What should teams do about Small Processing Agents under the Brazil LGPD?
Resolution 2/2022 covers qualifying microenterprises and small businesses under Complementary Law 123/2006, startups that meet Complementary Law 182/2021, and the other private legal persons, natural persons, or unincorporated private entities within its definition when they process personal data as controller or operator. Record the exact statutory category rather than relying on headcount or an informal small-company label.
The differentiated regime is unavailable when the agent performs , has gross revenue above the applicable small-business or startup ceiling, or belongs to an economic group whose global revenue exceeds the applicable ceiling. Determine the legal entity, relevant revenue period and evidence, group perimeter, and any special category condition. Do not divide one operation among related entities to manufacture eligibility.
Apply the risk test to every material activity. It is high risk only when at least one general criterion, large scale or significant effects on fundamental interests and rights, combines with at least one specific criterion: emerging or innovative technology; surveillance or control of publicly accessible areas; decisions based solely on automated processing, including profiling; or sensitive data or data on children, adolescents, or older people.
Where the agent qualifies, identify the exact flexibility used. Resolution 2 permits a and simplified security policy; it does not require appointment of an encarregado if another public communication channel is provided; and it doubles specified response, ANPD-request, and incident-communication periods. The incident period under Resolution 15/2024 is therefore generally six business days for a qualifying small agent unless a specific legal period or exception applies.
ANPD may require the ordinary duty after considering the nature and volume of the processing and risks to people. A high-risk agent generally loses the differentiated treatment but may still use the collective representation arrangement in Article 8 for negotiation, mediation, and conciliation of complaints.
- Eligibility: retain formation documents, legal category, revenue period and statements, tax or startup evidence, economic-group structure and global revenue, controller or operator role, and approval.
- Risk: screen each activity against both general criteria and all four specific criteria, with data volumes, people, geography, frequency, technology, monitoring, automated effects, and vulnerable-person evidence.
- Adaptation: record the exact Resolution article used, owner, operational control, ordinary rule it changes, deadline calculation, exception, and review date.
- Implementation: keep a current , proportionate technical and administrative security, a public data-subject channel, rights and incident procedures, contracts, training, and corrective-action evidence.
- Reassessment: repeat after revenue growth, acquisition or group change, new technology, scale, profiling, sensitive data, vulnerable people, public-area monitoring, incident, ANPD request, or regulatory amendment.
ANPD small-processing-agent regulation used to identify which organizations qualify and which LGPD adaptations apply.
Official LGPD authority provision supporting ANPD rules for differentiated treatment of small processing agents.
ANPD's binding dosimetry regulation governs administrative sanctions for established LGPD infringements.