What Is the LGPD?
The Lei Geral de Proteção de Dados Pessoais (Law No. 13,709/2018) is Brazil's principal personal data protection law.
The LGPD entered into force in August 2020, with administrative sanctions becoming applicable in August 2021. The Autoridade Nacional de Proteção de Dados (ANPD) is responsible for overseeing and enforcing the law.
The LGPD establishes principles and obligations governing the collection, use, storage, sharing, security, and other processing of personal data.
The law is relevant to organizations across sectors, including technology, e-commerce, financial services, healthcare, SaaS, marketing, and digital platforms.
Who Needs to Comply With LGPD?
LGPD can apply to organizations inside and outside Brazil depending on the circumstances of the processing.
The law's territorial scope includes situations involving:
Processing in Brazil
Processing operations carried out in Brazilian territory can fall within LGPD regardless of where the controller is established.
Offering Goods or Services in Brazil
Organizations processing personal data to offer goods or services to individuals located in Brazil may be subject to LGPD.
Data Collected in Brazil
LGPD can apply where personal data is collected in Brazilian territory, subject to the law's applicable scope and provisions.
This makes LGPD particularly relevant to international organizations entering or serving the Brazilian market.
LGPD Compliance Services
RegulatoryBridge provides a six-pillar LGPD compliance programme designed to help organizations address core privacy governance and regulatory obligations.
Encarregado / DPO Service
01The Encarregado de Proteção de Dados serves an important role in an organization's data protection programme and can act as a communication channel with the ANPD and data subjects.
RegulatoryBridge provides Encarregado services designed to support organizations with:
- LGPD compliance governance
- ANPD communications
- Data-subject communications
- Privacy programme oversight
- ROPA coordination
- RIPD/DPIA support
- Incident response
- Privacy documentation
- Ongoing compliance support
Our service can provide Portuguese and English-language support for international organizations operating in Brazil.
Records of Processing Activities (ROPA)
02LGPD Article 37 addresses records of processing activities.
A structured Registro de Operações de Tratamento helps organizations understand and document how personal data is processed throughout the business.
A comprehensive ROPA can cover:
- Processing activities
- Processing purposes
- Categories of personal data
- Categories of data subjects
- Data recipients
- Data-sharing arrangements
- International transfers
- Retention periods
- Security measures
- Controllers and processors
- Business owners responsible for processing
RegulatoryBridge supports organizations in maintaining processing records in Portuguese and coordinating them with broader global ROPA frameworks.
RIPD / DPIA
03A Relatório de Impacto à Proteção de Dados Pessoais (RIPD) is an important tool for assessing privacy risks associated with certain processing activities.
RegulatoryBridge supports organizations with privacy impact assessments for:
- High-risk processing
- New products and services
- New technologies
- Large-scale data processing
- Sensitive personal data
- AI-enabled processing
- Regulatory requests
Our approach helps organizations identify privacy risks, document mitigating controls, and maintain evidence of privacy governance.
ANPD Liaison & Regulatory Support
04The Autoridade Nacional de Proteção de Dados (ANPD) is Brazil's data protection authority.
Organizations may need to communicate with the ANPD regarding regulatory matters, consultations, inspections, incidents, or other compliance issues.
RegulatoryBridge provides ANPD liaison support covering:
- Regulatory communications
- Notifications
- Consultations
- Inspection responses
- Compliance inquiries
- Incident-related communications
- Regulatory documentation
Our team can help organizations coordinate communications with the ANPD and maintain appropriate records of regulatory interactions.
International Data Transfers
05International organizations frequently need to transfer personal data between Brazil and other countries.
LGPD establishes requirements governing international transfers, and organizations need to use an applicable legal mechanism and meet relevant safeguards.
RegulatoryBridge supports organizations with:
Adequacy Mechanisms
Assessment of whether an applicable destination or transfer mechanism meets relevant requirements.
Contractual Clauses
Support for contractual mechanisms used for international data transfers.
Binding Corporate Rules
Support for multinational organizations using group-wide transfer arrangements where applicable.
Transfer Governance
Documentation and review of international transfer arrangements.
RegulatoryBridge's current LGPD programme incorporates international-transfer support aligned with ANPD Resolution 19/2024.
LGPD Incident Response
06Personal-data incidents require rapid assessment and coordinated action.
RegulatoryBridge supports organizations with a structured LGPD incident-response process.
Detect
- Identify and classify the incident.
Assess
- Determine the nature and scope of the personal-data incident and assess potential impact.
Contain
- Coordinate appropriate technical, legal, privacy, and operational measures.
Notify
- Assess applicable notification obligations to the ANPD and affected individuals.
Document
- Maintain appropriate incident records and supporting evidence.
Remediate
- Identify corrective measures and reduce the likelihood of recurrence.
RegulatoryBridge's current programme includes ANPD incident-notification support aligned with ANPD Resolution CD/ANPD No. 15/2024.
LGPD Data Subject Rights
LGPD provides individuals with a range of rights concerning their personal data.
