gov.br
Referenced sections
- Official current-status register for ANPD resolutions, including Resolution 32/2026 recognising the European Union as adequate for international data transfers.
By Sorena AIPublished Updated
LATAM Brazil LGPD
Brazil LGPD
Brazil hub for scope, legal bases, rights, roles, security incidents, international transfers, children, accountability records, and enforcement.
- LGPD law
- Rights core
- Incident rule
- Fine cap
Understand Brazil LGPD
Brazil's Lei Geral de Proteção de Dados Pessoais (), Law 13.709/2018, can apply to an organisation outside Brazil. Article 3 looks at each processing operation: whether it occurs in Brazil, targets the offering of goods or services to people in Brazil or the processing of their data, or uses personal data collected while the person was in Brazil.
Start with the data flow, then check Article 4 exclusions. If the applies, record the and , the Article 7 or 11 legal basis, transparency and rights controls, security measures, and any incident or international-transfer route. Binding regulations from the Agência Nacional de Proteção de Dados () add procedures to the law's general duties; ANPD guides explain practice but do not create new statutory duties.
New to ? Start with applicability and roles. Then choose the legal basis and data category before designing notices, rights, vendor, transfer, or incident controls.
Compliance focus
Scope and roles
Apply Article 3 to each processing activity, check Article 4 exclusions narrowly, then classify who decides purposes and essential means and who acts on instructions.
Operational duties
Choose an Article 7 or 11 basis, provide Article 9 transparency, operate Articles 18-20 rights, and use the current rules for incidents and international transfers.
Regulator readiness
Be ready to show accountability and proportional controls. Administrative sanctions follow due process and the 's inspection and dosimetry regulations; the maximum simple fine is not an automatic fine.
LGPD decisions and records
- 1
Applicability and scope
Test Article 3's three territorial links for each operation, then document any Article 4 exclusion. Academic processing is not wholly excluded: Articles 7 and 11 still apply.
- 2
Obligations and controls
Separate Article 7 bases for ordinary personal data from Article 11 bases for sensitive data, apply the best-interest rule to children and adolescents, and map Articles 18-20 rights.
- 3
Evidence and assurance
Keep processing records, notices, consent evidence, legitimate-interest assessments, contracts, rights logs, security decisions, transfer records, incident records, and any Relatório de Impacto à Proteção de Dados Pessoais () required by the .
Key milestones for LATAM Brazil LGPD compliance
Separate the law's phased commencement from later rules. Most provisions have applied since 18 September 2020 and administrative sanctions since 1 August 2021. Resolution 15 took effect on 26 April 2024 and set the incident procedure and three-business-day notification clock. Resolution 19 took effect on 23 August 2024 and set transfer procedures and ANPD standard contractual clauses; its 12-month contractual transition has ended. Resolution 32, dated 26 January 2026 and currently in force, recognises the European Union as adequate for covered transfers.
Loading timeline...
Choose the next LGPD decision
Start with the processing activity, territorial link, and role. Once those are documented, move to legal basis and rights, then implement evidence, incident, transfer, and enforcement workflows.
Start here: scope and roles
Decide whether the applies, identify , , and encarregado responsibilities, and account for the proportionate rules available to eligible small processing agents.
Legal bases, transparency, and rights
Match each purpose and data category to an basis, explain the processing, and build a complete response path for Articles 18-20 requests.
Implementation and evidence
Turn the decisions into an owned programme, processing records, privacy-risk analysis, controls, and reusable evidence.
Security incidents and international transfers
Use the current regulations to apply the three-business-day incident rule and select a valid transfer mechanism. For EU destinations, confirm that Resolution 32/2026 covers the transfer rather than assuming every European destination or onward transfer is covered.
Dates and enforcement
Distinguish commencement dates, ongoing operational clocks, procedure, and the factors that affect sanctions.
Compare laws or answer a focused question
Use comparisons to identify reusable programme elements without assuming equivalence, or open the FAQ for a direct answer to a specific question.
Sources
planalto.gov.br
Referenced sections
- Binding consolidated text for territorial scope, exclusions, principles, legal bases, rights, controller and operator duties, international transfers, security, incidents, and administrative sanctions.
gov.br
Referenced sections
- Binding ANPD procedure for assessing and communicating security incidents that may cause relevant risk or damage.
gov.br
Referenced sections
- Binding rules for transfer characterisation, legal-basis and mechanism checks, adequacy, contractual safeguards, global corporate rules, transparency, and ANPD standard clauses, as rectified in 2025.
Next steps
Assign LGPD controls and evidence
Use the hub to assign the scope decision, legal basis, rights controls, incident route, transfer mechanism, evidence owner, and review date for each data flow.
- Scope the work by entity, product, processing purpose, system, and .
- Use cited research for unresolved scope, timing, mechanism, or interpretation questions.
- Assign each control, evidence request, approver, due date, exception, and reassessment trigger.
- Keep the resulting decision record with the processing inventory and implementation evidence.
- Open Research Copilot
Research scope, timing, and interpretation questions with cited sources.
- Open Assessment Autopilot
Assign tasks, request evidence, and set review checkpoints for the applicable duties.
- Talk through implementation
Review your current process, evidence model, and next implementation steps.