🇧🇷General Personal Data Protection Law
A law built around ten legal bases, not consent alone
The Lei Geral de Proteção de Dados Pessoais — Law No. 13,709 of August 14, 2018, universally known as the LGPD — is Brazil's comprehensive data protection statute. It was modelled closely on the European GDPR, took full effect in 2020, and had its administrative sanctions regime activated from August 2021. Understanding what it borrows from the GDPR, and where it quietly diverges, matters more than knowing its enactment date.
The LGPD is built around a structured idea: processing personal data is lawful only when it rests on one of ten enumerated legal bases. Consent is one of them — but it is not the default, and treating it as the only route is the most common source of both over-collection of consent and unlawful processing. The law gives organisations genuine alternatives: legal obligation, contract performance, the regular exercise of rights, protection of life, legitimate interest, and the protection of credit, among others. The discipline is in choosing the right basis for each activity and being able to prove it. That structure is the law's greatest strength and its most common point of compliance failure — because organisations accustomed to consent-default regimes often paper everything with consent, while organisations accustomed to lighter frameworks assume legitimate interest is broader than the LGPD permits.
Who the law covers — and who it doesn't
The LGPD applies to any processing operation carried out by a natural person or a legal entity of public or private law, irrespective of the means, the country where the controller is headquartered, or the country where the data are located, provided that the processing is carried out in the national territory, is aimed at offering goods or services to or processing data of individuals located in Brazil, or concerns personal data collected in Brazil (Art. 3). There is no revenue threshold and no small-business exemption from the core obligations — although the ANPD is empowered to set simplified rules for microenterprises, small businesses and startups (Art. 55-J, XVIII).
The law does not apply to processing carried out by a natural person purely for private and non-economic purposes, processing exclusively for journalistic, artistic or academic purposes, or processing exclusively for public security, national defence, State security, or criminal investigation and prosecution — the last category being reserved for specific legislation (Art. 4). These exclusions are narrow and purpose-bound. The journalistic and academic exclusions are tied to exclusive purpose; mixing those purposes with commercial processing does not carry the exclusion across.
The LGPD draws a clear role distinction. The controller is the natural person or legal entity that makes the decisions regarding processing — this is the accountable party. The processor processes personal data on the controller's behalf and must follow the controller's instructions (Art. 5, VI–VII; Art. 39). The data subject is the natural person to whom the data refers. This distinction carries real liability weight: under Art. 42, where the processor fails to comply with its obligations or acts contrary to the controller's lawful instructions, it is treated as a controller and the two can be jointly and severally liable for damages. That liability is not contracted away.
The legal bases — and the separate, stricter regime for sensitive data
Article 7 sets out the ten legal bases for processing ordinary personal data: consent; compliance with a legal or regulatory obligation; processing by the public administration for public policies; studies by research bodies; performance of a contract or preliminary procedures at the data subject's request; the regular exercise of rights in judicial, administrative or arbitration proceedings; protection of life or physical integrity; protection of health by health professionals or services; the legitimate interest of the controller or a third party; and the protection of credit. Where legitimate interest is relied upon, only the data strictly necessary for the purpose may be processed, the controller must adopt transparency measures, and the ANPD may require a data protection impact assessment (Art. 10).
Sensitive personal data is governed separately and more strictly under Art. 11. Sensitive data covers racial or ethnic origin, religious belief, political opinion, affiliation to a trade union or to a religious, philosophical or political organisation, data concerning health or sex life, and genetic or biometric data when related to a natural person (Art. 5, II). It may be processed only with the data subject's specific and emphatic consent for specific purposes, or — without consent — in a narrower list of indispensable situations, including legal obligation, public policy, research, the regular exercise of rights, protection of life, health protection by professionals, and fraud prevention and authentication. Processing sensitive data under an ordinary Art. 7 basis rather than the Art. 11 regime is a direct compliance failure.
The consent requirement — and what it actually demands
Where consent is the chosen basis, Art. 8 sets the standard: consent must be given in writing or by another means that demonstrates the data subject's intention, and where given in writing it must stand out from other contractual clauses. Consent must refer to specific purposes — generic authorisations are void (Art. 8(4)). It may be revoked at any time through a free and facilitated procedure (Art. 8(5)). Crucially, the controller bears the burden of proving that consent was obtained in compliance with the law (Art. 8(2)). Consent is also void where the information given to the data subject was misleading, abusive, or not presented transparently (Art. 9(1)).
