⁦LGPD⁩

⁦Brazil⁩ پرائیویسی

حیثیت

⁦In force. ANPD became a regulatory agency under Law 15,352/2026 (signed 25 Feb 2026).⁩✓ذرائع: ⁦planalto.gov.br⁩, ⁦www2.camara.leg.br⁩, ⁦confidata.com.br⁩, ⁦migalhas.com.br⁩

یہ کن پر لاگو ہوتا ہے

⁦Any public or private processing, wherever the company is based, if processing happens in Brazil, aims to offer goods or services to or process data of people in Brazil, or the data was collected in Brazil.⁩✓⁦LGPD Arts 1, 3 ↗⁩ · ذرائع: ⁦planalto.gov.br⁩, ⁦mayerbrown.com⁩

سائز کی حدیں

⁦No size or revenue thresholds. Small processing agents (micro/small businesses, startups) get a simplified regime under ANPD Resolution 2/2022, unless they do high-risk processing.⁩✓⁦ANPD Res. CD/ANPD 2/2022 Arts 2–3 (small processing agents; high-risk exclusion) ↗⁩ · ذرائع: ⁦planalto.gov.br⁩, ⁦gov.br⁩, ⁦demarest.com.br⁩

ریگولیٹر

⁦Agência Nacional de Proteção de Dados (ANPD)⁩✓⁦LGPD Art 55-A et seq. (as amended by Lei 15.352/2026, converting MP 1.317/2025) ↗⁩ · ذرائع: ⁦planalto.gov.br⁩, ⁦confidata.com.br⁩

خلاف ورزی یا واقعے کی رپورٹنگ

⁦Notify the ANPD (via its electronic form) and affected data subjects within 3 business days of learning of an incident that may cause relevant risk or damage (Resolution CD/ANPD 15/2024). Keep records of all incidents for at least 5 years. Deadlines doubled for small agents.⁩✓⁦LGPD Art 48; ANPD Res. 15/2024 Arts 6, 9, 10; ANPD Res. 2/2022 Art 14 (doubled deadlines) ↗⁩ · ذرائع: ⁦gov.br⁩, ⁦machadomeyer.com.br⁩, ⁦gov.br⁩

ذاتی ڈیٹا کی درخواستوں کے جواب کی آخری تاریخ

⁦Confirmation/access in simplified form immediately; complete declaration within 15 days of the request (Art. 19).⁩✓⁦LGPD Art 19(I)–(II) ↗⁩ · ذرائع: ⁦planalto.gov.br⁩, ⁦gov.br⁩

ڈیٹا پروٹیکشن آفیسر

⁦Controllers must appoint a DPO (encarregado) and publish their identity and contact details, preferably on the website (Art. 41). Small processing agents without high-risk processing are exempt but must provide a contact channel.⁩✓⁦LGPD Art 41; ANPD Res. 2/2022 Art 11; ANPD Res. 18/2024 ↗⁩ · ذرائع: ⁦planalto.gov.br⁩, ⁦gov.br⁩, ⁦demarest.com.br⁩

مقامی نمائندہ

⁦No requirement for foreign companies to appoint a local representative in Brazil.⁩✓⁦no provision (cf. LGPD Art 61 on service of process via Brazilian branch/agent) ↗⁩ · ذرائع: ⁦planalto.gov.br⁩, ⁦mayerbrown.com⁩

ڈیٹا بیرونِ ملک بھیجنا

⁦Allowed only on Art. 33 grounds: adequacy, ANPD standard contractual clauses (adopted verbatim; 12-month adoption deadline from 23 Aug 2024), specific clauses, global corporate rules, specific consent, etc. EU and Brazil granted mutual adequacy in Jan 2026.⁩⁦LGPD Art 33; ANPD Res. 19/2024 (SCCs); ANPD Res. 32/2026 (EU adequacy, 26 Jan 2026) ↗⁩

کوکیز اور رضامندی

⁦Needs a legal basis (consent or legitimate interest). ANPD cookie guide (Oct 2022): no pre-ticked non-essential cookies, offer an easy⁩ '⁦reject all⁩' ⁦on the first banner layer, and keep consent-based cookies off by default.⁩✓⁦LGPD Arts 7(I), 7(IX), 8, 10; ANPD Guia Orientativo Cookies (Oct 2022) ↗⁩ · ذرائع: ⁦webcon.unioeste.br⁩, ⁦mattosfilho.com.br⁩

زیادہ سے زیادہ سزا

⁦Up to 2% of the company⁩'⁦s (or group⁩'⁦s) revenue in Brazil in the prior fiscal year, net of taxes, capped at R$50 million per infraction.⁩✓⁦LGPD Art 52(II) ↗⁩ · ذرائع: ⁦planalto.gov.br⁩, ⁦confidata.com.br⁩

جن حقائق پر “تصدیق جاری ہے” لکھا ہے ان کی ابھی تصدیق ہو رہی ہے اور انہیں جواب کے طور پر نہیں دیا جاتا۔

آپ کو کیا کرنا ہوگا✓

• ⁦Identify a legal basis for each processing activity and record it.⁩
• ⁦Appoint and publish a DPO (encarregado), unless exempt as a low-risk small agent.⁩
• ⁦Answer access requests immediately (simplified) or within 15 days (complete).⁩
• ⁦Report risky security incidents to the ANPD and affected people within 3 business days.⁩
• ⁦Use ANPD standard contractual clauses or another Art. 33 mechanism for transfers abroad.⁩
• ⁦Keep a record of all security incidents for at least 5 years.⁩
• ⁦Set up cookie banners with a clear reject option and no pre-ticked boxes.⁩

حالیہ تبدیلیاں

⁦EU adequacy decision for Brazil adopted 26 Jan 2026 (Implementing Decision (EU) 2026/179); ANPD Res. 32/2026 recognized the EU as adequate. Law 15,352/2026 (25 Feb 2026) made ANPD a regulatory agency (Agencia Nacional de Protecao de Dados). SCC adoption deadline under Res. 19/2024 ended 23 Aug 2025.⁩✓

ذرائع

• بنیادی ذریعہ: ⁦https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709compilado.htm⁩
• دوسرا ذریعہ: ⁦https://www.whitecase.com/insight-alert/mutual-adequacy-between-eu-and-brazil-new-era-transatlantic-data-transfers⁩
• ریگولیٹر: ⁦Agência Nacional de Proteção de Dados (ANPD)⁩

✓ = دو آزاد ذرائع سے تصدیق شدہ، جن میں کم از کم ایک سرکاری ہے۔ ہم تصدیق کیسے کرتے ہیں

صرف معلومات، قانونی مشورہ نہیں۔ قوانین بدلتے رہتے ہیں؛ اس صفحے پر انحصار کرنے سے پہلے ریگولیٹر یا کسی مستند وکیل سے تصدیق کریں۔ کوئی غلطی نظر آئی؟ ای میل کریں ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.