Brazil. Comprehensive data protection. Law
LGPDGeneral Personal Data Protection Law, Law No. 13,709/2018 (Lei Geral de Proteção de Dados Pessoais - LGPD)
In force
§1Summary
- Synopsis
Brazil's GDPR-inspired general data protection law with ten lawful bases, data subject rights, accountability duties and a national authority. It applies to processing in Brazil, offering goods or services to people in Brazil, or data collected in Brazil.
- Key themes
- Unique features
Ten lawful bases including credit protection; DPO (encarregado) required for controllers by default (small agents exempt); regulations issued in rapid succession by ANPD. Mutual EU adequacy since January 2026.
- SaaS relevance
Any SaaS offering services to individuals in Brazil or processing data collected there is in scope regardless of establishment.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- ANPD and data subjects within 3 working days (Res. CD/ANPD 15/2024)
- DPO
- Yes
- Cross-border transfers
- Adequacy, ANPD SCCs, BCRs, specific clauses, consent and other derogations
- Maximum penalty
- 2% of Brazilian revenue, capped at BRL 50m per infraction; daily fines; processing bans
§3Dates
- Key dates
- Adopted
- In force
- Sanctions enforceable 2021-08-01; data protection made a constitutional right Feb 2022; ANPD autarchy Oct 2022 (Law 14,460) and regulatory agency status 2025-09-17; EU-Brazil mutual adequacy 2026-01-27
§4Text and authority
- Text
- Authoritative text planalto.gov.br
- Authority
- Agência Nacional de Proteção de Dados (ANPD)
§5Where it applies
- Domestic law of
- Brazil
§6Sources and verification
- Verification
High confidence.
Processors are not required to appoint a DPO (Res. 18/2024).