Brazil LGPD, Lei Geral de Proteção de Dados, is Brazil’s general data protection law. It was enacted as Lei nº 13.709/2018, took substantive effect on 18 September 2020, and became enforceable through administrative sanctions on 1 August 2021.
It is structurally close to the GDPR and differs in ways that matter. It provides ten legal bases rather than six. It gives data subjects a right to request review of decisions taken solely on the basis of automated processing under Article 20. It caps administrative fines at 2% of Brazilian revenue with a ceiling of BRL 50 million per infraction, which is a lower exposure than the GDPR but applies to a narrower revenue base.
Two Brazil LGPD developments reshaped the picture in 2026. On 26 January 2026, Brazil and the European Union adopted mutual adequacy decisions, which removed the need for transfer mechanisms in either direction. And the ANPD published a regulatory agenda naming biometrics, health data and financial data processed with AI as enforcement priorities for 2026 and 2027.
Brazil still has no AI statute. PL 2338/2023, the Marco Legal da Inteligência Artificial, passed the Senate on 10 December 2024 and remains in the Chamber of Deputies awaiting a rapporteur’s opinion. Until it is enacted, the LGPD is the binding framework for AI systems processing personal data in Brazil, and the ANPD has already acted under it.
Official text: Lei nº 13.709/2018
Key Brazil LGPD Definitions
Definitions are drawn from Article 5 of the LGPD. The law is in Portuguese and the translations below are working renderings rather than official English text.
| Term (Portuguese) | English | Definition |
|---|---|---|
| Dado pessoal | Personal data | Information relating to an identified or identifiable natural person |
| Dado pessoal sensível | Sensitive personal data | Personal data concerning racial or ethnic origin, religious belief, political opinion, membership of a trade union or of a religious, philosophical or political organisation, data concerning health or sex life, genetic or biometric data, where linked to a natural person |
| Dado anonimizado | Anonymised data | Data relating to a data subject who cannot be identified, considering the use of reasonable and available technical means at the time of processing |
| Titular | Data subject | The natural person to whom the personal data being processed relates |
| Controlador | Controller | The natural or legal person, of public or private law, to whom decisions concerning the processing of personal data fall |
| Operador | Processor | The natural or legal person, of public or private law, who processes personal data on behalf of the controller |
| Encarregado | Data protection officer | The person appointed by the controller and processor to act as a channel of communication between the controller, the data subjects and the ANPD |
| Tratamento | Processing | Any operation carried out with personal data, including collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation, control, modification, communication, transfer, dissemination or extraction |
| ANPD | National Data Protection Authority | Autoridade Nacional de Proteção de Dados, the federal authority responsible for supervising and enforcing the LGPD |
| Relatório de impacto | Data protection impact report | Documentation containing the description of processing operations that may generate risks to civil liberties and fundamental rights, together with measures and mechanisms for risk mitigation |
What the Brazil LGPD Is and When It Took Effect?
The LGPD is Brazil’s first comprehensive data protection statute. Before it, data protection obligations were scattered across the Consumer Protection Code, the Civil Rights Framework for the Internet (Marco Civil da Internet, Lei 12.965/2014), and sector-specific rules.
Article 1 sets out the purpose:
“This Law provides for the processing of personal data, including in digital media, by a natural person or by a legal entity of public or private law, with the objective of protecting the fundamental rights of freedom and privacy and the free development of the personality of the natural person.”