Before relying on consent — and indeed for transparency generally — the data subject is entitled to facilitated access to clear information on the specific purpose of processing, the form and duration, the controller's identity and contact details, information on shared use of data, the responsibilities of processing agents, and the data subject's rights under Art. 18 (Art. 9). Where processing is a condition for providing a product, service or right, the data subject must be emphatically informed of that fact (Art. 9(3)).
Children's and adolescents' data — best interest, verifiable consent
Processing of children's and adolescents' personal data must be carried out in their best interest (Art. 14). For children specifically, processing requires specific and distinguishable consent from at least one parent or legal representative, and the controller must make reasonable efforts — considering available technology — to verify that consent was genuinely given by the representative (Art. 14(1), Art. 14(5)). Controllers must not condition a child's participation in games, internet applications or other activities on the provision of personal information beyond what is strictly necessary (Art. 14(4)), and information about the processing must be presented in a simple, clear and accessible manner appropriate to the child's understanding (Art. 14(6)). Limited collection without parental consent is permitted only to contact a parent, used once and not stored, or for the child's protection (Art. 14(3)).
Data subject rights — a full suite, exercised on request
Article 18 grants the data subject the right to obtain from the controller, at any time and upon request: confirmation of the existence of processing; access to the data; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or erasure of unnecessary, excessive or non-compliant data; portability to another provider; erasure of data processed with consent; information on the public and private entities with which the controller has shared data; information on the possibility of denying consent and its consequences; and revocation of consent. Confirmation of existence or access must be provided immediately in simplified form, or within fifteen days by means of a clear and complete statement (Art. 19). The data subject also has the right to request review of decisions made solely on the basis of automated processing that affect their interests (Art. 20), and the right to petition the ANPD against the controller (Art. 18(1)).
A consumer fintech operating in Brazil built its onboarding flow around a single broad consent checkbox covering "processing of your data for our services." It relied on that consent for everything: identity verification, credit assessment, fraud screening, and marketing. When a data subject revoked consent and demanded erasure of all their data under Art. 18, the company discovered the structural flaw in its design. Several of its processing activities — credit protection under Art. 7(X), fraud prevention touching authentication under Art. 11, and retention required by financial regulation under Art. 16(I) — did not depend on consent at all and could not lawfully be switched off by its revocation. But because the company had presented every activity as consent-based, it could not cleanly separate what survived revocation from what did not, and its generic consent was independently vulnerable to being declared void under Art. 8(4) for failing to refer to specific purposes. The controller bore the burden under Art. 8(2) of proving valid consent it had never properly structured. The fix was not more consent — it was mapping each activity to its correct Art. 7 or Art. 11 basis and reserving consent for the activities that genuinely required it.
Records, impact assessments and governance — demonstrable accountability
The LGPD operationalises its accountability principle (Art. 6, X) through concrete obligations. Controllers and processors must maintain records of the processing operations they perform, especially where based on legitimate interest (Art. 37). The ANPD may require the controller to prepare a data protection impact assessment describing the processing operations that could pose risks to civil liberties and fundamental rights, together with the safeguards and risk-mitigation measures adopted (Art. 38, Art. 5, XVII). Controllers and processors may — and, where they handle higher-risk or larger-scale processing, in practice should — implement a privacy governance programme that demonstrates commitment to compliance, applies across all data under their control, is adapted to the scale and sensitivity of operations, includes incident response and remediation plans, and is kept continuously updated (Art. 50).
The data protection officer — a named, public point of accountability
The controller must appoint a data protection officer (encarregado) to act as the communication channel between the controller, data subjects and the ANPD (Art. 41, Art. 5, VIII). The officer's identity and contact details must be publicly, clearly and objectively disclosed, preferably on the controller's website (Art. 41(1)). The officer's duties include receiving complaints and communications from data subjects and from the ANPD and adopting measures, and instructing the entity's staff on data protection practices (Art. 41(2)). The ANPD may set supplementary rules on the officer's role, including cases where appointment may be waived according to the nature and size of the entity or the volume of processing (Art. 41(3)).
Security and breach notification — risk-based and time-sensitive
Processing agents must adopt technical and administrative security measures to protect personal data from unauthorised access and from accidental or unlawful destruction, loss, alteration, communication or any improper processing (Art. 46). These measures must be applied from the design phase of a product or service through to implementation (Art. 46(2)) — the LGPD's expression of privacy by design. Where a security incident may result in relevant risk or damage to data subjects, the controller must notify the ANPD and the affected data subjects (Art. 48). The communication must be made within a reasonable time as defined by the ANPD and must describe the nature of the affected data, the data subjects involved, the technical and security measures used, the risks, the reasons for any delay, and the measures taken to reverse or mitigate the damage (Art. 48(1)). The ANPD assesses severity and may order wide disclosure of the incident and mitigation measures (Art. 48(2)).
