Brazil's LGPD in plain language: who it applies to and what to do

By the Privacyboard teamPublished 10 November 202610 min read

Short answer

Brazil's LGPD (Law 13,709 of 2018) applies to any business that processes personal data in Brazil, sells to people there or uses data collected there, whatever its size or location. It has ten legal bases, a 15-day deadline for full access answers, an encarregado (DPO), 3-business-day breach notices and fines up to 2% of Brazilian revenue, capped at R$50 million per infraction.

The LGPD (Lei Geral de Proteção de Dados, Law 13,709 of 2018) is Brazil's general data protection law. It looks a lot like the GDPR: it applies to almost any use of personal data, it needs a legal basis for each use, and it gives people rights to see, correct and delete their data. It reaches companies outside Brazil too, as soon as they sell to people in Brazil.

If you are a small business with customers or website visitors in Brazil, this guide explains what the law asks of you, as of 10 November 2026, with a comparison table and a checklist. It is general information, not legal advice.

#What is the LGPD and when did it start?

The LGPD was signed on 14 August 2018. Brazil's Senate reported that it came into force on 18 September 2020. The fines and other sanctions only became enforceable on 1 August 2021, as the regulator explained at the time.

The regulator is the ANPD. It started as an authority inside the federal government. Law 15,352, published on 25 February 2026, turned it into the Agência Nacional de Proteção de Dados, an independent agency linked to the Ministry of Justice, with its own budget and staff. The acronym stayed the same.

The ANPD writes the detailed rules through resolutions. Several of them matter to small businesses: one for small processing agents (2022), one for breach notices (2024) and one for international transfers (2024).

#Does the LGPD apply to my business if it is not in Brazil?

Often, yes. Article 3 says the law applies when any of these is true, "regardless of the country" where the company or the data is:

the processing happens in Brazil;
the processing aims at offering or supplying goods or services to people in Brazil, or processes data of people located there;
the personal data was collected in Brazil.

There is no size or revenue threshold. A small online shop in Lisbon that ships to São Paulo is covered for its Brazilian customers.

Article 4 leaves out a few cases: purely personal use by an individual, journalism, art and academic purposes, public security and national defence, and data that only passes through Brazil without being shared there.

#Which words does the LGPD use?

The roles match the GDPR, with different names:

Controlador (controller): the person or company that makes the decisions about the processing.
Operador (operator): the processor that handles data on the controller's behalf, such as a hosting or email provider.
Encarregado: the person named as the channel between the company, the people whose data it holds and the ANPD. In practice, the data protection officer.
Titular: the data subject, the person the data is about.
Dado pessoal sensível (sensitive personal data): racial or ethnic origin, religious belief, political opinion, union or religious, philosophical or political membership, health or sex life, genetic and biometric data (Article 5).

#What are the ten legal bases?

The GDPR has six legal bases. The LGPD lists ten in Article 7. Most map to a GDPR basis; two are specific to Brazil.

LGPD Article 7	What it covers	Closest GDPR basis
I. Consent	The person agrees	Consent
II. Legal or regulatory obligation	A law requires it, such as tax records	Legal obligation
III. Public policies	Public administration carrying out public policies	Public task
IV. Research	Studies by a research body, anonymised where possible	No direct match
V. Contract	Performing a contract or steps before one, at the person's request	Contract
VI. Exercise of rights	Using data in court, administrative or arbitration proceedings	No basis (an exception in Article 9 only for sensitive data)
VII. Protection of life	Protecting the life or physical safety of the person or someone else	Vital interests
VIII. Health protection	Procedures by health professionals or services	No basis (Article 9 exception)
IX. Legitimate interests	Interests of the controller or a third party, unless the person's rights prevail	Legitimate interests
X. Credit protection	Credit scoring and protection, under credit laws	No direct match

Sensitive data has a shorter list in Article 11, and consent there must be specific and highlighted. Legitimate interests and credit protection cannot be used for sensitive data.

#What rights do people have, and how fast must you answer?

Article 18 gives people nine rights against a controller:

confirmation that you process their data;
access to the data;
correction of incomplete, inaccurate or outdated data;
anonymisation, blocking or deletion of unnecessary, excessive or unlawful data;
portability to another provider, on express request;
deletion of data processed on the basis of consent;
information about the public and private bodies you shared the data with;
information about the option to refuse consent and what refusing means;
withdrawal of consent.

The deadline is the strictest of the large privacy laws. Under Article 19, a confirmation or access request gets a simplified answer immediately, or a complete declaration within 15 days of the request. The GDPR gives one month, and many US state laws give 45 days.

Small processing agents (see below) get twice the time for requests, under ANPD Resolution 2/2022.

#Do you need an encarregado (data protection officer)?

Article 41 says the controller must name an encarregado, and publish their identity and contact details, preferably on its website. Unlike the GDPR, the LGPD does not limit this to large-scale or risky processing.

The ANPD eased the rule for small businesses. Resolution 2/2022 defines small processing agents: micro and small companies, startups and non-profits within Brazil's revenue limits, and individuals. They do not have to appoint an encarregado, but they must offer people a channel of communication. The relief does not apply to a company that carries out high-risk processing, for example large-scale processing of sensitive or children's data, or that belongs to a group above the revenue limits.

#What happens after a data breach?

Article 48 requires the controller to tell the ANPD and the people affected about a security incident that may cause them relevant risk or damage. ANPD Resolution 15/2024 sets the deadline at three business days, unless a specific law sets another. The ANPD's own page confirms the same three-business-day deadline for the notice to individuals, in plain language and directly where possible.

