geral de Proteção de Dados, Law No. 13,709/2018) governs how any organization collects, stores, uses, and shares personal data tied to people in Brazil, gives those people nine enforceable rights over their data, and backs the whole framework with fines that reach roughly $10 million USD per violation. It applies whether your company is in São Paulo, Stuttgart, or Seattle. If the data touches Brazil, the law reaches you.

Who Has to Comply

The LGPD applies to any natural person or organization that processes personal data, regardless of where the organization is based or where its servers sit. Three triggers pull a foreign company in: offering goods or services to people in Brazil, processing data collected from individuals located in the country, or carrying out any processing activity on Brazilian soil.

A few activities sit outside the law. Processing by a natural person for purely personal, non-commercial purposes is exempt. So is processing done exclusively for journalistic, artistic, or academic purposes, along with national defense, public security, and criminal investigations. Data that originates entirely outside Brazil and merely passes through without being shared with Brazilian processors or transferred to a third country is also exempt.1LGPD Brazil. LGPD English Version

Personal Data and Sensitive Personal Data

Personal data means any information tied to an identified or identifiable person: names, email addresses, IP addresses, phone numbers, and similar identifiers. Sensitive personal data is a separate, tighter category covering racial or ethnic origin, religious beliefs, political opinions, union membership, health, sex life, and genetic or biometric information. Processing sensitive data triggers stricter consent standards and stronger security expectations.

Anonymized data generally falls outside the law, but only if the anonymization cannot reasonably be reversed. If it can, the data is still personal data and the full LGPD applies. Pseudonymized data (identifiers replaced with codes that a key can undo) gets no special relaxation and is treated like any other personal data.

The Ten Legal Bases for Processing

Every act of processing personal data in Brazil needs one of ten legal justifications set out in Article 7. An organization that cannot point to at least one is processing unlawfully.2LGPD Brazil. Personal Data of Children and Adolescents The ten are:

  • Consent from the data subject, which the organization must be able to prove if challenged.
  • Compliance with a legal or regulatory obligation, such as tax filings or employment records.
  • Execution of public policy by government bodies.
  • Research by research entities, with anonymization where possible.
  • Performance of a contract the data subject is party to, or preparatory steps at their request.
  • Exercise of legal rights in judicial, administrative, or arbitration proceedings.
  • Protection of the life or physical safety of the data subject or a third party.
  • Health protection, by health professionals or sanitary authorities.
  • Fraud prevention and safety of the data subject.
  • Legitimate interests of the controller or a third party, provided those interests do not override the data subject’s fundamental rights.

Credit protection sits alongside these as a separate standalone basis, reflecting how central credit scoring is in Brazil’s economy.1LGPD Brazil. LGPD English Version

Legitimate interests is the most flexible basis and the most contested. Using it requires a balancing test between the organization’s business needs and the individual’s privacy expectations and fundamental rights. Marketing, internal analytics, and fraud detection often rely on this basis, and the ANPD can demand a Data Protection Impact Assessment to check that the balance was struck fairly.

Children’s Data

Processing a child’s data must be in the child’s best interest and requires specific, highlighted consent from at least one parent or legal guardian. Controllers must make reasonable technological efforts to verify that the consent actually came from a parent rather than the child.2LGPD Brazil. Personal Data of Children and Adolescents

Two narrow exceptions let an organization process a child’s data without parental consent: when the sole purpose is contacting the parent or guardian, or when necessary to protect the child. Even then, the data can only be used once, without storage, and sharing it with any third party still requires parental consent. Privacy notices aimed at children must use simple, clear language a child can understand.2LGPD Brazil. Personal Data of Children and Adolescents

Nine Rights of Data Subjects

Article 18 gives individuals nine rights they can invoke at any time against any organization holding their data:3LGPD Brazil. Article 18 – Personal Data Subjects Rights in Relation to the Controller

  • Confirmation that processing is happening at all.
  • Access to the data itself.
  • Correction of incomplete, inaccurate, or outdated records.
  • Anonymization, blocking, or deletion of data that is unnecessary, excessive, or unlawfully processed.
  • Portability of data to another service provider, subject to trade secret protections.
  • Deletion of data that was processed on the basis of consent.
  • Information about which public and private entities received the data.
  • Information about the consequences of refusing to give consent.
  • Revocation of consent through a free, simple process.

Withdrawing consent does not invalidate processing that already occurred while consent was active. Once revoked, however, the organization must stop processing unless it can point to a separate legal basis. This is where many companies stumble: they never mapped which data relies solely on consent versus another basis like contract performance, so they cannot tell what to stop.

Appointing a Data Protection Officer

Organizations processing personal data must appoint a Data Protection Officer, called an Encarregado. The DPO is the point of contact between the organization, data subjects, and the ANPD. The law does not fix specific qualifications, but the person is expected to understand data protection law and the organization’s processing well enough to do the job meaningfully.

The DPO’s identity and contact information must be public, usually on the organization’s website or privacy notice. The role can be outsourced to a consultancy, and the DPO does not need to be physically in Brazil as long as they remain accessible to the ANPD and to data subjects. Small businesses in the ANPD’s simplified track do not need to appoint a DPO but still have to maintain a channel for data subject requests.

Breach Notification Within Three Business Days

When a security incident compromises personal data, the controller must notify both the ANPD and affected individuals. The ANPD’s Resolution No. 15 of 2024 set the deadline at three business days from the moment the controller confirms that personal data was affected. The same three-day window applies to notifying the affected individuals.4CD/ANPD. Resolution No. 15 of April 24, 2024

Not every breach requires notice. The obligation kicks in when the incident is likely to cause material risk or damage. The ANPD looks at whether the breach involves sensitive data, data about children or the elderly, financial data, authentication credentials, or legally privileged information, combined with whether it could stop someone from exercising rights or using a service, or lead to financial fraud, identity theft, or reputational harm.4CD/ANPD. Resolution No. 15 of April 24, 2024

The notification must describe the data affected, the individuals involved, the risks the incident creates, the reasons for any delay, and the steps taken or planned to contain and mitigate the damage. Small business agents in the simplified track get double the standard time: six business days to notify the ANPD and the individuals.4CD/ANPD. Resolution No. 15 of April 24, 2024

Data Protection Impact Assessments

The ANPD can require any controller to prepare a Data Protection Impact Assessment, known in Portuguese as a Relatório de Impacto à Proteção de Dados Pessoais (RIPD). It must describe the types of data collected, the collection methodology, security measures, and the controller’s analysis of safeguards and risk mitigation.5LGPD Brazil. Article 38 – DPIA or Data Protection Impact Report

Under the LGPD the RIPD is something the ANPD can demand rather than something organizations must produce on their own initiative. Keeping one ready for processing that involves sensitive data, large-scale profiling, or cross-border transfers is a practical safeguard. If the ANPD asks, having one already prepared signals good faith and shapes how the authority responds.

Sending Data Outside Brazil

Article 33 lets personal data leave Brazil only through specific pathways:6LGPD Brazil. Article 33 – Cases of Permission for the International Transfer of Personal Data

  • An adequacy decision from the ANPD finding that the destination country offers adequate protection. As of mid-2025 the ANPD has not issued any adequacy decisions.
  • Contractual safeguards, including ANPD-approved standard contractual clauses, specific clauses, or binding corporate rules for multinational groups.
  • Specific, prominent consent from the data subject after being told the transfer is international.
  • Direct ANPD authorization.
  • International legal cooperation between law enforcement or intelligence bodies.
  • Protection of the life or physical safety of the data subject or a third party.
  • Execution of public policy by a government entity.

The ANPD finalized its international transfer rules in Resolution CD/ANPD No. 19/2024, requiring the use of ANPD-approved standard contractual clauses. Companies had until August 2025 to adopt them.7International Trade Administration. Brazils New Rules on International Data Transfers With no adequacy decisions in place, most organizations rely on contractual mechanisms or specific consent to move data across borders.

Simplified Track for Small Businesses

ANPD Resolution No. 2 created a lighter compliance track for microenterprises (annual revenue up to R$360,000), small businesses (up to R$4.8 million), startups, nonprofits, and individual data processors. Qualifying organizations:

  • Do not need to appoint a DPO, but must still keep a channel open for data subject requests.
  • Can use a simplified record-of-processing model provided by the ANPD.
  • Can adopt a basic information security policy scaled to their processing.
  • Get double the standard deadlines to respond to data subject requests and ANPD inquiries, including the six-day breach notification window.

These flexibilities disappear when the organization engages in high-risk processing. High risk means meeting at least one general criterion (like large-scale processing) plus one specific criterion, such as using emerging technologies, surveillance of public areas, decisions based solely on automated processing, or handling sensitive data of vulnerable groups. A small fintech profiling users for automated lending decisions would lose its simplified status despite its size.

Penalties and How the ANPD Enforces

The Autoridade Nacional de Proteção de Dados (ANPD) investigates complaints, conducts audits, and issues the regulations that fill in the statute’s gaps. Article 52 sets a graduated scale of sanctions the ANPD works up from the lightest measures:8LGPD Brazil. Article 52 – Administrative Sanctions by the National Authority

  • Warning with a deadline for corrective action.
  • Simple fine of up to 2% of the organization’s revenue in Brazil for the prior fiscal year (excluding taxes), capped at R$50 million (roughly $10 million USD) per infraction.
  • Daily fine for ongoing noncompliance, subject to the same R$50 million cap.
  • Public disclosure of the violation.
  • Blocking of the personal data involved until the issue is resolved.
  • Permanent deletion of the affected data.
  • Partial suspension of the relevant database for up to six months, renewable for another six.
  • Suspension of the specific processing activity for up to six months, renewable.
  • Partial or total prohibition of data processing activities.

The three most severe sanctions (database suspension, processing suspension, and total prohibition) can only be imposed after the ANPD has already applied at least one lesser penalty in the same case.8LGPD Brazil. Article 52 – Administrative Sanctions by the National Authority The 2% cap applies only to revenue generated in Brazil, so a multinational’s exposure scales with its Brazilian operations rather than its worldwide business. For a company that depends on Brazilian customer data, though, a processing ban can cost far more than any fine.

When calculating fines, the ANPD weighs the severity of the breach, the organization’s cooperation with the investigation, whether it adopted good-faith security measures, and whether it promptly remediated the harm. Organizations that self-report, cooperate with audits, and show genuine compliance efforts consistently fare better than those that stonewall.