Brazil's Lei Geral de Proteção de Dados Pessoais (), Law 13.709/2018, applies to personal-data processing connected with Brazil, subject to Article 4 exclusions. Start with the processing operation, identify the controller and operator, classify ordinary and sensitive data, choose an Article 7 or 11 legal basis for each purpose, and then apply the binding rules and guidance from the Agência Nacional de Proteção de Dados (ANPD) for rights, children, security incidents, international transfers, impact reports, eligible , and enforcement.
Browse sub-FAQs
Choose the question set you need
These focused FAQ modules break this artifact into narrower answer sets so teams can move straight to the right source-backed guidance.
How should teams use the Brazil LGPD FAQ hub for privacy compliance decisions?
Use the FAQ after identifying the processing operation, purpose, people, data, systems, recipients, and countries. The is the binding statute. ANPD resolutions add binding procedures; ANPD guides explain the authority's approach but do not create a new legal basis, right, exemption, or penalty.
Answer in order: decide scope and any exclusion; identify controller, operator, and encarregado responsibilities; classify ordinary or sensitive data; document the Article 7 or 11 basis; then apply the relevant transparency, rights, retention, security, incident, transfer, or governance rule.
Record the exact processing operation and the fact that triggers the answer.
Name the controller decision-maker, instructed operator, system owner, evidence owner, reviewer, and reassessment trigger.
Keep the cited provision or regulation with the decision record rather than using a source link as a substitute for the answer.
Reopen the answer after a new purpose, data category, child or vulnerable population, vendor, country, automated decision, complaint, incident, or ANPD rule.
ANPD sanctions regulation source for enforcement exposure, corrective action, and compliance evidence planning.
aplicação de sanções administrativas
2
Question 2
Who owns the processing decisions and supporting evidence?
The controller remains accountable for the processing purpose, legal basis, transparency, rights response, transfer route, reportable-incident decision, and risk acceptance. An operator processes on the controller's behalf under lawful instructions and must maintain its own Article 37 record. A supplier can be an operator for the contracted service and a controller for a separate use it determines.
The encarregado is the published communication and advisory function between the processing agent, data subjects, and the ANPD. Resolution 18/2024 requires a formal designation and substitute, resources, technical autonomy, and a usable contact route. Its advisory work does not transfer the controller's or operator's compliance responsibility.
Keep a per-purpose role map; a contract label alone does not decide the role.
Record the controller's instructions, operator assistance, sub-operator approval, security duties, incident escalation, rights support, and return or deletion terms.
Publish the encarregado's identity and contact details, maintain absence coverage, and preserve complaints, ANPD communications, advice, training, conflicts, and escalation records.
Reassess roles when a supplier chooses a new purpose, retention period, recipient, analytics use, or onward transfer.
Binding designation, substitute, publication, resources, autonomy, activity, and conflict rules for the encarregado.
3
Question 3
Which edge cases should teams check before relying on Brazil LGPD FAQ guidance?
Ordinary personal data uses Article 7; sensitive data uses Article 11. includes racial or ethnic origin, religious belief, political opinion, union or religious, philosophical, or political affiliation, health or sex-life data, and genetic or biometric data linked to a person. Article 7 legitimate interest is not an Article 11 basis.
Children's and adolescents' data must be processed in their best interests. Article 14 also sets specific transparency and consent rules for children. Eligible receive only the measures stated in Resolution 2/2022; high-risk processing and revenue or group thresholds can remove that treatment.
Do not treat public, pseudonymised, hashed, or encrypted data as automatically anonymous.
Do not promise deletion where Article 16 permits conservation, or apply Article 19's 15-day complete access period to every Article 18 request.
Do not treat consent as the default basis. It must be demonstrable, purpose-specific, and revocable, and refusal consequences must be explained.
Check public-sector, consumer, employment, health, finance, telecoms, and other sector rules separately.
Official ANPD interpretive statement allowing children's and adolescents' data to be processed under an Article 7 or 11 basis when their best interest is observed and prevails in the concrete case.
O tratamento de dados pessoais de crianças e adolescentes poderá ser realizado com base nas hipóteses legais previstas no art. 7º ou no art. 11
Binding eligibility, high-risk, revenue, and economic-group limits for the special treatment available to small processing agents.
será considerado de alto risco o tratamento de dados pessoais que atender cumulativamente a pelo menos um critério geral e um critério específico
4
Question 4
How should teams turn Brazil LGPD FAQ guidance into owned controls?
