Privacy Map

Latin America & Caribbean. National jurisdiction.

Brazil BR

EU adequacy decisionPrimary authority: Agência Nacional de Proteção de Dados (ANPD)
Part I

Domestic law

Comprehensive data protection1

  • LGPDGeneral Personal Data Protection Law, Law No. 13,709/2018 (Lei Geral de Proteção de Dados Pessoais - LGPD)In force
    In force from     Brazil's GDPR-inspired general data protection law with ten lawful bases, data subject rights, accountability duties and a national authority. It applies to processing in Brazil, offering goods or services to people in Brazil, or data collected in Brazil.
    Synopsis

    Brazil's GDPR-inspired general data protection law with ten lawful bases, data subject rights, accountability duties and a national authority. It applies to processing in Brazil, offering goods or services to people in Brazil, or data collected in Brazil.

    Key themes
    • lawful bases
    • legitimate interest
    • data subject rights
    • encarregado (DPO)
    • DPIA (RIPD)
    • breach notification
    • international transfers
    • ANPD sanctions
    Unique features

    Ten lawful bases including credit protection; DPO (encarregado) required for controllers by default (small agents exempt); regulations issued in rapid succession by ANPD. Mutual EU adequacy since January 2026.

    SaaS relevance

    Any SaaS offering services to individuals in Brazil or processing data collected there is in scope regardless of establishment.

    Extraterritorial
    Yes
    Breach notification
    ANPD and data subjects within 3 working days (Res. CD/ANPD 15/2024)
    DPO
    Yes
    Cross-border transfers
    Adequacy, ANPD SCCs, BCRs, specific clauses, consent and other derogations
    Maximum penalty
    2% of Brazilian revenue, capped at BRL 50m per infraction; daily fines; processing bans
    Key dates
    • Adopted
    • In force
    • Sanctions enforceable 2021-08-01; data protection made a constitutional right Feb 2022; ANPD autarchy Oct 2022 (Law 14,460) and regulatory agency status 2025-09-17; EU-Brazil mutual adequacy 2026-01-27
    Text
    Authority
    Agência Nacional de Proteção de Dados (ANPD)
    Verification

    High confidence.

    Processors are not required to appoint a DPO (Res. 18/2024).

    Full record for LGPD

Sectoral privacy1

  • Marco CivilBrazilian Civil Rights Framework for the Internet, Law No. 12,965/2014 (Marco Civil da Internet)In force
    In force from     Establishes principles, rights and duties for internet use in Brazil, including privacy of communications, net neutrality, intermediary liability and mandatory retention of connection and application access logs.
    Synopsis

    Establishes principles, rights and duties for internet use in Brazil, including privacy of communications, net neutrality, intermediary liability and mandatory retention of connection and application access logs.

    Key themes
    • internet rights
    • log retention
    • intermediary liability
    • net neutrality
    • confidentiality of communications
    Unique features

    Application providers operating as a business must retain access logs for six months; Brazilian law applies when any collection act occurs in Brazil.

    SaaS relevance

    SaaS 'application providers' offering services in Brazil must keep access logs, protect communications and respond to court orders.

    Extraterritorial
    Yes
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Brazilian law applies to data collected in Brazil
    Maximum penalty
    Up to 10% of Brazilian group revenue; suspension or prohibition of activities
    Key dates
    • Adopted
    • In force
    • Regulated by Decree 8,771/2016; STF 2025 ruling expanded platform liability under art. 19
    Text
    Authority
    Courts; ANPD/consumer authorities for overlapping matters
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Penalty and STF ruling from general knowledge.

    Full record for Marco Civil
    Partly verifiedMedium confidence. Penalty and STF ruling from general knowledge.

