LGPD is Brazil's comprehensive data protection law, closely modelled on the EU's GDPR.

Does LGPD apply outside Brazil?

Yes. It applies to any organisation worldwide that processes the personal data of individuals located in Brazil.

What are the penalties under LGPD?

Up to 2% of the company's revenue in Brazil, capped at R$50 million per violation.

Is a Data Protection Officer required under LGPD?

Yes, organisations must appoint an Encarregado (equivalent to a DPO) to oversee compliance.

🇧🇷 Brazil

LGPD Compliance

Brazil's General Data Protection law

LGPD (Lei Geral de Proteção de Dados) is Brazil's GDPR-style data protection law, enforced by the ANPD. It applies to any organisation worldwide processing the personal data of individuals in Brazil, with fines up to 2% of Brazil revenue capped at R$50 million per violation.

Brazil

Territorial scope

Legal bases (Art. 7)

Max. fine (of BR revenue)

Any

Sector or size

2020

Effective since

What is LGPD?

The Lei Geral de Proteção de Dados (Law No. 13,709/2018) is
Brazil's comprehensive data protection law, built on principles of
purpose limitation, necessity, transparency, and security, and
enforced by the Autoridade Nacional de Proteção de Dados
(ANPD).

Who needs to comply with LGPD?

Any organisation, anywhere in the world, that processes the
personal data of individuals in Brazil, or that carries out processing
activities within Brazilian territory.

What are the key requirements
of LGPD?

A valid legal basis for every processing activity

Honouring data subject rights: confirmation, access, correction, deletion, and portability

Appointing a Data Protection Officer (Encarregado)

Notifying the ANPD and affected individuals of security incidents that pose relevant risk

Maintaining records of processing activities and valid international transfer mechanisms

What are the penalties for LGPD non-compliance?

Fines of up to 2% of the company's Brazil revenue, capped at R$50 million per violation, plus
daily fines and potential suspension of processing activities.

$50m

Fine per violation

2%

Of company’s revenue in Brazil

How does GDPRLocal help with LGPD?

GDPRLocal supports you with everything LGPD requires: data-flow mapping, Encarregado (DPO) appointment, ANPD-ready documentation, breach response, and full alignment of your LGPD programme with your existing global privacy framework.

Get started free