LGPD: The Complete Guide
Brazil's Lei Geral de Proteção de Dados (LGPD) is Latin America's most comprehensive data protection law. Enacted in August 2018 and enforceable since September 2020, the LGPD applies to any processing of personal data carried out in Brazil, data collected in Brazil, or data used to offer goods and services to individuals in Brazil.
What the LGPD Covers
The LGPD establishes ten legal bases for processing personal data, going beyond the GDPR's six. These include consent, legitimate interest, contract performance, legal obligation, research, exercise of rights, health protection, credit protection, life protection, and public policy. Organizations must identify and document the applicable basis for each processing activity.
Data subjects (titulares) are granted extensive rights including confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing with third parties, and the ability to revoke consent. Controllers must respond to requests within a reasonable timeframe.
The law categorizes certain data as sensitive personal data — including racial or ethnic origin, religious belief, political opinion, health and sexual data, genetic and biometric data — which requires explicit consent or must fall under specific statutory exceptions.
Who Needs to Comply
The LGPD's extraterritorial scope reaches any organization that processes personal data of individuals located in Brazil, processes data collected in Brazilian territory, or offers goods and services to the Brazilian market. This broad reach means global companies with Brazilian customers or operations must comply.
Enforcement and Penalties
The Autoridade Nacional de Proteção de Dados (ANPD) is responsible for enforcement. Penalties include warnings, fines of up to 2% of revenue in Brazil (capped at 50 million reais per violation), daily fines, public disclosure of violations, data blocking, and data deletion. The ANPD has been actively issuing guidance and enforcement actions since its establishment.
Practical Compliance Steps
- Legal basis mapping — Identify and document legal bases for each processing activity
- Data subject rights — Implement intake and response mechanisms for all ten rights
- DPO appointment — Designate a Data Protection Officer and publish contact information
- Vendor management — Execute processing agreements with all operators (processors)
- Breach notification — Establish procedures for reporting incidents to the ANPD and data subjects
- Cross-border transfers — Assess international transfer mechanisms including adequacy decisions, standard clauses, or binding corporate rules
Organizations already GDPR-compliant will find significant overlap, but must address LGPD-specific requirements such as additional legal bases and the distinct enforcement structure.