Breach notification1

  • ANPD Res. 15/2024Resolution CD/ANPD No. 15/2024 - Regulation on Security Incident ReportingIn force
    In force from     Defines when a security incident must be reported to the ANPD and data subjects, the content of notices and record-keeping. Incidents with relevant risk or harm must be notified within three working days.
    Synopsis

    Defines when a security incident must be reported to the ANPD and data subjects, the content of notices and record-keeping. Incidents with relevant risk or harm must be notified within three working days.

    Key themes
    • security incidents
    • risk criteria
    • 3 working days
    • incident register
    • preliminary notice
    Unique features

    Lists specific high-risk triggers (sensitive data, children/elderly, financial data, credentials, large scale) and requires an incident log retained for five years.

    SaaS relevance

    SaaS controllers must report qualifying incidents within three working days; processors must support controllers promptly.

    Extraterritorial
    Yes
    Breach notification
    ANPD + data subjects within 3 working days; supplement within 20 working days
    Maximum penalty
    As per LGPD
    Key dates
    • Adopted
    • In force
    Text
    Authority
    Agência Nacional de Proteção de Dados (ANPD)
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Exact adoption/publication dates from general knowledge; DLA Piper confirms April 2024.

    Full record for ANPD Res. 15/2024
    Partly verifiedMedium confidence. Exact adoption/publication dates from general knowledge; DLA Piper confirms April 2024.

Children's privacy1

  • ECA DigitalDigital Statute of Children and Adolescents, Law No. 15,211/2025 (ECA Digital)In force
    In force from     Online child-safety law for digital products and services directed at or likely to be accessed by minors in Brazil. It requires reliable age assurance, parental tools, protective defaults, a ban on profiling minors for ads and impact assessments.
    Synopsis

    Online child-safety law for digital products and services directed at or likely to be accessed by minors in Brazil. It requires reliable age assurance, parental tools, protective defaults, a ban on profiling minors for ads and impact assessments.

    Key themes
    • age verification
    • parental supervision
    • privacy by default
    • ad profiling ban
    • dark patterns
    • child rights impact assessment
    • transparency reports
    Unique features

    Self-declaration of age is not sufficient; accounts of under-16s must be linked to a guardian; foreign providers must appoint a Brazilian legal representative.

    SaaS relevance

    Consumer SaaS, apps, games, marketplaces and edtech likely to be accessed by minors in Brazil are caught, including foreign providers.

    Extraterritorial
    Yes
    Cross-border transfers
    Legal representative in Brazil for foreign providers
    Maximum penalty
    Up to 10% of Brazilian group revenue, capped at BRL 50m per infraction; suspension/prohibition
    Key dates
    • Adopted
    • In force
    • Implementing decrees published 2026-03-18; ANPD sanctions planned from Nov 2026, formal enforcement from Jan 2027
    Text
    Authority
    Agência Nacional de Proteção de Dados (ANPD)
    Verification

    High confidence.

    Sanction date (17 Sept 2025) from general knowledge.

    Full record for ECA Digital

Data localisation / cross-border1

  • ANPD Res. 19/2024Resolution CD/ANPD No. 19/2024 - Regulation on International Data Transfers and Standard Contractual ClausesIn force
    In force from     Sets out procedures for international transfers under the LGPD, adopts mandatory ANPD standard contractual clauses and governs approval of specific clauses, BCRs and adequacy decisions.
    Synopsis

    Sets out procedures for international transfers under the LGPD, adopts mandatory ANPD standard contractual clauses and governs approval of specific clauses, BCRs and adequacy decisions.

    Key themes
    • SCCs
    • BCRs
    • adequacy
    • transparency of transfers
    • equivalent clauses
    Unique features

    ANPD SCCs must be adopted verbatim (no modification) and the controller must publish transfer information on request; foreign SCCs may be recognised as equivalent.

    SaaS relevance

    SaaS providers receiving data from Brazilian customers outside Brazil generally need ANPD SCCs in their DPAs (or reliance on EU adequacy where applicable).

