Loading...
Lei Geral de Proteção de Dados Pessoais (General Personal Data Protection Law)
Brazil's General Data Protection Law establishes comprehensive data protection rules for all public and private sector organisations processing personal data. Modelled after the GDPR, it mandates consent-based processing, data subject rights, Data Protection Impact Assessments, and breach notification obligations, with extraterritorial application to any entity targeting Brazilian residents.
65
Articles
10
Chapters
BRL 50M
Max Fine
Aug 2021
Enforced
14 August 2018
Law 13.709 enacted by National Congress
28 December 2018
ANPD (enforcement authority) created
16 August 2020
LGPD becomes enforceable
1 August 2021
ANPD begins applying penalties and sanctions
Obtain informed consent before processing, identify one of ten lawful processing bases for each activity.
Provide access, correction, deletion, anonymisation, portability, and information about sharing to individuals upon request.
Conduct DPIAs for high-risk processing activities as determined by ANPD.
Notify ANPD and affected data subjects of security incidents within a reasonable timeframe.
Establish written contracts between controllers and processors defining processing obligations, security requirements, and liability.
Up to 2% of revenue, capped at BRL 50M (~EUR 9M)
Per infraction, based on Brazilian annual revenue
Public disclosure of violation
Data deletion orders, processing bans, warning notices
Escalating tiers
Warnings → fines → daily fines → publicising → blocking → deletion → prohibition
Schedule a consultation with our regulatory experts to assess your LGPD compliance posture and build a practical roadmap.