Brazil LGPD sequencing matters for anyone reading older guidance.
| Date | Event |
|---|---|
| 14 August 2018 | Lei nº 13.709/2018 sanctioned |
| 18 September 2020 | Substantive provisions take effect |
| 1 August 2021 | Administrative sanctions become applicable |
| 2021 | ANPD begins operating under the LGPD |
| November 2023 | First ANPD enforcement actions |
| February 2022 | Constitutional Amendment 115/2022 elevates data protection to a fundamental right under the Federal Constitution |
| 2024 | Resolution CD/ANPD No. 19/2024 establishes the international transfer framework and standard contractual clauses |
| 26 January 2026 | Brazil and the EU adopt mutual adequacy decisions |
| March 2026 | Digital Child and Adolescent Statute (Lei 15.211/2025) in force |
| 2026 | ANPD publishes regulatory agenda naming AI-processed biometric, health and financial data as enforcement priorities |
Constitutional Amendment 115/2022 is frequently overlooked outside Brazil. It inserted protection of personal data, including in digital media, into the list of fundamental rights in Article 5 of the Federal Constitution. The practical effect is that data protection claims in Brazil carry constitutional weight, which influences how courts weigh them against competing interests.
Territorial Scope: Does Brazil LGPD Apply to Your Business
Article 3 establishes extraterritorial reach on a basis similar to the GDPR.
“This Law applies to any processing operation carried out by a natural person or by a legal entity of public or private law, regardless of the medium, the country of its headquarters or the country where the data are located, provided that:
I. the processing operation is carried out in the national territory;
II. the processing activity has as its objective the offer or supply of goods or services, or the processing of data of individuals located in the national territory; or
III. the personal data being processed were collected in the national territory.”
| Scenario | LGPD applies |
|---|---|
| Brazilian company processing Brazilian residents’ data | Yes |
| Non-Brazilian company offering goods or services to people in Brazil | Yes |
| Non-Brazilian company processing data of individuals located in Brazil | Yes |
| Data collected in Brazil and processed abroad | Yes |
| Processing for exclusively private and non-economic purposes | No, Article 4(I) |
| Processing for journalistic, artistic or academic purposes | Partially excluded, Article 4(II) |
| Processing for public security, national defence, State security, or criminal investigation | Excluded from the LGPD, subject to separate legislation, Article 4(III) |
| Data originating outside Brazil, not communicated to Brazilian processing agents, in transit through Brazil | Excluded, Article 4(IV) |
A US, UK or EU company with Brazilian users is in scope. Establishment is irrelevant.
The Ten Legal LGPD Bases
This is the most commonly misunderstood divergence from the GDPR. Article 7 provides ten legal bases for processing personal data, four more than Article 6 GDPR.
| Article 7 basis | Equivalent under GDPR |
|---|---|
| I. Consent of the data subject | Article 6(1)(a) |
| II. Compliance with a legal or regulatory obligation of the controller | Article 6(1)(c) |
| III. By the public administration, for the execution of public policies | Article 6(1)(e) |
| IV. For studies by a research body, with anonymisation where possible | No direct equivalent |
| V. For the execution of a contract or preliminary procedures related to a contract to which the data subject is a party | Article 6(1)(b) |
| VI. For the regular exercise of rights in judicial, administrative or arbitral proceedings | No direct equivalent |
| VII. For the protection of life or physical safety of the data subject or a third party | Article 6(1)(d) |
| VIII. For the protection of health, in a procedure carried out by health professionals, health services or sanitary authorities | No direct equivalent |
| IX. When necessary to meet the legitimate interests of the controller or a third party, except where the data subject’s fundamental rights and freedoms prevail | Article 6(1)(f) |
| X. For the protection of credit | No direct equivalent |
Three points matter in practice.
Legitimate interests under Article 7(IX) is narrower than the GDPR equivalent. Article 10 restricts it to support and promote the controller’s activities and to protect the regular exercise of the data subject’s rights or provide services that benefit them, in each case with the data subject’s legitimate expectations and fundamental rights considered. It is not a general-purpose residual basis.
The credit protection basis under Article 7(X) has no GDPR counterpart and is used widely in Brazilian financial services.
Sensitive personal data has its own list of bases under Article 11, which is narrower than Article 7. Legitimate interests is not available for sensitive data.
Brazil LGPD Article 20: Automated Decisions
For any organisation deploying AI, Article 20 is the operative provision and it is where ANPD enforcement attention has concentrated.
