🇧🇷Brazil

Brazil's data compliance framework is built around a single comprehensive privacy law modelled on the GDPR

Brazil's data protection regime is anchored by the Lei Geral de Proteção de Dados Pessoais (LGPD), Law No. 13,709 of August 14, 2018, which became fully effective in 2020 with its administrative sanctions provisions taking effect from August 2021. The LGPD applies to any processing of personal data carried out by a natural person or a legal entity of public or private law, irrespective of the means, the country of the controller's headquarters or where the data are located, where the processing occurs in Brazil, targets individuals located in Brazil, or processes data collected in Brazil (Art. 3). The National Data Protection Authority (ANPD), created within the LGPD framework and made an autonomous government agency by Law No. 14,460/2022, is the central body for interpreting the law and applying its sanctions. ANPD regulations and resolutions sit beside the statute as a layer of binding administrative detail that directly shapes how organisations design their data practices.

The three pillars to understand first

The ten legal bases (Art. 7 and Art. 11) answer the legal question: when may an organisation process personal data? Unlike consent-default regimes, the LGPD provides ten lawful bases for processing personal data — including consent, compliance with a legal or regulatory obligation, performance of a contract, the regular exercise of rights, protection of life, legitimate interest of the controller, and protection of credit. Consent is one basis among several, not the default. Sensitive personal data — covering racial or ethnic origin, religious belief, political opinion, trade-union or organisational affiliation, health, sex life, and genetic or biometric data — is governed by a separate and narrower set of bases under Art. 11, with specific and emphatic consent required where consent is the chosen ground.

Data subject rights and controller accountability (Art. 18 and Art. 6) answer the duty question: what does the organisation owe to the individual, and how must it govern itself? The LGPD grants data subjects a full suite of rights — confirmation of processing, access, correction, anonymisation or erasure of unnecessary data, portability, information on data sharing, and revocation of consent. These sit on top of ten governing principles in Art. 6, including purpose, necessity, transparency, security, prevention, non-discrimination, and accountability. The controller must be able to demonstrate compliance, not merely assert it. Records of processing operations (Art. 37), data protection impact assessments where required by the ANPD (Art. 38), and a privacy governance programme (Art. 50) operationalise this accountability.

The data protection officer and the ANPD (Art. 41 and Chapter IX) answer the governance and enforcement question: who is accountable internally, and who supervises externally? The LGPD requires the controller to appoint a data protection officer (encarregado) to act as the communication channel between the controller, data subjects and the ANPD, with the officer's identity publicly disclosed. The ANPD is the supervisory authority with exclusive power to apply the law's administrative sanctions, which range from warnings to fines of up to two percent of Brazilian revenue capped at fifty million reais per infraction, and up to partial or full prohibition of data processing activities. Its powers prevail over the related powers of other public bodies on matters of personal data protection.

How these elements work together

A valid legal basis under Art. 7 does not on its own make processing compliant. A controller relying on legitimate interest must still satisfy the necessity and transparency requirements, process only the data strictly necessary for the stated purpose, and be prepared to produce a data protection impact assessment if the ANPD requests one. A consent mechanism that satisfies the formalities of Art. 8 but covers generic rather than specific purposes is void. Sensitive data processed under a general Art. 7 basis rather than the narrower Art. 11 regime creates direct exposure. Cross-border transfers under Chapter V require an adequacy determination, appropriate safeguards such as standard contractual clauses or binding corporate rules, or one of the enumerated exceptions — independent of whether the controller is otherwise compliant.

These obligations should not be managed in separate silos. Legal-basis mapping, consent design, data subject rights workflows, the records of processing, security implementation under Art. 46, breach notification to the ANPD and affected individuals under Art. 48, processor contracts, and transfer governance all operate across the same data lifecycle. Because the controller and processor can be jointly and severally liable for damages caused by processing (Art. 42), and because the burden of proving lawful consent rests on the controller (Art. 8(2)), any gap in one area becomes evidence of non-compliance across the whole programme.

What organisations should prioritise

Start with a complete inventory of personal data and processing activities, and map a specific legal basis to every category of processing — distinguishing clearly between ordinary personal data under Art. 7 and sensitive personal data under Art. 11. Audit every consent mechanism against the Art. 8 formality requirements, ensuring consent refers to specific purposes and that the controller can discharge its burden of proof. Appoint and publicly disclose a data protection officer. Build data subject rights workflows capable of responding within the statutory timeframe, including the fifteen-day response window for full access statements under Art. 19.

For organisations processing sensitive data, children's data, conducting cross-border transfers, or operating at scale, the preparation should go further: documented lawful basis for every category of sensitive data, verifiable parental consent for children's data under Art. 14, transfer adequacy assessments or appropriate safeguards for each destination, a maintained record of processing operations under Art. 37, a privacy governance programme under Art. 50, and an incident response procedure aligned with the Art. 48 breach notification regime. Where processing presents high risk, a data protection impact assessment should be prepared in anticipation of an ANPD request rather than after it.