FAQImplementation Answers

Brazil LGPD FAQ

Use direct answers for the questions teams ask every week.

These answers follow the law and current ANPD guidance, not generic privacy boilerplate.

Author
Sorena AI
Published
Feb 21, 2026
Updated
Feb 21, 2026
Questions
4

Structured answer sets in this page tree.

Primary sources
4

Cited legal and guidance references.

Publication metadata
Sorena AI
Published Feb 21, 2026
Updated Feb 21, 2026
Overview

The questions below are the ones that repeatedly drive launch delays, legal escalations, and weak evidence. The safest practice is to answer them once in a governed standard and then reuse the same answer format across the program.

Question 1

Scope and role questions

Does LGPD apply to a foreign company? Yes, if Article 3 connects the processing to Brazil through the operation itself, offering or supplying goods or services to individuals located in Brazil, or collection in Brazil.

Can a vendor call itself only a processor and be done? No. The ANPD role analysis depends on who actually decides purpose and essential means in the real workflow.

  • Use Article 3 and 4 first, not corporate domicile alone
  • Map controller and operator roles by activity, not only by contract title
  • Reassess role allocation when affiliates or vendors start making their own purpose decisions
Question 2

Rights and timing questions

How fast must access be provided? Article 19 allows a simplified response immediately or a complete declaration in up to 15 days.

Can requests be charged? The law says the request route should be without cost to the data subject.

  • Build both the immediate and the 15 day response paths
  • Keep refusal and limitation reasons documented
  • Treat automated-decision review as a distinct workflow under Article 20
Question 3

Lawful basis and children questions

Can legitimate interest be used for sensitive data? No. The ANPD guide explains that legitimate interest is a basis for ordinary personal data under Article 7 and does not appear in Article 11 for sensitive data.

Do children data always require consent? Article 14 paragraph 1 creates a highlighted-consent rule for children, but ANPD Statement No. 1 explains that children and adolescents data may also rely on Articles 7 or 11 when best interest prevails in the specific case.

  • Use a documented balancing test for legitimate-interest cases
  • Escalate child-data basis decisions for explicit best-interest review
  • Update notices and rights logic whenever the basis changes
Question 4

Incident, transfer, and sanctions questions

When must an incident be reported? Under the current ANPD incident rule, reportable incidents need communication to ANPD and data subjects within 3 business days, with a 20 business day complement window for preliminary communication.

What is the fine cap? Article 52 allows up to 2 percent of Brazilian revenue, excluding taxes, capped at R$50 million per infraction, plus other non-monetary sanctions.

  • Keep the 3 business day and 20 business day clocks visible in the case workflow
  • Choose transfer mechanisms only after confirming basis and scope
  • Build sanctions mitigation evidence before any case exists
Recommended next step

Use Brazil LGPD FAQ as a cited research workflow

Research Copilot can take Brazil LGPD FAQ from cited answers to recurring questions on this topic to a reusable workflow inside Sorena. Teams working on Brazil LGPD can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Primary sources

References and citations

Related guides

Explore more topics

ANPD Enforcement and Fines | Brazil LGPD Inspection, Procedure, and Sanctions
Grounded ANPD enforcement guide covering inspection procedure, sanctions progression, Article 52 factors, Resolution CD ANPD No.
Brazil LGPD Applicability Test | Article 3 Scope, Article 4 Exclusions, Roles
Grounded Brazil LGPD applicability test covering Article 3 territorial reach, Article 4 exclusions, controller versus operator allocation.
Brazil LGPD Checklist | Scope, Rights, Incidents, Transfers, Evidence
Audit-ready Brazil LGPD checklist covering scope, role allocation, lawful bases, rights timing, DPO disclosure, security, incident reporting.
Brazil LGPD Compliance Program Guide
Build a grounded Brazil LGPD compliance program around scope, lawful bases, rights, records, incident reporting, transfers, DPO, and ANPD-ready evidence.
Brazil LGPD Data Subject Rights | Articles 18 to 20 and 15 Day Access Rule
Grounded Brazil LGPD rights guide covering Articles 18 to 20, free requests, immediate simplified confirmation, full access declaration within 15 days.
Brazil LGPD Deadlines and Compliance Calendar
Brazil LGPD compliance calendar covering key legal and ANPD milestones plus recurring duties for rights, incidents, transfers, training.
Brazil LGPD DSAR Response Template | Immediate and 15 Day Response Logic
Use a Brazil LGPD DSAR response template aligned to Articles 18 and 19, immediate simplified response, full declaration within 15 days, denial rationale.
Brazil LGPD Incident Reporting and Breach Notification
Grounded Brazil LGPD incident reporting guide covering Article 48, ANPD Resolution CD ANPD No.
Brazil LGPD International Transfers | Articles 33 to 35 and ANPD Transfer Mechanisms
Grounded Brazil LGPD transfer guide covering Articles 33 to 35, adequacy, ANPD standard contractual clauses, specific clauses, binding corporate rules.
Brazil LGPD Lawful Bases | Article 7, Article 11, Legitimate Interest
Grounded Brazil LGPD lawful basis guide covering Article 7 and 11 bases, consent rules, ANPD legitimate interest guide, sensitive data.
Brazil LGPD Penalties and Fines | Article 52 and ANPD Dosimetry
Grounded Brazil LGPD penalties guide covering Article 52 sanctions, 2 percent fine cap, R$50 million limit per infraction, publicization, blocking, deletion.
Brazil LGPD Requirements | Articles, Controls, Evidence, and ANPD Guidance
Operational Brazil LGPD requirements map covering scope, lawful bases, transparency, rights, records, DPO, security, incidents, transfers.
Brazil LGPD Templates | DSAR, Incident, Basis, Transfer, Governance
Practical Brazil LGPD template library priorities covering DSAR responses, incident communications, lawful basis records, transfer assessments.
Brazil LGPD vs CCPA and CPRA | Structure, Rights, Enforcement, and Reuse
Grounded comparison of Brazil LGPD and CCPA or CPRA covering scope logic, legal basis model, rights timing, cross-border governance, and reusable controls.
Brazil LGPD vs GDPR | Similarities, Differences, and Control Reuse
Grounded comparison of Brazil LGPD and GDPR covering scope, lawful bases, rights timing, DPO rules, transfer mechanisms, incident reporting.