An LGPD program starts with the real processing inventory, then assigns each applicable duty to the team that can change the data flow.
Completion requires operating evidence: notices as shown, request logs, configured retention, executed contracts, tested security controls, transfer records, and incident decisions.
Use this page to build and review a program under Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD), Law 13.709/2018, and binding regulations from the Agência Nacional de Proteção de Dados (ANPD). Confirm scope and roles first; document an Article 7 or 11 basis for each purpose; then implement transparency, rights, retention, vendor, security, incident, and transfer controls. The controller remains accountable even when operators perform part of the work.
Start with a that identifies purposes, people, data categories, collection points, systems, controller and operators, recipients, countries, retention, security, and the Article 7 or 11 legal basis. Article 37 requires controllers and operators to maintain processing records, especially for legitimate-interest processing.
Group remediation by dependency: scope and roles; principles, purpose, and basis; notices and rights; retention and vendors; security and incidents; transfers; then governance testing. A later control cannot repair an invalid purpose or missing legal basis.
Sources (2)
Binding source for scope, principles, legal bases, rights, processing records, roles, security, incidents, transfers, and governance.
Official register showing the current status of ANPD regulations that supplement the LGPD.
Assign each control to the team that can change the processing. Product owns purpose and collection design; data and engineering own system implementation and retention; procurement and business owners manage operators; security manages preventive and incident controls; privacy or legal reviews the legal route; the controller approves residual risk.
Use dated evidence such as a scope memo, role map, , live notice, consent record, legitimate-interest test, rights log, operator instructions, deletion result, access review, security test, transfer record, or incident exercise. A Relatório de Impacto à Proteção de Dados Pessoais () should describe the processing, risks, safeguards, and mitigation when the ANPD requires one; organisations may also use it as a governance tool for high-risk processing.
Sources (2)
Articles 37-41 allocate processing-record, RIPD, operator-instruction, and encarregado duties; Articles 46 and 50 support security and governance evidence.
Non-binding ANPD guidance with practical security measures for eligible small processing agents.
Small-agent status does not erase the LGPD. Resolution 2/2022 offers specified simplified records, an encarregado dispensation, and differentiated periods only to eligible agents; high-risk processing and revenue or group thresholds can prevent access to that treatment.
Children and adolescents require a concrete best-interest assessment. Sensitive data requires an Article 11 basis; Article 7 legitimate interest is unavailable. International transfers require both a processing basis and a transfer mechanism. Reassess after changes to purpose, data, role, system, vendor, market, people, transfer, complaint, or incident.
Sources (3)
Primary LGPD source for the compliance program scope, including treatment of personal data, controller obligations, rights handling, and governance evidence.
Esta Lei dispõe sobre o tratamento de dados pessoais, inclusive nos meios digitais
Binding eligibility, high-risk, simplified-record, encarregado, and differentiated-period rules for small processing agents.
Non-binding security guidance; it does not replace the LGPD or Resolution 2 eligibility limits.
Test the program against a sample of live processing activities. Confirm that the notice matches the system, rights requests reach every relevant system and recipient, retention jobs run, operator instructions are followed, access controls are reviewed, incident clocks can start, and transfer mechanisms match the actual importer and onward transfers.
Keep an owned remediation register with the source provision, affected activity, gap, action, interim measure, evidence, reviewer, due date, exception, and reassessment trigger. Escalate repeated or high-impact failures for controller decision and, where appropriate, a or other risk review.
Use the statutory and regulatory clocks as test cases. For example, a complete confirmation or access declaration must be supportable within Article 19's 15-day period, a reportable incident must reach the ANPD and affected people within the applicable Resolution 15 period, and a standard-clause transfer must support the 15-day clause-access request in Resolution 19.
Sources (2)
Primary LGPD source for the compliance program scope, including treatment of personal data, controller obligations, rights handling, and governance evidence.
Esta Lei dispõe sobre o tratamento de dados pessoais, inclusive nos meios digitais
Binding accountability, transparency, security, and transfer-mechanism controls for international data flows.
Turn the program gaps into owned controls, evidence requests, and review dates.
Turn Compliance into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next Compliance actions with operational practice.
"Esta Lei dispõe sobre o tratamento de dados pessoais, inclusive nos meios digitais"
How ANPD investigates LGPD infringements, classifies severity, selects sanctions, calculates fines, and weighs aggravating and mitigating evidence.