That is shorter than the GDPR's 72 hours in practice, because business days skip weekends and holidays, but the clock still runs fast. Small agents get double the time for incident notices, except where the incident may affect people's physical or moral integrity or national security.

#How do international transfers work?

Article 33 allows transfers out of Brazil only on specific grounds, including:

a country the ANPD recognises as adequate;
standard contractual clauses approved by the ANPD;
global corporate rules, specific clauses approved by the ANPD, or the person's specific and highlighted consent.

ANPD Resolution 19/2024, published on 23 August 2024, approved Brazil's own standard contractual clauses and gave companies up to 12 months to put them in their contracts.

Since January 2026, transfers between Brazil and the EU are simpler. On 28 January 2026, the European Commission and the ANPD welcomed the adoption of mutual adequacy decisions, which create "a comprehensive area of free and safe personal data flows" between the two. An EU company can send personal data to Brazil without SCCs, and Brazilian companies can send data to the EU on the basis of ANPD Resolution 32/2026. Transfers to other countries still need one of the other grounds.

The LGPD has no cookie article, but the ANPD published a guide on cookies in October 2022. It says:

consent is "more appropriate" for non-essential cookies, and legitimate interests will "hardly" be the right basis for advertising cookies;
non-essential cookies should be off by default, without pre-ticked boxes;
the banner should offer a button to reject all non-necessary cookies, as visible as the accept button;
strictly necessary cookies do not need consent.

In practice, a banner that meets EU expectations also meets the ANPD's guide.

#What about children's data?

Article 14 says children's and teenagers' data must be processed in their best interest, and a child's data needs the specific consent of a parent or guardian. Since 17 March 2026, Law 15,211 of 2025, known as the ECA Digital, adds duties for digital products and services aimed at children or likely to be used by them: risk prevention, age assurance, parental tools and limits on advertising. The ANPD supervises it.

#How large are LGPD fines?

Article 52 lists the sanctions:

a warning with a deadline to fix the problem;
a fine of up to 2% of the revenue in Brazil of the company, group or conglomerate in the previous year, capped at R$50 million per infraction;
a daily fine, within the same cap;
publishing the infraction;
blocking or deleting the personal data involved;
suspending the processing or the database, and in the most serious cases prohibiting the activity.

The GDPR's ceiling is higher (€20 million or 4% of worldwide turnover), but the LGPD adds sanctions that can stop a business from using the data at all.

Topic	GDPR	LGPD, as of 10 November 2026
Reach outside the territory	Offering goods or services, or monitoring	Offering goods or services, processing data of people in Brazil, or data collected there
Size threshold	None	None (lighter rules for small agents)
Legal bases	6	10
Access request deadline	One month	Simplified answer immediately, complete one within 15 days
Data protection officer	Only in three cases	Required, except for small agents (who need a contact channel)
Breach notice	72 hours to the regulator	3 business days to the ANPD and to the people affected
Standard contractual clauses	EU SCCs	Brazil's own SCCs (Resolution 19/2024)
EU–Brazil transfers	Adequacy decision since January 2026	EU recognised as adequate since January 2026
Maximum fine	€20 million or 4% of worldwide turnover	2% of Brazilian revenue, up to R$50 million per infraction
Regulator	One per EU country	ANPD, a federal agency since 2026

#LGPD checklist for a small business

Confirm whether you sell to, or collect data from, people in Brazil.
List what you process and pick one of the ten legal bases for each use.
Update your privacy policy with the LGPD rights, the 15-day deadline and how to reach you.
Name an encarregado and publish their contact details, or, if you qualify as a small agent, publish a contact channel.
Prepare to answer access requests within 15 days, with a simplified answer straight away.
Turn non-essential cookies off by default for visitors in Brazil, with equal accept and reject buttons.
Add Brazil's three-business-day deadline to your breach plan.
Check transfers: EU-to-Brazil can rely on adequacy; other routes need Brazil's SCCs.
If your product is aimed at or likely used by children, review the ECA Digital duties.

Privacyboard lets you add Brazil to the countries you serve, which adds the LGPD rights and the 15-day deadline to your request form and privacy policy, and its cookie banner asks visitors in Brazil for consent. See countries with their own privacy law. Whether the LGPD applies to you is a legal question that a tool cannot settle.

#FAQ

#Does the LGPD apply to a company with no office in Brazil?

Yes, if it offers goods or services to people in Brazil, processes data of people located there, or uses data collected in Brazil (Article 3). Where the company is based does not matter.

#Is there a minimum company size for the LGPD?

No. The law applies to businesses of every size. Micro and small companies, startups and non-profits get lighter rules under ANPD Resolution 2/2022, such as no compulsory encarregado and double deadlines, unless their processing is high-risk.

#How long do I have to answer an LGPD access request?

A simplified answer is due immediately, and a complete declaration within 15 days of the request (Article 19). Small processing agents get twice the time.

#Do I need Brazilian standard contractual clauses to send data from the EU to Brazil?

Not for EU-to-Brazil transfers under the GDPR: the EU adopted an adequacy decision for Brazil in January 2026. Transfers out of Brazil to countries without an ANPD adequacy decision still need a ground in Article 33, usually Brazil's own SCCs.

It covers a lot, but not everything. The LGPD has its own legal bases, a 15-day access deadline, an encarregado in more cases, a three-business-day breach notice and its own contract clauses for transfers outside the EU route.

#Who enforces the LGPD?

The ANPD, now the Agência Nacional de Proteção de Dados, a federal agency since Law 15,352 of 2026. People can also go to the courts and consumer protection bodies.

#Sources

Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to hello@privacyboard.io.