Brazil LGPD FAQ

Use the FAQ after identifying the processing operation, purpose, people, data, systems, recipients, and countries. The LGPD is the binding statute. ANPD resolutions add binding procedures; ANPD guides explain the authority's approach but do not create a new legal basis, right, exemption, or penalty.

Answer in order: decide scope and any exclusion; identify controller, operator, and encarregado responsibilities; classify ordinary or sensitive data; document the Article 7 or 11 basis; then apply the relevant transparency, rights, retention, security, incident, transfer, or governance rule.

The controller remains accountable for the processing purpose, legal basis, transparency, rights response, transfer route, reportable-incident decision, and risk acceptance. An operator processes on the controller's behalf under lawful instructions and must maintain its own Article 37 record. A supplier can be an operator for the contracted service and a controller for a separate use it determines.

The encarregado is the published communication and advisory function between the processing agent, data subjects, and the ANPD. Resolution 18/2024 requires a formal designation and substitute, resources, technical autonomy, and a usable contact route. Its advisory work does not transfer the controller's or operator's compliance responsibility.

Ordinary personal data uses Article 7; sensitive data uses Article 11. Sensitive personal data includes racial or ethnic origin, religious belief, political opinion, union or religious, philosophical, or political affiliation, health or sex-life data, and genetic or biometric data linked to a person. Article 7 legitimate interest is not an Article 11 basis.

Children's and adolescents' data must be processed in their best interests. Article 14 also sets specific transparency and consent rules for children. Eligible small processing agents receive only the measures stated in Resolution 2/2022; high-risk processing and revenue or group thresholds can remove that treatment.

Use current ANPD procedure for regulated decisions. Resolution 15/2024 sets the reportability test, three-business-day incident period, staged ANPD filing, affected-person notice, and five-year record. Resolution 19/2024 requires both an Article 7 or 11 processing basis and an Article 33 transfer mechanism; its standard clauses must be adopted in full when selected.

The ANPD applies administrative sanctions through due process and its enforcement and dosimetry regulations. The statutory maximum simple fine is 2% of Brazilian revenue for the prior financial year, excluding taxes and capped at R$50 million per infringement. It is a ceiling, not an automatic amount.