Artifact GuideBrazilRequirements

Brazil LGPD Requirements

This page maps the Brazil LGPD Requirements into scope triggers, accountable owners, controls, evidence records, deadlines, and escalation points.

Use this section to define scope, owner, evidence inputs, and the review outcome before execution.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

This page explains the core Brazil LGPD requirements for lawful processing, transparency, data-subject rights, security, children and sensitive data, international transfers, public-sector processing, and ANPD oversight. Use it to identify the trigger, the required action, the responsible role, the evidence to keep, and the review path.

Section 1

How should teams map Brazil LGPD Requirements into owners, controls, and evidence?

Start by deciding whether the issue affects controller/operator roles, lawful basis, data-subject rights, children data, international transfers, security incidents, DPO/encarregado duties, or ANPD enforcement exposure. The useful answer should name the exact trigger, affected product or process, required action, owner, evidence, and escalation point.

The legal requirements most visitors need to see are the Article 7 lawful bases, Article 11 rules for sensitive data, Article 14 rules for children and adolescents, Article 18 data-subject rights, Article 23 public-sector transparency, Article 26 public-sector sharing limits, Articles 33 to 35 international transfer rules, and Articles 46 to 48 security and incident duties. Keep the LGPD source, role map, lawful-basis analysis, data-subject-right record, transfer basis, incident assessment, and ANPD-facing evidence together.

Define the exact Requirements trigger and the business process it affects.
Record which role, product, system, customer group, or data flow is in scope.
Attach the source-linked rule, the owner, and the evidence field before approving the control.
Escalate uncertainty when the facts depend on thresholds, exemptions, cross-border activity, vulnerable users, or enforcement-sensitive wording.

Sources for this answer

LEI Nº 13.709, DE 14 DE AGOSTO DE 2018

Primary source support for the Requirements decision.

PORTARIA ANPD N° 35, DE 4 DE NOVEMBRO DE 2022

Primary source support for the Requirements decision.

RESOLUÇÃO CD/ANPD Nº 4, DE 24 DE FEVEREIRO DE 2023

Primary source support for the Requirements decision.

Section 2

Who should own the Brazil LGPD requirements, and what evidence should prove the decision?

Ownership should sit with the team that controls the processing purpose, data-subject channel, vendor relationship, transfer mechanism, security incident response, or ANPD communication.

Evidence should show controller/operator mapping, lawful basis, transparency notice, rights response, transfer analysis, incident decision, DPO involvement, and ANPD remediation record where applicable.

Name one accountable owner and one reviewer for the Requirements workflow.
Keep source screenshots or source links, decision notes, implementation tickets, and approval records together.
Use dated evidence for deadlines, notices, risk assessments, contracts, user journeys, and regulator-facing records.
Review the evidence after product changes, new markets, new vendors, enforcement updates, or material changes in the source text.

Sources for this answer

PORTARIA ANPD N° 35, DE 4 DE NOVEMBRO DE 2022

Evidence and ownership support for Brazil LGPD.

RESOLUÇÃO CD/ANPD Nº 4, DE 24 DE FEVEREIRO DE 2023

Evidence and ownership support for Brazil LGPD.

GUIA ORIENTATIVO SOBRE SEGURANÇA DA INFORMAÇÃO PARA AGENTES DE TRATAMENTO DE PEQUENO PORTE

ANPD small-agent security guidance supports the requirements evidence for administrative, technical, and cloud controls under LGPD security duties.

Section 3

Which edge cases should teams check before relying on a Brazil LGPD requirements decision?

Most LGPD mistakes happen at the boundary between controller and operator duties, consent and other lawful bases, academic or public-interest processing, international transfers, and incident notification thresholds.

Apply this section before approving a processing activity, vendor arrangement, transfer, rights workflow, child-data handling, or incident response under LGPD. If evidence is missing, block progression and raise a review task.

Check whether the rule changes for minors, consumers, business users, public-sector bodies, regulated sectors, high-risk services, or cross-border transfers.
Separate binding law, regulator guidance, consultation material, standards, and enforcement commentary in the evidence record.
Do not rely on a previous answer if the data categories, user interface, vendor role, or contractual flow changed.
Track unresolved assumptions in an open-questions section and route legal interpretation points for review.

Sources for this answer

LEI Nº 13.709, DE 14 DE AGOSTO DE 2018

Boundary and edge-case support for this artifact page.

PORTARIA ANPD N° 35, DE 4 DE NOVEMBRO DE 2022

Boundary and edge-case support for this artifact page.

RESOLUÇÃO CD/ANPD Nº 4, DE 24 DE FEVEREIRO DE 2023

Boundary and edge-case support for this artifact page.

GUIA ORIENTATIVO SOBRE SEGURANÇA DA INFORMAÇÃO PARA AGENTES DE TRATAMENTO DE PEQUENO PORTE

ANPD small-agent security guidance supports the requirements evidence for administrative, technical, and cloud controls under LGPD security duties.

Section 4

How should teams operationalize Requirements with proportionate controls?

Use an LGPD workflow that captures role, purpose, lawful basis, data category, data-subject right, transfer or incident trigger, DPO review, evidence, and review date.

The output should be a lawful-basis memo, role map, privacy notice update, DSAR record, transfer note, incident assessment, or ANPD response pack.

Create a short intake question that identifies the Requirements scenario.
Map the answer to a required action, evidence field, owner, reviewer, and review date.
Link related artifact pages with descriptive anchors so users can move from scope to deadlines, controls, penalties, and templates.
Update the workflow when official source material changes or when internal evidence shows recurring exceptions.

Sources for this answer

LEI Nº 13.709, DE 14 DE AGOSTO DE 2018

Operational implementation support for the Brazil LGPD requirements.

PORTARIA ANPD N° 35, DE 4 DE NOVEMBRO DE 2022

Operational implementation support for the Brazil LGPD requirements.

RESOLUÇÃO CD/ANPD Nº 4, DE 24 DE FEVEREIRO DE 2023

Operational implementation support for the Brazil LGPD requirements.

Recommended next step