    Extraterritorial
    Yes
    Cross-border transfers
    ANPD SCCs mandatory text since 2025-08-23
    Maximum penalty
    As per LGPD
    Key dates
    • Adopted
    • In force
    • 12-month window to incorporate ANPD SCCs into existing contracts ended 2025-08-23
    Text
    Authority
    Agência Nacional de Proteção de Dados (ANPD)
    Verification

    High confidence.

    DOU URL pattern from general knowledge.

    Full record for ANPD Res. 19/2024

Human rights / constitutional1

  • EC 115/2022Constitutional Amendment No. 115/2022 (fundamental right to personal data protection)In force
    In force from     Adds personal data protection, including in digital media, to the fundamental rights in Article 5 of the Federal Constitution and gives the Union exclusive competence to legislate on the subject.
    Synopsis

    Adds personal data protection, including in digital media, to the fundamental rights in Article 5 of the Federal Constitution and gives the Union exclusive competence to legislate on the subject.

    Key themes
    • fundamental right
    • federal competence
    • data protection
    Unique features

    Prevents states and municipalities from enacting their own general data protection laws.

    SaaS relevance

    Ensures a single federal regime (LGPD/ANPD) for SaaS providers rather than a patchwork of state laws.

    Key dates
    • Adopted
    • In force
    Text
    Authority
    Courts (STF)
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Amendment number/date from general knowledge; DLA confirms Feb 2022.

    Full record for EC 115/2022
    Partly verifiedMedium confidence. Amendment number/date from general knowledge; DLA confirms Feb 2022.
Part II

Regional & international frameworks

Membership-based — check ratification status in the instrument record. 7 instruments from 3 bodies.

United Nations

  • UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified
    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
    Synopsis

    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.

    Key themes
    • cybercrime offences
    • e-evidence
    • production orders
    • data preservation
    • mutual legal assistance
    • human rights safeguards
    Unique features

    It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.

    SaaS relevance

    Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.

    Extraterritorial
    Limited
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Cooperation channels for electronic evidence
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
    Text
    Authority
    UNODC (secretariat); Conference of the States Parties once in force
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.

    Full record for UN Cybercrime Convention
    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
  • Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force
    In force from     This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
    Synopsis

    This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.

    Key themes
    • surveillance
    • interception
    • AI and privacy
    • encryption
    • business responsibility
    • remedies
    Unique features

    The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.

    SaaS relevance

    These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
    Text
    Authority
    Office of the UN High Commissioner for Human Rights (OHCHR) reports; UN Special Rapporteur on the right to privacy
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.

    Full record for Right to privacy in the digital age
    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
  • ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force
    In force from     This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
    Synopsis

    This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.

    Key themes
    • right to privacy
    • state obligations
    • legality
    • arbitrariness
    • individual communications
    Unique features

    It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.

    SaaS relevance

    It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None (treaty-body views; no fines)
    Key dates
    • Adopted
    • In force
    • Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
    Text
    Authority
    UN Human Rights Committee (treaty body)
    Sources consulted
    Verification

    High confidence.

    The party count is approximate and was not re-checked against the UN Treaty Collection.

    Full record for ICCPR Art 17
  • UDHR Art 12Universal Declaration of Human Rights, Article 12In force
    In force from     Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
    Synopsis

    Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.

    Key themes
    • right to privacy
    • correspondence
    • reputation
    • protection of the law
    Unique features

    Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.

    SaaS relevance

    Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Proclaimed by the UN General Assembly in Paris on 10 December 1948
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    The CIPP/E project holds a copy (1948UDHR.pdf).

    Full record for UDHR Art 12
  • UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force
    In force from     Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
    Synopsis

    Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.

    Key themes
    • fair information principles
    • sensitive data
    • access
    • security
    • supervisory authority
    • transborder flows
    Unique features

    Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.

    SaaS relevance

    Gives no direct obligations; it is historical background to UN-system data protection policies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Free flow to states with comparable safeguards
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    Text
    Authority
    None designated
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.

    Full record for UN Guidelines 1990
    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.