Use current ANPD procedure for regulated decisions. Resolution 15/2024 sets the reportability test, three-business-day incident period, staged ANPD filing, affected-person notice, and five-year record. Resolution 19/2024 requires both an Article 7 or 11 processing basis and an Article 33 transfer mechanism; its standard clauses must be adopted in full when selected.
The ANPD applies administrative sanctions through due process and its enforcement and dosimetry regulations. The statutory maximum simple fine is 2% of Brazilian revenue for the prior financial year, excluding taxes and capped at R$50 million per infringement. It is a ceiling, not an automatic amount.
For incidents, keep the knowledge timestamp, risk analysis, filing, affected-person notice, supplement, remediation, and five-year record.
For transfers, keep the exporter, importer, roles, countries, purpose, data, processing basis, mechanism, contract or adequacy decision, onward transfers, security, transparency, and review date.
For a , keep the processing description, methodology, safeguards, risk analysis, mitigation, controller approval, and source data; prepare it when the ANPD requires one and use it proactively for high-risk processing where appropriate.
For enforcement readiness, preserve dated decisions, notices, request logs, processing records, contracts, tests, remediation, cooperation, and proof of corrective action.
Binding transfer characterisation, dual legal gate, mechanism, contractual, transparency, security, and onward-transfer rules.
5
Question 5
Questions and answers
What does the apply to?
The applies to a personal-data processing operation when it occurs in Brazil, aims to offer or supply goods or services to people in Brazil or process their data, or uses personal data collected while the person was in Brazil. Headquarters, server location, and medium do not decide scope by themselves. Article 4 excludes specified private non-economic, journalistic, artistic, public-security, national-defence, state-security, criminal-investigation, and narrow foreign-origin operations. Academic processing remains subject to Articles 7 and 11.
How do controller, operator, sub-operator, and encarregado roles differ?
The controller decides the purpose and essential elements of processing. The operator processes on the controller's behalf under lawful instructions. A sub-operator is a supplier engaged by an operator to help perform that instructed processing; the term comes from ANPD guidance rather than an definition. The encarregado is the formally designated communication and advisory function for data subjects and the ANPD. Classify each purpose from actual conduct, because one supplier can be an operator for the service and a controller for a separate use it determines.
When can personal data be processed under the ?
Article 7 lists ten bases for ordinary personal data: consent; legal or regulatory obligation; specified public-administration processing; research by a research body; contract or requested pre-contract steps; exercise of rights; protection of life or physical safety; health protection; legitimate interest; and credit protection. uses the separate Article 11 list, so an Article 7 basis cannot be carried over automatically.
What is under the ?
is personal data about racial or ethnic origin, religious belief, political opinion, union membership or affiliation with a religious, philosophical, or political organisation, health or sex life, or genetic or biometric data linked to a natural person. Its processing needs an Article 11 basis. Article 7 legitimate interest does not apply, and specific prominent consent is only one of the available Article 11 routes.
What must teams do if they use consent?
Consent must be free, informed, unambiguous, and tied to specified purposes. Written consent must appear in a clause separate from the other contract terms, and the controller must prove that valid consent was obtained. Generic consent is void. The controller must explain the consequences of refusal, make withdrawal free and easy, and stop relying on consent for future processing after revocation unless another legal basis genuinely applies.
What are the main rights of the data subject?
Article 18 gives the data subject rights to confirmation, access, correction, anonymisation, blocking or deletion of unnecessary, excessive, or unlawful data, portability subject to ANPD regulation and protected secrets, deletion of consent-based data subject to Article 16 conservation grounds, sharing information, information about refusing consent, consent revocation, and objection to unlawful non-consent processing. Article 20 separately covers review of solely automated decisions that affect the person's interests. Exercise is free; only confirmation and access have Article 19's immediate simplified or 15-day complete-response choices.
Must a controller delete every record when a person asks?
No. Unnecessary, excessive, or unlawful data can be subject to anonymisation, blocking, or deletion under Article 18(IV), while consent-based data can be deleted under Article 18(VI). Article 16 permits conservation for a legal or regulatory obligation, research by a research body with anonymisation where possible, a transfer to a third party that meets the , or the controller's exclusive use when third-party access is prohibited and the data is anonymised. The controller should explain any refusal or limitation and record the applied ground.
