Brazil LGPD Requirements

Article 3 applies when any one of three links exists: processing occurs in Brazil; the activity targets the offer or supply of goods or services to people in Brazil or the processing of data about people located there; or the personal data was collected in Brazil while the person was there. The controller's headquarters, the server location, and the person's nationality do not replace that test.

Article 4 excludes a natural person's exclusively private and non-economic processing; exclusively journalistic or artistic processing; specified academic processing, although Articles 7 and 11 still apply; specified public-security, national-defence, state-security, and criminal-investigation processing governed by separate law; and qualifying foreign-origin data that is not shared with Brazilian processing agents or transferred onward outside its country of origin and comes from a country with adequate protection.

The common baseline is Articles 5-10: classify the data and actors, follow purpose, adequacy, necessity, access, quality, transparency, security, prevention, non-discrimination, and accountability, and select a purpose-specific legal basis. Consent is one Article 7 basis, not a default or a cure for unnecessary processing.

Additional requirements depend on the facts: Article 11 for sensitive data; Article 14 and the child's or adolescent's best interest; Articles 18-20 rights; Articles 23-30 public-sector processing; Articles 33-36 international transfers; Articles 37-41 records, operator instructions, RIPDs, and the encarregado; and Articles 46-50 security, incidents, and governance.

The controller decides purposes and essential means and remains accountable. Operators process on the controller's instructions and keep records of their operations. The encarregado acts as a communication channel and performs the duties assigned by Article 41 and Resolution 18/2024; eligible small processing agents may be excused from appointing one but must provide a data-subject communication channel.

Role labels in a contract are evidence, not the final test. Determine the controller and operator for each operation from who decides the purpose and essential elements and who acts on instructions. The same organization may be a controller for one operation and an operator for another.

Evidence should match the duty: a processing record, displayed notice, consent event, basis assessment, best-interest assessment, rights log, operator instruction, retention result, security test, transfer record, incident record, formal encarregado appointment, or RIPD.

Erasure is not absolute: Article 16 permits conservation for legal or regulatory obligations, research with anonymisation where possible, a lawful transfer to a third party, or the controller's exclusive use when the data is anonymised and inaccessible to third parties. Portability remains subject to ANPD regulation and commercial and industrial secrets.

Article 7 legitimate interest does not apply to sensitive personal data. For children and adolescents, any Article 7 or 11 basis used under ANPD Statement 1/2023 must still satisfy the concrete best-interest rule in Article 14. Publicly accessible data remains subject to purpose, good faith, public interest, principles, and rights.

For rights, confirmation or access must be provided immediately in simplified form or through a clear and complete declaration within 15 days. Other request periods depend on applicable regulation; public-sector procedures also follow the specific laws named in Article 23.

For incidents that may cause relevant risk or damage, Resolution 15/2024 generally requires controller notice to the ANPD and affected people within three business days, subject to a shorter sector-specific period. For transfers, Resolution 19/2024 requires both an Article 7 or 11 processing basis and a valid transfer mechanism.

Review controls after changes to purpose, people, data, interfaces, systems, vendors, suboperators, access countries, retention, complaints, incidents, or ANPD rules.