Organization of American States (OAS)

  • OAS Updated PrinciplesInter-American Juridical Committee Updated Principles on Privacy and Personal Data ProtectionIn force
    In force from     Thirteen non-binding principles to guide OAS member states in adopting or updating data protection laws. They cover legitimate purpose and fairness, transparency and consent, relevance, limited retention, confidentiality, security, accuracy, access and correction, sensitive data, accountability, cross-border flows and independent authorities.
    Synopsis

    Thirteen non-binding principles to guide OAS member states in adopting or updating data protection laws. They cover legitimate purpose and fairness, transparency and consent, relevance, limited retention, confidentiality, security, accuracy, access and correction, sensitive data, accountability, cross-border flows and independent authorities.

    Key themes
    • principles
    • consent
    • sensitive data
    • accountability
    • cross-border flows
    • independent authority
    Unique features

    The update accounts for the GDPR and Convention 108+ while staying compatible with Inter-American human rights law and the habeas data tradition.

    SaaS relevance

    Background for Latin American national law; no direct obligations.

    Breach notification
    Recommended (security principle)
    DPO
    No
    Cross-border transfers
    Transfers to jurisdictions with comparable protection or with safeguards
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Replaces the CJI 2015 Principles (from the 2012 proposal); approved by the Inter-American Juridical Committee in April 2021 (98th regular session); the General Assembly took note in 2021
    Text
    Authority
    OAS Inter-American Juridical Committee; Department of International Law
    Sources consulted
    Verification

    Low confidence.

    Partly verifiedLow confidence. The April 2021 CJI approval is confirmed indirectly (a SIC Colombia article from 2021 says 'approved last April'). The resolution number, the GA action and the publication URL were not verified.

    Full record for OAS Updated Principles
    Partly verifiedLow confidence. The April 2021 CJI approval is confirmed indirectly (a SIC Colombia article from 2021 says 'approved last April'). The resolution number, the GA action and the publication URL were not verified.

Ibero-American Data Protection Network (RIPD)

  • RIPD StandardsStandards for Personal Data Protection for Ibero-American States (Estándares de Protección de Datos Personales para los Estados Iberoamericanos)In force
    In force from     Non-binding GDPR-inspired model standards for national data protection laws in Spain, Portugal and Latin America. They cover principles, data subject rights, controller accountability, DPIAs, DPOs, breach notification and international transfers.
    Synopsis

    Non-binding GDPR-inspired model standards for national data protection laws in Spain, Portugal and Latin America. They cover principles, data subject rights, controller accountability, DPIAs, DPOs, breach notification and international transfers.

    Key themes
    • principles
    • ARCO rights
    • portability
    • accountability
    • DPIA
    • DPO
    • breach notification
    • transfers
    Unique features

    It acts as a regional GDPR template for Latin American law reform. The 2026 update adds neurodata as a special category and requires human intervention for decisions that are 'solely or essentially' automated.

    SaaS relevance

    Indicates the direction of Latin American national laws; it has no direct obligations.

    Breach notification
    Recommended: authority and data subjects
    DPO
    Conditional
    Cross-border transfers
    Adequacy/contractual clauses/BCRs (model)
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Approved at the RIPD meeting in Santiago de Chile on 2017-06-20. An updated version (neurodata, AI and automated decisions, children) was approved unanimously at the Cartagena de Indias meeting in June 2026, for submission to the Ibero-American Summit in Madrid on 4–5 Nov 2026.
    Text
    Authority
    Red Iberoamericana de Protección de Datos (RIPD)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The text_url is a Panamanian judiciary mirror; the official RIPD URL was not verified. The 2026 updated text is hosted by SEGIB (see sources) and is pending endorsement at the Summit.

    Full record for RIPD Standards
    Partly verifiedMedium confidence. The text_url is a Panamanian judiciary mirror; the official RIPD URL was not verified. The 2026 updated text is hosted by SEGIB (see sources) and is pending endorsement at the Summit.