Brazil LGPD Deadlines and Compliance Calendar

The LGPD was enacted on 14 August 2018. The ANPD governance provisions identified in Article 65 took effect on 28 December 2018. Most remaining provisions have applied since 18 September 2020, and Articles 52 to 54 on administrative sanctions took effect on 1 August 2021. These dates explain when the legal regime began; they are not recurring due dates.

Resolution CD/ANPD No. 19 took effect on 23 August 2024. Its 12-month transition for organizations using contractual clauses for international transfers ended on 23 August 2025. A team that missed that transition has an existing compliance issue, not a future calendar entry: it should identify each affected transfer and confirm that its contract uses the ANPD clauses or another valid Article 33 mechanism.

For confirmation that processing exists or access to personal data, Article 19 gives the controller two routes: a simplified response immediately, or a clear and complete statement within 15 days from the data subject's request. The complete statement must address the origin of the data, whether records exist, the criteria used, and the purpose of processing, subject to commercial and industrial secrecy. The ANPD may set different deadlines for specific sectors, so the request log should record any applicable sector rule.

For a security incident capable of causing relevant risk or harm, the controller must notify the ANPD and affected data subjects within three business days, counted under Resolution 15/2024 and subject to any deadline in specific legislation. If the controller cannot provide complete information, it may file a justified preliminary notice and complete the ANPD submission within 20 business days from that notice. Qualifying small processing agents have six business days for the notices and 40 business days for the supplement under Articles 6(8) and 9(6). The preliminary notice does not complete the Article 48 duty. The controller must generally keep incident records for at least five years from registration, including incidents it concluded were not reportable, subject to longer duties and the Article 10(2) public-body archival exception.

If an operator discovers the incident first, it should notify the controller without unjustified delay and provide the facts needed for the controller's assessment. The controller's log should preserve the occurrence date, operator notice time, controller knowledge time, reportability decision, and each communication time instead of using one incident date for every clock.

The LGPD does not supply one numeric response period for every Article 18 right, one retention period for all personal data, or one review cycle for privacy notices, processing records, impact reports, contracts, and governance controls. Do not label an internal service level as a statutory deadline. Set an internal target from the applicable legal trigger, risk, contract, sector rule, and any ANPD instruction, then label its legal status.

Retention requires a purpose-by-purpose decision. Articles 15 and 16 address when processing ends and when data may be retained, including compliance with legal or regulatory obligations, research under safeguards, transfer to a third party that meets the LGPD, and the controller's exclusive use with third-party access prohibited and data anonymized. Other laws and regulated-sector rules may set specific retention periods.

The same event can start several clocks. A breach may trigger the ANPD rule, a sector regulator's rule, contractual notice, consumer communications, and litigation-preservation duties. Keep each authority, trigger, calculation, recipient, and completion record separate.

Privacy or legal should maintain the rule and interpretation; the operational owner should maintain the start event, action, and evidence. Incident response, data-subject rights, procurement, security, finance, and business teams each need access to the entries they trigger.

For every live item, keep the source, legal status, covered processing, trigger timestamp, calculation, owner, reviewer, required action, completion evidence, delay reason, and escalation route. A calendar entry is complete only when the organization can show both what it did and why the recorded deadline applied.