The LGPD applies if any territorial link is met for the processing operation, unless an covers that operation.
Test the operation, not only the entity. A foreign headquarters or foreign server does not by itself put processing outside the LGPD.
Use this test for each processing operation under Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD), Law 13.709/2018. The LGPD applies when the operation occurs in Brazil, the activity offers or supplies goods or services to people in Brazil or processes their data, or the personal data was collected while the person was in Brazil. If one link is present, test the Article 4 exclusions before deciding the LGPD is inapplicable.
Apply separately to collection, access, storage, analysis, disclosure, deletion, and other operations in the data flow. One covered operation is enough for the LGPD to govern that operation, regardless of the organisation's headquarters or the medium used.
For the collection link, data is collected in Brazil when the data subject is in Brazil at the time of collection. For the targeting link, record the facts showing that the activity concerns offering goods or services to individuals in Brazil or processing their data; a globally accessible website alone does not answer that fact-specific question.
End with one of three outcomes for each operation: outside on the recorded facts, within Article 3 but covered by a specific , or subject to the LGPD. A mixed data flow can produce different outcomes for different operations.
Sources (1)
Primary LGPD text used to decide whether processing is in scope based on Brazil processing, offering goods or services to individuals in Brazil, or data collected in Brazil.
Esta Lei aplica-se a qualquer operação de tratamento
The controller should approve the scope conclusion. Product, data, procurement, security, and local business teams supply the facts; privacy or legal should review exclusions and unresolved territorial questions.
Keep the data-flow map, the analysis for each operation, any , controller and operator allocation, source version, assumptions, reviewer, approval date, and change trigger.
Sources (1)
Articles 7 and 8 restate territorial application for international data flows and explain the limited foreign-origin transit or return-to-origin exception.
Article 4 excludes processing by a natural person for exclusively private, non-economic purposes; exclusively journalistic or artistic processing; specified public-security, national-defence, state-security, and criminal-investigation processing; and a narrow foreign-origin data case. Academic processing remains subject to Articles 7 and 11.
Do not treat pseudonymised or potentially re-identifiable data as automatically anonymous. Anonymised data falls outside the personal-data rules only when reversal is not reasonably possible using the controller's own means or reasonable available efforts. Record the facts supporting an exclusion and reopen the decision if the data is shared, enriched, reused, or made available to a Brazilian processing agent.
Sources (1)
Boundary and edge-case support for this artifact page.
Esta Lei aplica-se a qualquer operação de tratamento
Use a per-operation intake. A company-level yes or no cannot capture different products, collection points, purposes, recipients, or Article 4 exclusions.
The output should name the covered operation and link, or the precise and its facts. It should also identify the controller and operators, unresolved assumptions, downstream LGPD work, approver, decision date, source version, and reassessment trigger.
Sources (1)
Operational implementation support for the Brazil LGPD applicability test.
Esta Lei aplica-se a qualquer operação de tratamento
Turn the scope decision into assigned evidence, review, and downstream LGPD work.
Turn Applicability Test into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with operational practice.
"Esta Lei aplica-se a qualquer operação de tratamento"
How ANPD investigates LGPD infringements, classifies severity, selects sanctions, calculates fines, and weighs aggravating and mitigating evidence.
Apply Brazil's LGPD incident notification test, three-business-day clock, notice content, phased filing, affected-person communication, and five-year records.
An evidence-based Brazil LGPD checklist for scope, roles, legal bases, notices, rights, vendors, security incidents, transfers, retention, and governance.
Build an LGPD compliance program from processing records, legal bases, transparency, rights, security, vendors, transfers, incidents, and accountable evidence.
Classify LGPD controller, operator, sub-operator, and encarregado roles from actual decisions, instructions, processing facts, and Resolution 18 duties.
Brazil LGPD rights guide covering confirmation, access, correction, restriction, deletion, portability, consent, sharing, objection, and automated decisions.
Track Brazil LGPD commencement dates, data-access responses, incident notices, international-transfer clauses, and ANPD fine-payment deadlines.
Build an LGPD data-subject response that identifies the right, applies the correct timing, records the decision, protects third parties, and proves delivery.
Run an LGPD data-subject request from intake and identity checks through rights analysis, response timing, evidence, exceptions, and escalation.
Decide whether an LGPD incident is reportable, calculate the ANPD deadline, prepare complete or staged notices, and keep the required five-year record.
Run an LGPD personal-data incident from confirmation and risk assessment through three-business-day notices, supplementation, mitigation, and records.
Compare LGPD international-transfer mechanisms: adequacy, ANPD standard clauses, approved specific clauses, global corporate rules, consent, and other Article 33 routes.
Brazil LGPD international-transfer guide for identifying transfers, selecting Article 33 mechanisms, applying ANPD clauses, EU adequacy, and transparency.
Compare LGPD Article 7 bases for ordinary personal data and Article 11 bases for sensitive data, with consent, necessity, evidence, and edge cases.
Apply LGPD legitimate interest through purpose, necessity, balancing, reasonable expectations, safeguards, children, sensitive-data limits, and records.
Understand every ANPD administrative sanction under LGPD Article 52, the fine ceilings, non-monetary penalties, and public-body limits.
Answers to common Brazil LGPD questions about scope, roles, legal bases, rights, incidents, transfers, impact reports, small agents, and enforcement.
Reference guide to Brazil LGPD scope, principles, legal bases, transparency, rights, roles, security, incidents, transfers, records, and ANPD oversight.
Build an LGPD RIPD evidence file that proves the processing scope, high-risk screen, necessity, safeguards, residual risk, approval, and later review.
Decide when to prepare an LGPD RIPD, apply the ANPD high-risk screen, document required evidence and mitigation, approve residual risk, and review changes.
Check whether an organization qualifies for Brazil's small-processing-agent regime, which flexibilities apply, and which LGPD duties remain unchanged.
Choose and maintain LGPD templates for processing records, data-subject requests, incidents, RIPDs, transfers, and controller-operator role evidence.
Classify an LGPD international transfer, confirm the processing legal basis and transfer mechanism, document onward transfers, and approve the evidence before launch.
Compare Brazil's LGPD and California's CCPA by scope, legal bases, consumer rights, sale and sharing rules, deadlines, transfers, and enforcement.
Compare Brazil's LGPD and the EU GDPR by scope, legal bases, roles, rights deadlines, impact assessments, incidents, transfers, and enforcement.
Apply LGPD Article 14 to children's and adolescents' data: age categories, best interests, legal bases, parental consent, limited collection, notices, and evidence.
Compare actual decision rights with contracts, operator instructions, sub-operator approvals, and the encarregado channel.
Test tracker classification, legal bases, banner choices, stored preferences, and deployed network behavior.
Assign the reportability decision, knowledge timestamp, ANPD filing, affected-person notice, and follow-up evidence.
Match each exporter, importer, onward flow, and processing basis to the selected Article 33 mechanism.
Record each purpose, data category, statutory basis, necessity, notice, retention, and reassessment trigger.
Document the interest, necessity, alternatives, expectations, impacts, effective safeguards, and approval.
Assign the report trigger, processing description, risk assessment, safeguards, controller decision, and mitigation checks.
Organize the infringement facts, classification, revenue inputs, mitigation evidence, and procedural deadlines.
Verify eligibility, group revenue, the two-part high-risk screen, each flexibility used, and continuing duties.