Regulations › Rest of world › Brazil
LGPD
Lei Geral de Proteção de Dados (Brazil)
WhenIn effect since 18 September 2020
Who enforces itAutoridade Nacional de Proteção de Dados (ANPD)
Who it applies toOrganizations processing personal data in Brazil or of people in Brazil.
Tell the regulatorNotify ANPD within 3 business days of learning an incident affected personal data and may caus…
DPO requiredControllers must appoint an encarregado
RegistrationNot addressed
Transfers abroadTransfers allowed via adequacy, ANPD standard clauses (mandatory since Aug 2025), ANPD-approve…
Request deadlineFull access response within 15 days of the request
Maximum fineSimple fine up to 2% of Brazil revenue for the prior year, capped at BRL 50 million per infrac…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
3
Applies regardless of location if processing occurs in Brazil, targets goods or services to people in Brazil, or data was collected in Brazil.Art. 3 · source ↗
Scored 3 because collection in Brazil alone triggers application.
Lawful basis
1
Ten legal bases including consent, legal obligation, contract, credit protection and legitimate interests.Art. 7 · source ↗
Consent
2
Consent must be free, informed and unambiguous, given in writing or by other means showing the data subject's will; controller bears proof.Art. 5(XII), Art. 8 · source ↗
Sensitive data
2
Sensitive data processed only with specific, highlighted consent or under listed exceptions.Art. 11 · source ↗
Children
3
Under 12 needs specific parental consent; all minors under 18 must be processed in their best interest.Art. 14 · source ↗
Scored 3 for best-interest regime up to 18. Law 15.211/2025 (Digital ECA) adds online child protections; not verified this session.
People's rights
Rights
3
Confirmation, access, correction, anonymization/blocking/deletion, portability, consent revocation, objection and review of automated decisions.Art. 18, Art. 20 · source ↗
Request deadline
3
Full access response within 15 days of the request; simplified confirmation immediately.Art. 19(II) · source ↗
15 days applies to access; deadlines for other rights await ANPD regulation.
Marketing
1
No specific marketing rule; requires a legal basis, and data subjects may object or revoke consent.Art. 18 para. 2, Art. 8 para. 5 · source ↗
Paragraph-level cites not separately verified.
Governance
DPO required
2
Controllers must appoint an encarregado; ANPD may exempt small processing agents.Art. 41; Res. CD/ANPD 18/2024 · source ↗
Small-agent waiver under Res. CD/ANPD 2/2022 not verified this session.
DPO qualifications
1
No certification required; organization sets qualifications by risk; must communicate in Portuguese and be publicly identified.Res. CD/ANPD 18/2024 · secondary source · source ↗
DPIA
1
ANPD may require a data protection impact report, including for sensitive data and legitimate-interest processing.Art. 38; Art. 10 para. 3 · source ↗
Mandatory on ANPD request; scored 1 as no general advance requirement.
Records
2
Controllers and processors must keep records of processing operations, especially those based on legitimate interest.Art. 37 · source ↗
Simplified regime for small agents.
Retention
2
Data must be deleted when processing ends, with listed exceptions such as legal obligations or research.Art. 15, Art. 16 · source ↗
Breaches
Tell the regulator
2
Notify ANPD within 3 business days of learning an incident affected personal data and may cause relevant risk or harm.Art. 48; Res. CD/ANPD 15/2024 · secondary source · source ↗
Incident register kept at least 5 years. Article number within Res. 15/2024 not verified.
Tell people
3
Notify affected data subjects within 3 business days when the incident may cause relevant risk or harm.Art. 48; Res. CD/ANPD 15/2024 · secondary source · source ↗
Transfers
Transfers abroad
2
Transfers allowed via adequacy, ANPD standard clauses (mandatory since Aug 2025), ANPD-approved specific clauses or BCRs, or specific consent.Art. 33; Res. CD/ANPD 19/2024 · secondary source · source ↗
Specific clauses and BCRs need prior ANPD approval.
Enforcement
Maximum fine
3
Simple fine up to 2% of Brazil revenue for the prior year, capped at BRL 50 million per infraction; daily fines also possible.Art. 52(II) · source ↗
Private action
3
Controllers and processors must compensate material or moral damage; individual and collective actions allowed.Art. 22, Art. 42 · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws