LGPD

Lei Geral de Proteção de Dados Pessoais (Law No. 13,709/2018)

Sourced · 13/14 facts confirmed by two sources. Last verified 10 October 2026

Next full re-check due: April 2027. Regulator news is checked monthly; changes are logged in the change log.

Cite this page: GlanceDesk Jurisdiction, “LGPD (Brazil)”, glancedeskjurisdiction.com/laws/br-lgpd, last verified 10 October 2026.

Brazil Privacy

Status: In force. ANPD became a regulatory agency under Law 15,352/2026 (signed 25 Feb 2026).✓Sources: planalto.gov.br, www2.camara.leg.br, confidata.com.br, migalhas.com.br
Who it applies to: Any public or private processing, wherever the company is based, if processing happens in Brazil, aims to offer goods or services to or process data of people in Brazil, or the data was collected in Brazil.✓LGPD Arts 1, 3 ↗ · Sources: planalto.gov.br, mayerbrown.com
Size thresholds: No size or revenue thresholds. Small processing agents (micro/small businesses, startups) get a simplified regime under ANPD Resolution 2/2022, unless they do high-risk processing.✓ANPD Res. CD/ANPD 2/2022 Arts 2–3 (small processing agents; high-risk exclusion) ↗ · Sources: planalto.gov.br, gov.br, demarest.com.br
Regulator: Agência Nacional de Proteção de Dados (ANPD)✓LGPD Art 55-A et seq. (as amended by Lei 15.352/2026, converting MP 1.317/2025) ↗ · Sources: planalto.gov.br, confidata.com.br
Breach or incident reporting: Notify the ANPD (via its electronic form) and affected data subjects within 3 business days of learning of an incident that may cause relevant risk or damage (Resolution CD/ANPD 15/2024). Keep records of all incidents for at least 5 years. Deadlines doubled for small agents.✓LGPD Art 48; ANPD Res. 15/2024 Arts 6, 9, 10; ANPD Res. 2/2022 Art 14 (doubled deadlines) ↗ · Sources: gov.br, machadomeyer.com.br, gov.br
Deadline to answer personal data requests: Confirmation/access in simplified form immediately; complete declaration within 15 days of the request (Art. 19).✓LGPD Art 19(I)–(II) ↗ · Sources: planalto.gov.br, gov.br
Data protection officer: Controllers must appoint a DPO (encarregado) and publish their identity and contact details, preferably on the website (Art. 41). Small processing agents without high-risk processing are exempt but must provide a contact channel.✓LGPD Art 41; ANPD Res. 2/2022 Art 11; ANPD Res. 18/2024 ↗ · Sources: planalto.gov.br, gov.br, demarest.com.br
Local representative: No requirement for foreign companies to appoint a local representative in Brazil.✓no provision (cf. LGPD Art 61 on service of process via Brazilian branch/agent) ↗ · Sources: planalto.gov.br, mayerbrown.com
Sending data abroad: Allowed only on Art. 33 grounds: adequacy, ANPD standard contractual clauses (adopted verbatim; 12-month adoption deadline from 23 Aug 2024), specific clauses, global corporate rules, specific consent, etc. EU and Brazil granted mutual adequacy in Jan 2026.LGPD Art 33; ANPD Res. 19/2024 (SCCs); ANPD Res. 32/2026 (EU adequacy, 26 Jan 2026) ↗
Cookies and consent: Needs a legal basis (consent or legitimate interest). ANPD cookie guide (Oct 2022): no pre-ticked non-essential cookies, offer an easy 'reject all' on the first banner layer, and keep consent-based cookies off by default.✓LGPD Arts 7(I), 7(IX), 8, 10; ANPD Guia Orientativo Cookies (Oct 2022) ↗ · Sources: webcon.unioeste.br, mattosfilho.com.br
Maximum penalty: Up to 2% of the company's (or group's) revenue in Brazil in the prior fiscal year, net of taxes, capped at R$50 million per infraction.✓LGPD Art 52(II) ↗ · Sources: planalto.gov.br, confidata.com.br

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

Identify a legal basis for each processing activity and record it.
Appoint and publish a DPO (encarregado), unless exempt as a low-risk small agent.
Answer access requests immediately (simplified) or within 15 days (complete).
Report risky security incidents to the ANPD and affected people within 3 business days.
Use ANPD standard contractual clauses or another Art. 33 mechanism for transfers abroad.
Keep a record of all security incidents for at least 5 years.
Set up cookie banners with a clear reject option and no pre-ticked boxes.

Recent changes

EU adequacy decision for Brazil adopted 26 Jan 2026 (Implementing Decision (EU) 2026/179); ANPD Res. 32/2026 recognized the EU as adequate. Law 15,352/2026 (25 Feb 2026) made ANPD a regulatory agency (Agencia Nacional de Protecao de Dados). SCC adoption deadline under Res. 19/2024 ended 23 Aug 2025.✓

Partner

Termly

Create and maintain a privacy policy, cookie banner and request forms.

Create your privacy policy with Termly

Partner link: we may earn a commission if you buy, at no extra cost to you. It never affects our legal content. Affiliate disclosure

Sources

Primary source: https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709compilado.htm
Second source: https://www.whitecase.com/insight-alert/mutual-adequacy-between-eu-and-brazil-new-era-transatlantic-data-transfers
Regulator: Agência Nacional de Proteção de Dados (ANPD)

Sources used for the independent check (16)

= confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.