LGPD - Lei Geral de Proteção de Dados (Brazil)

Framework Name

‍LGPD (Lei Geral de Proteção de Dados Pessoais)

Type

‍Mandatory

Region / Jurisdiction

‍Brazil

Enforcing Body / Certifying Party

‍Autoridade Nacional de Proteção de Dados (ANPD), Brazil's national data protection authority

Penalty / Consequence of Non-Compliance

‍Fines of up to 2% of the company's revenue in Brazil from the prior fiscal year, capped at R$50 million (roughly $10 million USD) per infraction, alongside warnings, mandatory corrective measures, and the power to suspend or fully prohibit specific data processing activities

What It Is & Why It Matters

LGPD is Brazil's comprehensive data protection law, closely modeled on GDPR, and it applies to any organization processing personal data tied to Brazil, regardless of where that organization is based. It recognizes ten separate lawful bases for processing personal data, more than most comparable privacy laws, and requires most organizations to appoint a Data Protection Officer, called an Encarregado, as the point of contact between the company, data subjects, and the ANPD, though small businesses and startups are exempt from that formal appointment requirement.

It matters because Brazil is Latin America's largest economy and digital market, and the ANPD has moved decisively from a quiet early period into active enforcement, including fines against foreign platforms with no physical presence in Brazil. It also carries more constitutional weight than most privacy laws: a 2022 amendment to Brazil's constitution made personal data protection a fundamental right, giving LGPD a legal foundation similar in strength to Brazil's core civil liberties, not just an ordinary statute that could be casually amended.

Who Needs It

• You process personal data of individuals located in Brazil, even if your company has no Brazilian office
• You are a SaaS vendor, cloud provider, or multinational with Brazilian customers or users
• You are already GDPR compliant and want to understand how much of that work carries over, since the two laws overlap significantly
• You are a foreign platform serving the Brazilian market and want to understand your actual enforcement exposure, which has grown substantially in the past two years