What rule applies to children's and adolescents' data?
Article 14 requires processing of children's and adolescents' personal data in their best interests. Under ANPD Statement 1/2023, processing may use an Article 7 or 11 basis if their best interest is observed and prevails in the concrete case. When consent is used for a child, Article 14 requires specific and prominent consent from at least one parent or legal guardian, subject to the narrow contact and protection exceptions in paragraph 3. Controllers must publish the types of data collected, their uses, and rights procedures, verify parental consent using reasonable efforts, avoid conditioning games or applications on unnecessary data, and present information in a clear form suited to the child's understanding.
What happens after a data security incident?
The controller must notify the ANPD and affected data subjects when a confirmed incident involving -covered personal data may cause relevant risk or damage. Resolution 15/2024 generally requires both communications within three business days from the controller's knowledge that the incident affected personal data, unless specific legislation sets another period. If justified information is missing, the controller may file preliminarily with the ANPD and supplement the same process within 20 business days. Qualifying have six business days for the notices and 40 business days for the supplement under Articles 6(8) and 9(6). Records of reportable and non-reportable personal-data incidents must generally be kept for at least five years from registration, subject to longer duties and the Article 10(2) public-body archival exception.
What makes an international transfer lawful under the ?
An international transfer needs both an Article 7 or 11 basis for the processing and an Article 33 transfer mechanism. Under Resolution 19/2024, identify the exporter, importer, countries, roles, purposes, data, people, access, and onward transfers. Valid routes include a covered ANPD adequacy decision, the ANPD standard contractual clauses adopted in full, prior-approved specific clauses or global corporate rules, and the other case-specific Article 33 routes. Direct collection from the person by an agent abroad is not itself a transfer, although Article 3 can still make the apply.
When does a controller need a ?
A Relatório de Impacto à Proteção de Dados Pessoais () is the controller's record of processing that may create risks to civil liberties and fundamental rights, including the data types, collection and security methodology, safeguards, and mitigation. The ANPD may require one, including for sensitive-data or legitimate-interest processing under the provisions. A controller can also prepare one proactively for high-risk processing. Record the scope, method, risks, safeguards, residual risk, approver, and reassessment triggers; do not describe every RIPD as a regulator-mandated filing.
Do small organisations receive a general exemption?
No. Resolution 2/2022 gives specified simplified records, an encarregado dispensation with a required communication channel, and differentiated periods only to eligible . It does not remove legal bases, principles, rights, security, incident, transfer, or accountability duties. High-risk processing requires at least one general criterion, large scale or potential significant effects on fundamental interests and rights, together with at least one specific criterion: emerging or innovative technology, public-area surveillance, solely automated decisions, or sensitive data or data about children, adolescents, or older people. High-risk processing and applicable revenue or economic-group thresholds can prevent an organisation from using the special treatment.
What penalties can the ANPD impose?
After an administrative process, the ANPD can apply a warning with a corrective period, a simple fine, a daily fine, public disclosure of the infringement, blocking or deletion of affected personal data, suspension measures, and partial or total prohibition measures listed in Article 52. A simple fine is capped at 2% of the private legal entity, group, or conglomerate's prior-year Brazilian revenue, excluding taxes, and R$50 million per infringement. The cap is not an automatic fine; the ANPD applies the enforcement and dosimetry regulations to the case facts.
Recommended next step
Turn Brazil LGPD FAQ into assigned work
Assign the scope, role, basis, rights, incident, transfer, risk, and enforcement questions to named owners with dated evidence.
Official ANPD guidance explaining the binding incident test, period, filing, affected-person notice, staged communication, and five-year record requirements under Resolution 15/2024.
Current binding incident-reporting test, period, filing, notice, supplement, and five-year record procedure under Resolution 15/2024.
Official explanation of confirmation, access, correction, restriction, deletion, consent, sharing, objection, automated-decision, and free-exercise rights.
Official ANPD interpretive statement allowing children's and adolescents' data to be processed under an Article 7 or 11 basis when their best interest is observed and prevails in the concrete case.
"O tratamento de dados pessoais de crianças e adolescentes poderá ser realizado com base nas hipóteses legais previstas no art. 7º ou no art. 11"