These include rights relating to:
- Confirmation of processing
- Access to personal data
- Correction of incomplete or inaccurate data
- Anonymisation, blocking, or deletion of unnecessary or excessive data
- Data portability
- Deletion of data processed based on consent, subject to applicable conditions
- Information about public and private entities with which data has been shared
- Information about the possibility of refusing consent and its consequences
- Revocation of consent
Organizations need processes to receive, assess, authenticate, fulfil, and document applicable data-subject requests.
LGPD Compliance Penalties
The ANPD has enforcement powers under LGPD.
For certain violations, administrative fines can reach up to 2% of revenue in Brazil, capped at R$50 million per infraction. Other sanctions can include daily fines, publication of the infraction, and blocking of personal data, subject to the applicable legal framework and enforcement process.
The potential financial and operational consequences make structured privacy governance an important part of an organization's Brazilian compliance programme.
LGPD Data Subject Request Management
RegulatoryBridge can help organizations establish a structured workflow for handling privacy requests.
A structured request-management process can help organizations manage privacy obligations consistently across Brazil and other jurisdictions.
LGPD Principles
Article 6 establishes principles that organizations must consider when processing personal data.
These include:
Purpose
Personal data should be processed for legitimate, specific, explicit, and informed purposes.
Adequacy
Processing should be compatible with the purposes communicated to the data subject.
Necessity
Processing should be limited to data that is relevant and necessary for the intended purpose.
Free Access
Individuals should have access to information regarding the processing of their personal data.
Data Quality
Personal data should be accurate, clear, relevant, and kept appropriately updated.
Transparency
Individuals should receive clear information about how their data is processed.
Security
Organizations should adopt technical and administrative measures to protect personal data.
Prevention
Organizations should adopt measures designed to prevent harm resulting from data processing.
Non-Discrimination
Personal data should not be processed for unlawful or discriminatory purposes.
Accountability
Organizations should be able to demonstrate the adoption of effective measures capable of complying with data-protection requirements.
RegulatoryBridge's current LGPD page highlights the core Article 6 principles and related accountability requirements.
LGPD Compliance for Different Industries
FinTech & Financial Services
Financial organizations can face overlapping privacy, cybersecurity, and financial-sector requirements. RegulatoryBridge can help coordinate LGPD with broader regulatory obligations.
E-commerce & Retail
Manage customer data, marketing activities, consent, data-subject rights, retention, and international data transfers.
HealthTech
Healthcare organizations may process sensitive personal data and require stronger privacy governance and risk-management processes.
SaaS & Technology
International technology companies serving Brazilian customers may need to assess LGPD territorial scope, processing activities, contracts, international transfers, and data-subject rights.
AI & Machine Learning
AI systems that process personal data may create additional privacy risks around profiling, automated processing, data minimisation, transparency, and lawful processing.
LGPD & Global Privacy Compliance
Global organizations rarely operate under one privacy regulation.
An organization serving Brazilian customers may also need to comply with regulations such as:
- EU GDPR
- UK GDPR
- CCPA/CPRA
- India's DPDPA
- Singapore PDPA
- Japan APPI
- Other national and sector-specific privacy frameworks
RegulatoryBridge provides broader compliance coverage across 45+ jurisdictions, allowing organizations to coordinate LGPD with their wider global privacy programme.
LGPD vs GDPR
LGPD and GDPR share several concepts, including:
- Data-subject rights
- Data protection principles
- Accountability
- Privacy governance
- Records of processing
- Impact assessments
- International transfer requirements
- Breach and incident obligations
However, the laws are not identical.
Organizations should assess the specific requirements of each jurisdiction rather than assuming that GDPR compliance automatically establishes LGPD compliance.
RegulatoryBridge can help organizations coordinate LGPD with GDPR and other global privacy frameworks.
Why Choose RegulatoryBridge for LGPD Compliance?
Brazil-Focused Privacy Support
Access dedicated LGPD compliance support for organizations operating in or serving Brazil.
Encarregado Services
Establish an appropriate privacy communication channel and receive ongoing support for LGPD governance.
ANPD Liaison
Coordinate regulatory communications, notifications, consultations, and inspection responses.
International Transfer Support
Manage Brazilian data transfers within a broader global privacy framework.
Global Regulatory Coverage
Coordinate LGPD with GDPR, UK GDPR, CCPA/CPRA, DPDPA, APPI, PDPA, and other privacy frameworks.
Continuous Regulatory Awareness
RegulatoryBridge's broader platform monitors regulatory and authority developments across 45+ jurisdictions and provides relevant compliance intelligence.
Frequently Asked Questions
Build a Continuous LGPD Compliance Programme
LGPD compliance should evolve alongside your organization.
Your privacy obligations may need to be reassessed when you:
- Launch new products
- Enter the Brazilian market
- Introduce new technologies
- Change service providers
- Process new categories of personal data
- Introduce AI systems
- Change international transfer arrangements
- Expand marketing activities
- Experience a data incident
RegulatoryBridge helps organizations establish an ongoing programme combining Encarregado services, ROPA, RIPD/DPIA, ANPD liaison, international transfer support, incident response, and regulatory monitoring.
Build a privacy programme that can scale with your business in Brazil.