Apply LGPD Articles 3 and 4 to a processing activity, including foreign organisations, Brazil collection, targeting, exclusions, and the evidence to retain.
Apply Brazil's LGPD incident notification test, three-business-day clock, notice content, phased filing, affected-person communication, and five-year records.
An evidence-based Brazil LGPD checklist for scope, roles, legal bases, notices, rights, vendors, security incidents, transfers, retention, and governance.
Classify LGPD controller, operator, sub-operator, and encarregado roles from actual decisions, instructions, processing facts, and Resolution 18 duties.
Brazil LGPD rights guide covering confirmation, access, correction, restriction, deletion, portability, consent, sharing, objection, and automated decisions.
Track Brazil LGPD commencement dates, data-access responses, incident notices, international-transfer clauses, and ANPD fine-payment deadlines.
Build an LGPD data-subject response that identifies the right, applies the correct timing, records the decision, protects third parties, and proves delivery.
Run an LGPD data-subject request from intake and identity checks through rights analysis, response timing, evidence, exceptions, and escalation.
Decide whether an LGPD incident is reportable, calculate the ANPD deadline, prepare complete or staged notices, and keep the required five-year record.
Run an LGPD personal-data incident from confirmation and risk assessment through three-business-day notices, supplementation, mitigation, and records.
Compare LGPD international-transfer mechanisms: adequacy, ANPD standard clauses, approved specific clauses, global corporate rules, consent, and other Article 33 routes.
Brazil LGPD international-transfer guide for identifying transfers, selecting Article 33 mechanisms, applying ANPD clauses, EU adequacy, and transparency.
Compare LGPD Article 7 bases for ordinary personal data and Article 11 bases for sensitive data, with consent, necessity, evidence, and edge cases.
Apply LGPD legitimate interest through purpose, necessity, balancing, reasonable expectations, safeguards, children, sensitive-data limits, and records.
Understand every ANPD administrative sanction under LGPD Article 52, the fine ceilings, non-monetary penalties, and public-body limits.
Answers to common Brazil LGPD questions about scope, roles, legal bases, rights, incidents, transfers, impact reports, small agents, and enforcement.
Reference guide to Brazil LGPD scope, principles, legal bases, transparency, rights, roles, security, incidents, transfers, records, and ANPD oversight.
Build an LGPD RIPD evidence file that proves the processing scope, high-risk screen, necessity, safeguards, residual risk, approval, and later review.
Decide when to prepare an LGPD RIPD, apply the ANPD high-risk screen, document required evidence and mitigation, approve residual risk, and review changes.
Check whether an organization qualifies for Brazil's small-processing-agent regime, which flexibilities apply, and which LGPD duties remain unchanged.
Choose and maintain LGPD templates for processing records, data-subject requests, incidents, RIPDs, transfers, and controller-operator role evidence.
Classify an LGPD international transfer, confirm the processing legal basis and transfer mechanism, document onward transfers, and approve the evidence before launch.
Compare Brazil's LGPD and California's CCPA by scope, legal bases, consumer rights, sale and sharing rules, deadlines, transfers, and enforcement.
Compare Brazil's LGPD and the EU GDPR by scope, legal bases, roles, rights deadlines, impact assessments, incidents, transfers, and enforcement.
Apply LGPD Article 14 to children's and adolescents' data: age categories, best interests, legal bases, parental consent, limited collection, notices, and evidence.
Compare actual decision rights with contracts, operator instructions, sub-operator approvals, and the encarregado channel.
Test tracker classification, legal bases, banner choices, stored preferences, and deployed network behavior.
Assign the reportability decision, knowledge timestamp, ANPD filing, affected-person notice, and follow-up evidence.
Match each exporter, importer, onward flow, and processing basis to the selected Article 33 mechanism.
Record each purpose, data category, statutory basis, necessity, notice, retention, and reassessment trigger.
Document the interest, necessity, alternatives, expectations, impacts, effective safeguards, and approval.
Assign the report trigger, processing description, risk assessment, safeguards, controller decision, and mitigation checks.
Organize the infringement facts, classification, revenue inputs, mitigation evidence, and procedural deadlines.
Verify eligibility, group revenue, the two-part high-risk screen, each flexibility used, and continuing duties.