⁦LGPD⁩

⁦Brazil⁩ الخصوصية

الحالة

⁦In force. ANPD became a regulatory agency under Law 15,352/2026 (signed 25 Feb 2026).⁩✓المصادر: ⁦planalto.gov.br⁩, ⁦www2.camara.leg.br⁩, ⁦confidata.com.br⁩, ⁦migalhas.com.br⁩

على من ينطبق

⁦Any public or private processing, wherever the company is based, if processing happens in Brazil, aims to offer goods or services to or process data of people in Brazil, or the data was collected in Brazil.⁩✓⁦LGPD Arts 1, 3 ↗⁩ · المصادر: ⁦planalto.gov.br⁩, ⁦mayerbrown.com⁩

حدود الحجم

⁦No size or revenue thresholds. Small processing agents (micro/small businesses, startups) get a simplified regime under ANPD Resolution 2/2022, unless they do high-risk processing.⁩✓⁦ANPD Res. CD/ANPD 2/2022 Arts 2–3 (small processing agents; high-risk exclusion) ↗⁩ · المصادر: ⁦planalto.gov.br⁩, ⁦gov.br⁩, ⁦demarest.com.br⁩

الجهة الرقابية

⁦Agência Nacional de Proteção de Dados (ANPD)⁩✓⁦LGPD Art 55-A et seq. (as amended by Lei 15.352/2026, converting MP 1.317/2025) ↗⁩ · المصادر: ⁦planalto.gov.br⁩, ⁦confidata.com.br⁩

الإبلاغ عن الخروقات أو الحوادث

⁦Notify the ANPD (via its electronic form) and affected data subjects within 3 business days of learning of an incident that may cause relevant risk or damage (Resolution CD/ANPD 15/2024). Keep records of all incidents for at least 5 years. Deadlines doubled for small agents.⁩✓⁦LGPD Art 48; ANPD Res. 15/2024 Arts 6, 9, 10; ANPD Res. 2/2022 Art 14 (doubled deadlines) ↗⁩ · المصادر: ⁦gov.br⁩, ⁦machadomeyer.com.br⁩, ⁦gov.br⁩

مهلة الرد على طلبات البيانات الشخصية

⁦Confirmation/access in simplified form immediately; complete declaration within 15 days of the request (Art. 19).⁩✓⁦LGPD Art 19(I)–(II) ↗⁩ · المصادر: ⁦planalto.gov.br⁩, ⁦gov.br⁩

مسؤول حماية البيانات

⁦Controllers must appoint a DPO (encarregado) and publish their identity and contact details, preferably on the website (Art. 41). Small processing agents without high-risk processing are exempt but must provide a contact channel.⁩✓⁦LGPD Art 41; ANPD Res. 2/2022 Art 11; ANPD Res. 18/2024 ↗⁩ · المصادر: ⁦planalto.gov.br⁩, ⁦gov.br⁩, ⁦demarest.com.br⁩

الممثل المحلي

⁦No requirement for foreign companies to appoint a local representative in Brazil.⁩✓⁦no provision (cf. LGPD Art 61 on service of process via Brazilian branch/agent) ↗⁩ · المصادر: ⁦planalto.gov.br⁩, ⁦mayerbrown.com⁩

نقل البيانات إلى الخارج

⁦Allowed only on Art. 33 grounds: adequacy, ANPD standard contractual clauses (adopted verbatim; 12-month adoption deadline from 23 Aug 2024), specific clauses, global corporate rules, specific consent, etc. EU and Brazil granted mutual adequacy in Jan 2026.⁩⁦LGPD Art 33; ANPD Res. 19/2024 (SCCs); ANPD Res. 32/2026 (EU adequacy, 26 Jan 2026) ↗⁩

ملفات تعريف الارتباط والموافقة

⁦Needs a legal basis (consent or legitimate interest). ANPD cookie guide (Oct 2022): no pre-ticked non-essential cookies, offer an easy⁩ '⁦reject all⁩' ⁦on the first banner layer, and keep consent-based cookies off by default.⁩✓⁦LGPD Arts 7(I), 7(IX), 8, 10; ANPD Guia Orientativo Cookies (Oct 2022) ↗⁩ · المصادر: ⁦webcon.unioeste.br⁩, ⁦mattosfilho.com.br⁩

أقصى عقوبة

⁦Up to 2% of the company⁩'⁦s (or group⁩'⁦s) revenue in Brazil in the prior fiscal year, net of taxes, capped at R$50 million per infraction.⁩✓⁦LGPD Art 52(II) ↗⁩ · المصادر: ⁦planalto.gov.br⁩, ⁦confidata.com.br⁩

المعلومات الموسومة بعبارة «قيد التحقق» لا تزال قيد التأكيد ولا تُقدَّم كإجابات.

ما يجب عليك فعله✓

• ⁦Identify a legal basis for each processing activity and record it.⁩
• ⁦Appoint and publish a DPO (encarregado), unless exempt as a low-risk small agent.⁩
• ⁦Answer access requests immediately (simplified) or within 15 days (complete).⁩
• ⁦Report risky security incidents to the ANPD and affected people within 3 business days.⁩
• ⁦Use ANPD standard contractual clauses or another Art. 33 mechanism for transfers abroad.⁩
• ⁦Keep a record of all security incidents for at least 5 years.⁩
• ⁦Set up cookie banners with a clear reject option and no pre-ticked boxes.⁩

التغييرات الأخيرة

⁦EU adequacy decision for Brazil adopted 26 Jan 2026 (Implementing Decision (EU) 2026/179); ANPD Res. 32/2026 recognized the EU as adequate. Law 15,352/2026 (25 Feb 2026) made ANPD a regulatory agency (Agencia Nacional de Protecao de Dados). SCC adoption deadline under Res. 19/2024 ended 23 Aug 2025.⁩✓

المصادر

• المصدر الأساسي: ⁦https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709compilado.htm⁩
• المصدر الثاني: ⁦https://www.whitecase.com/insight-alert/mutual-adequacy-between-eu-and-brazil-new-era-transatlantic-data-transfers⁩
• الجهة الرقابية: ⁦Agência Nacional de Proteção de Dados (ANPD)⁩

✓ = مؤكَّد من مصدرين مستقلين، أحدهما على الأقل رسمي. كيف نتحقق

معلومات فقط، وليست استشارة قانونية. القوانين تتغير؛ تحقّق مع الجهة الرقابية أو محامٍ مؤهل قبل الاعتماد على هذه الصفحة. هل لاحظت خطأ؟ راسلنا على ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.