“The data subject has the right to request the review of decisions taken solely on the basis of automated processing of personal data that affect their interests, including decisions intended to define their personal, professional, consumer and credit profile, or aspects of their personality.”
Article 20(1) adds:
“The controller shall provide, whenever requested, clear and adequate information regarding the criteria and procedures used for the automated decision, observing commercial and industrial secrets.”
Three features distinguish this from GDPR Article 22.
The LGPD confers a right to request review rather than a general prohibition. Article 22 GDPR prohibits solely automated decisions with legal or similarly significant effects subject to three exceptions. The LGPD permits them and gives the data subject a right of review.
The review need not be by a human. The original bill required human review, and that requirement was removed by presidential veto before enactment. Attempts to restore it have not succeeded. The current text requires review, without specifying who or what performs it.
Trade secret protection is express. The obligation to explain the criteria and procedures is qualified by observance of commercial and industrial secrets, which gives controllers more room than the GDPR’s equivalent transparency requirement.
Article 20(2) permits the ANPD to carry out an audit to verify discriminatory aspects of automated processing where the controller does not supply information on grounds of trade secrecy. This is the hook the ANPD has signalled it intends to use.
LGPD Data Subject Rights
Article 18 sets out the rights of the data subject, exercisable against the controller free of charge.
| Right | Article 18 |
|---|---|
| Confirmation of the existence of processing | I |
| Access to the data | II |
| Correction of incomplete, inaccurate or outdated data | III |
| Anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in non-compliance with the Law | IV |
| Portability to another provider | V |
| Deletion of data processed with consent | VI |
| Information about public and private entities with which the controller has shared data | VII |
| Information about the possibility of refusing consent and the consequences of refusal | VIII |
| Revocation of consent | IX |
Article 19 sets the response timeframes: immediately in simplified format, or within 15 days in a clear and complete declaration.
Fifteen days is materially shorter than the GDPR’s one month, and it is a fixed period rather than an extendable one. Organisations running a single global rights-handling process calibrated to GDPR timelines will miss the Brazilian deadline.
International Transfers and the January 2026 EU Adequacy Decision
Article 33 governs international transfers. The framework was substantially developed by Resolution CD/ANPD No. 19/2024, which introduced Brazilian standard contractual clauses and the procedural rules for their use.
On 26 January 2026, Brazil and the European Union adopted mutual adequacy decisions. This is the single most consequential development for cross-border data flows involving Brazil since the LGPD took effect.
| Transfer route | Mechanism required |
|---|---|
| Brazil to EU or EEA | None. Covered by the January 2026 mutual adequacy decision |
| EU or EEA to Brazil | None. Covered by the January 2026 mutual adequacy decision |
| Brazil to a country with an ANPD adequacy decision | None |
| Brazil to any other jurisdiction | ANPD-approved standard contractual clauses under Resolution CD/ANPD No. 19/2024, binding corporate rules, or another Article 33 mechanism |
| Intragroup transfers | Binding corporate rules, subject to prior assessment and ANPD approval |
Two consequences follow for multinationals.
The EU to Brazil leg no longer requires SCCs or a transfer impact assessment. Organisations still running EU SCCs for Brazilian processors can retire them, though the underlying Article 28 GDPR data processing agreement remains necessary.
Transfers from Brazil to the United States, the United Kingdom, or any other non-adequate jurisdiction still require Brazilian SCCs. The UK is not covered by the January 2026 decision, which is a Brazil-EU instrument. A UK company receiving data from a Brazilian entity needs the Brazilian clauses in place.
The ANPD
The ANPD is the federal authority responsible for supervising and enforcing the LGPD. It was established by the LGPD itself and began operating in 2021. Its status was strengthened in 2026 when it became an independent regulatory agency, which removes it from direct subordination to the executive and aligns its governance with other Brazilian sectoral regulators.