International transfers — adequacy, safeguards, or a narrow exception
Chapter V governs the international transfer of personal data. Transfers are permitted only where the destination country or international organisation provides an adequate level of protection consistent with the LGPD; where the controller offers and demonstrates appropriate safeguards in the form of specific contractual clauses, standard contractual clauses, binding corporate rules, or regularly issued seals, certificates and codes of conduct; or under one of the enumerated exceptions including international legal cooperation, protection of life, ANPD authorisation, international agreement commitments, public policy enforcement, or the data subject's specific and distinguishable consent given with prior information on the international nature of the operation (Art. 33). The ANPD assesses the adequacy of a destination's protection (Art. 34) and defines the content of standard contractual clauses and verifies the other safeguard mechanisms (Art. 35). A GDPR-aligned transfer programme is a strong starting point, but the operative instruments must satisfy ANPD requirements, not only EU ones.
Enforcement — the ANPD and a graduated sanctions regime
The ANPD is the central body for interpreting the LGPD and has exclusive power to apply its administrative sanctions, prevailing over the related powers of other public bodies on matters of personal data protection (Art. 55-J, Art. 55-K). The sanctions in Art. 52 are graduated: a warning with a deadline for corrective measures; a simple fine of up to two percent of the entity's, group's or conglomerate's Brazilian revenue in the preceding fiscal year, excluding taxes, capped at fifty million reais per infraction; a daily fine subject to the same cap; public disclosure of the infraction; blocking or erasure of the data to which the infraction relates; partial suspension of database operations or of the processing activity for up to six months, extendable; and partial or total prohibition of data-processing activities. The more severe sanctions — suspension and prohibition — may be applied only after at least one of the lesser sanctions has already been imposed for the same case (Art. 52(6)). Sanctions are applied following an administrative proceeding with a full defence, weighing factors such as the severity of the infraction, the offender's good faith, recidivism, the extent of damage, cooperation, and the adoption of a good-practices and governance policy (Art. 52(1)). These administrative sanctions do not displace civil or criminal liability under other legislation (Art. 52(2)).
Article 3 — Territorial scope: applies to processing carried out in Brazil, aimed at individuals in Brazil, or of data collected in Brazil, regardless of the controller's location.
Article 6 — Principles: ten governing principles including purpose, necessity, transparency, security, prevention, non-discrimination, and accountability.
Article 7 — Legal bases: ten lawful bases for processing ordinary personal data; consent is one basis among several, not the default.
Article 8 — Consent: must be specific and provable; generic authorisations are void; the controller bears the burden of proof; revocable at any time.
Article 11 — Sensitive data: a separate, stricter regime requiring specific and emphatic consent or a narrow indispensable-situation basis.
Article 14 — Children and adolescents: processing in their best interest; verifiable parental consent for children; no conditioning beyond what is strictly necessary.
Article 18 — Data subject rights: confirmation, access, correction, anonymisation/blocking/erasure, portability, information on sharing, and revocation of consent.
Articles 37, 38 and 50 — Accountability: records of processing, ANPD-requested impact assessments, and the privacy governance programme.
Article 41 — Data protection officer: mandatory appointment and public disclosure of the encarregado as the channel to data subjects and the ANPD.
Articles 46 and 48 — Security and breach: privacy-by-design security measures; notification to the ANPD and data subjects where an incident poses relevant risk.
Articles 33–35 — International transfer: adequacy, appropriate safeguards, or a narrow exception; the ANPD assesses adequacy and verifies safeguards.
Article 52 — Sanctions: graduated administrative penalties up to 2% of Brazilian revenue capped at R$50m per infraction, and up to prohibition of processing.
The LGPD is not a consent-collection exercise. It is a legal-basis accountability framework with a supervisory authority that can fine, suspend and ultimately prohibit your processing. Your checklists tell you what to do. This law tells you why: because every processing activity needs a specific legal basis you can defend, sensitive and children's data carry stricter regimes, consent must be provable and purpose-specific, a named data protection officer must be public, and a security incident that poses relevant risk obliges you to notify the ANPD and the people affected. With joint and several liability between controller and processor, and the burden of proving lawful consent resting on you, the organisations that treat the LGPD as a genuine accountability question — not a GDPR-adjacent tickbox — are the ones that will be ready when the ANPD asks for an impact assessment or a data subject petitions for erasure.