Brazil’s LGPD, added to your GDPR setup.
The LGPD applies to any company offering goods or services to people in Brazil, wherever it is based. Tick Brazil in your profile: Privacyboard adds the notice, the 15-day deadline and consent first in the banner.
Free to set up · No credit card · Checked 12 November 2026
In short
- Applies to
- Companies serving or collecting data from people in Brazil
- Maximum fine
- 2% of revenue in Brazil, up to BRL 50 million per infraction
- Deadlines
- 15 days for access, 3 business days per breach
- In Privacyboard
- On every plan, Free included
What the LGPD asks, and where it lives
Pick a duty to see the screen that handles it.
What the law asks
Legal bases, purposes, sharing, transfers and rights.
In Privacyboard
A Brazil section added to your policy from your records.
Every plan
Show all 5 duties as a list
Art. 9A notice for people in BrazilEvery plan
What the law asks: Legal bases, purposes, sharing, transfers and rights.
In Privacyboard: A Brazil section added to your policy from your records.
Art. 18–19Answer access within 15 daysEvery plan
What the law asks: A full answer to an access request within 15 days.
In Privacyboard: Brazil in the request form, with its 15-day deadline. Request form on Pro.
Art. 41Name an encarregadoEvery plan
What the law asks: Publish who your data protection officer is and how to reach them.
In Privacyboard: Shown in your policy and privacy center from your profile.
Res. 15/2024Report breaches in 3 business daysEvery plan
What the law asks: Notify the ANPD and the people affected when there is relevant risk.
In Privacyboard: The breach register names the ANPD and the deadline.
CookiesConsent before trackersEvery plan
What the law asks: The LGPD relies on consent for non-essential cookies.
In Privacyboard: Visitors in Brazil are always asked first.
The numbers to know
the cap per infraction, or 2% of revenue in Brazil
for a full answer to an access request
to notify the ANPD of a breach
Small processing agents get double deadlines and may skip the encarregado, but must offer a contact channel.
What Privacyboard covers, and what it does not
Covered
- A Brazil notice in your privacy policy
- Brazil in the request form, 15-day deadline
- Your encarregado published
- The ANPD in the breach register
- Consent first for visitors in Brazil
Not covered
- Checking whether you qualify as a small processing agent
- Filing the breach notice with the ANPD for you
- Translating your policy into Portuguese
Privacyboard is a guidance tool, not legal advice.
Your first hour
- 1
Add Brazil
In Company profile, Activity.
- 2
Add your encarregado
Or your contact channel.
- 3
Validate your policy
It now has a Brazil notice.
- 4
Publish your center
Brazil appears in the form.
Go online for free. Grow when you need to.
Free puts you online. Pro adds requests, monitoring and your team; Business, security questionnaires and only your brand.
Free
$0 forever
No card, no time limit
For getting compliant and going online on your own.
Start for freeKey features:
- Privacy and cookie policies
- Vendor and processing registers
- Requests and breaches tracked
- Impact assessment screening
- AI Act screening
- Privacy center on privacyboard.io
- Cookie banner on 1 domain
- 1 person
- And 1 more on the pricing page
No card needed
ProRecommended
$20 per month
Billed $240 a year Save $48
For founders who want to be compliant in a few clicks and stay that way.
Start with ProEverything in Free, plus:
- DPA for your clients
- Vendor monitoring
- Reminders for documents and reviews
- Request form and replies
- Your own domain
- Banner on 3 domains, every choice logged
- Weekly site scan
- Complete DPIAs and TIAs
- AI assistant connector
- 2 people
- And 1 more on the pricing page
Cancel any time
Business
$109 per month
Billed $1,308 a year Save $240
For the person in charge of privacy: every detail in order, a team with roles, and proof for audits and customers.
Start with BusinessEverything in Pro, plus:
- Up to 50 people, with roles
- PDF and Excel exports
- Signed agreements on vendors
- Activity log kept 3 years
- Security questionnaires answered for you
- No Privacyboard mention
- Center in English and French
- Evidence pack in one click
- Banner on 10 domains, daily scan
- Two-step verification required
- And 3 more on the pricing page
Bank transfer on request
Questions, answered.
Does the LGPD apply to a company outside Brazil?
Yes, if it offers goods or services to people in Brazil or collects their data there (Art. 3).
Is my GDPR setup enough?
Mostly. The LGPD adds a 15-day access deadline, an encarregado and a 3-business-day breach notice.
Can we transfer data from Brazil to the EU?
Yes. Brazil and the EU adopted mutual adequacy decisions in January 2026.
Do we need an encarregado?
Usually. Small processing agents are exempt unless their processing is high risk, but must offer a channel.
Official sources
- Law 13.709/2018 (LGPD)
- ANPD Resolution 15/2024 (incidents)
- ANPD Resolution 2/2022 (small agents)
- European Commission, EU–Brazil adequacy
Checked on 12 November 2026. Laws and guidance change: read the official text before you rely on a figure.
Read more
Guides on the blog
In the documentation
