Brazil LGPD Small Processing Agents

Apply three checks before relying on Resolution 2/2022. First, confirm that the organization fits an eligible category in Article 2. Second, confirm that its gross revenue and, where relevant, the global revenue of its economic group do not exceed the limits incorporated by Article 3. Third, test whether its activity is high-risk processing. An agent that fails any applicable check cannot use the differentiated treatment for small processing agents.

For the incorporated revenue tests, a microenterprise has annual gross revenue up to R$360,000 and a small enterprise has revenue above R$360,000 and up to R$4.8 million under Complementary Law 123/2006. A startup must remain within the Complementary Law 182/2021 ceiling of R$16 million in the previous calendar year, or R$1,333,334 multiplied by the number of months of activity when it operated for less than 12 months. Use the applicable statutory period and include the global revenue of a de facto or de jure economic group.

High risk under Article 4 requires at least one general criterion together with at least one specific criterion. The general criteria are large-scale processing or processing that may significantly affect interests and fundamental rights. The specific criteria are emerging or innovative technology, monitoring publicly accessible areas, decisions based solely on automated processing, or use of sensitive data or data about children, adolescents, or older people.

The regime permits a simplified processing record, a simplified security policy, and specified differentiated periods. Qualifying agents are not required to appoint an encarregado, but an agent without one must maintain a communication channel for data subjects. Appointing an encarregado is treated as a governance practice, not as a condition of qualification.

The flexibilities do not waive the LGPD's principles, legal bases, transparency, data-subject rights, security, incident handling, other laws, contracts, or accountability. Security measures must still be essential and necessary for the actual privacy risk and the agent's circumstances.

Article 14 grants double time for specified data-subject requests, the Article 19 complete declaration, incident communication under Resolution 15/2024, and information or records requested by the ANPD. Article 15 allows the simplified Article 19 confirmation or access declaration within up to 15 days rather than immediately. Read the exact provision before calculating a due date.

The ANPD may require a small agent to comply with an otherwise waived or flexible obligation after considering the nature or volume of processing and risks to data subjects. A prior eligibility decision should therefore be reopened when revenue, group structure, scale, technology, automation, monitored spaces, or affected populations change.

Maintain one controlled eligibility record that identifies the legal category, revenue and group tests, high-risk analysis, each flexibility used, the supporting evidence, owner, approval date, and reassessment conditions. Link it to the processing inventory so reviewers can see whether later processing changed the conclusion.

A controller and an operator may each need their own assessment. Role labels do not decide eligibility, and qualifying as a small processing agent does not change whether an entity is a controller or operator for a particular activity.