Meet Brazil's LGPD data protection obligations with less effort

The LGPD is Brazil's general data protection law, Law No. 13,709 of 14 August 2018, in force since 18 September 2020. It regulates the processing of personal data by public and private organisations, sets ten processing principles and ten legal bases, gives individuals rights over their data and requires security and accountability measures. It is enforced by the National Data Protection Authority (ANPD).

Any organisation that processes personal data in Brazil, offers or supplies goods or services to individuals in Brazil, or processes personal data collected in Brazil must comply, regardless of where it is based. This means UK, European and US companies with Brazilian customers, users or staff are usually in scope. Limited exemptions exist, for example purely personal use, journalism, artistic and academic purposes and certain public security activities.

The ANPD can impose sanctions under Article 52, including warnings, a simple fine of up to 2% of the organisation's revenue in Brazil for the prior financial year, capped at R$50 million per infraction, daily fines, publication of the infringement, blocking or deletion of the personal data involved and suspension or prohibition of processing. Administrative sanctions have applied since 1 August 2021.

The LGPD is closely modelled on the GDPR and shares its core concepts: controllers and processors, legal bases, data subject rights, data protection officers, impact assessments, breach notification and restrictions on international transfers. Differences include ten legal bases rather than six, including credit protection, and different timelines and procedures set by ANPD regulations. Strong GDPR controls cover much of the LGPD, but a gap review is still needed.

Yes, as a general rule. Article 41 requires controllers to appoint a person in charge of personal data processing, known as the encarregado, who acts as the contact point for data subjects and the ANPD. The ANPD has issued regulations that relieve small processing agents, such as micro and small businesses, from this obligation in some circumstances while still requiring a communication channel.

Start by mapping the personal data you process and recording a legal basis for each activity. Then publish clear privacy information, set up processes for data subject requests, appoint an encarregado, put processor contracts and international transfer mechanisms in place, implement technical and organisational security measures and prepare a breach response plan. Keep records of processing and impact reports to show accountability to the ANPD.

No. There is no official LGPD certification scheme for organisations. Compliance is demonstrated through your records of processing, policies, contracts, impact reports and security evidence, and is assessed by the ANPD when it supervises or investigates. Many organisations use ISO 27001 or ISO 27701 certification as supporting evidence of the security and privacy controls the LGPD expects.

Yes. OneClickComply supports the LGPD today. Control mapping lets you reuse controls and evidence from GDPR, ISO 27001 and other frameworks against LGPD articles, with automated evidence collection, policy generation and continuous monitoring. OneClickComply does not certify LGPD compliance, but our audit team can guide you through gaps via Ask an Auditor.