Enforcement priorities for 2026 and 2027
The ANPD publishes a regulatory agenda indicating where it will concentrate rulemaking and enforcement. The current agenda names:
| Priority | Scope |
|---|---|
| Biometric data processed with AI | Facial recognition, identity verification, remote biometric identification |
| Health data processed with AI | Diagnostic support, triage, health insurance underwriting |
| Financial data processed with AI | Credit scoring, fraud detection, underwriting |
| Automated decision-making under Article 20 | Reviewability of decisions in credit and employment screening |
| Cross-border transfers involving AI systems | Transfers of training and inference data outside Brazil |
The ANPD has already acted on AI under the LGPD, including suspending platform features that used user data for AI training without an adequate legal basis. That action predates any AI statute and relied entirely on LGPD provisions.
Sanctions under LGPD
Article 52 sets out the administrative sanctions available to the ANPD.
| Sanction | Detail |
|---|---|
| Warning | With a deadline for corrective measures |
| Simple fine | Up to 2% of the revenue of the private legal entity, group or conglomerate in Brazil in its last financial year, excluding taxes, capped at BRL 50 million per infraction |
| Daily fine | Subject to the same overall cap |
| Publicising the infraction | After it has been confirmed |
| Blocking of the personal data | Until regularisation |
| Deletion of the personal data | Relating to the infraction |
| Partial suspension of database operation | Up to six months, extendable |
| Suspension of the processing activity | Up to six months, extendable |
| Partial or total prohibition of processing activities | The most severe sanction |
The headline fine looks modest next to the GDPR’s 4% of worldwide turnover. Two qualifications apply.
The 2% is calculated on Brazilian revenue, not global revenue, which reduces exposure for multinationals with limited Brazilian operations. The BRL 50 million cap applies per infraction, and a single incident can produce multiple infractions.
The operational sanctions matter more than the financial ones for many businesses. Suspension of a database or prohibition of processing activities is an existential event for a platform, and the ANPD has shown willingness to suspend specific features rather than fine and move on.
Article 52(1) requires sanctions to be applied after an administrative procedure allowing full defence, taking into account the gravity of the infraction, the good faith of the offender, the advantage obtained, the economic condition of the offender, repeat offences, the degree of damage, cooperation, repeated adoption of mechanisms and procedures minimising damage, the adoption of a privacy governance programme, and prompt adoption of corrective measures.
The reference to a privacy governance programme is the closest the LGPD comes to rewarding documented compliance directly. Article 50 sets out what such a programme should demonstrate, and the ability to produce it during an administrative procedure is a mitigating factor by statute.
AI Under the LGPD: The Position Until PL 2338 Passes
Brazil has no AI statute in force. PL 2338/2023, the Marco Legal da Inteligência Artificial, was approved by the Federal Senate on 10 December 2024 and sent to the Chamber of Deputies, where it remains in a special committee awaiting the rapporteur’s opinion.
| Feature | PL 2338/2023 as passed by the Senate |
|---|---|
| Model | Risk-based, loosely modelled on the EU AI Act |
| Prohibited uses | Yes |
| High-risk classification | Yes, with specific obligations |
| Algorithmic impact assessment | Required for high-risk systems |
| Central authority | ANPD, coordinating the System for AI Regulation and Governance (SIA) with sector regulators |
| Extraterritorial scope | Yes, applying to AI systems affecting individuals in Brazil |
| Maximum penalty | Up to 2% of Brazilian revenue, capped at BRL 50 million per infraction, mirroring the LGPD |
| Status as at October 2026 | Not enacted. Awaiting rapporteur’s opinion in the Chamber special committee |
Describing PL 2338 as a Portuguese translation of the EU AI Act is inaccurate. The institutional model differs: it sits within the LGPD and ANPD architecture, Brazilian consumer and civil law, and a live constitutional debate over federal legislative competence.
Until it is enacted, AI systems processing personal data in Brazil are governed by the LGPD. The provisions that bite are Article 7 and Article 11 on legal basis, Article 6 on the processing principles including necessity and non-discrimination, Article 20 on automated decisions, Article 38 on impact reports, and Article 46 on security measures.
An organisation that treats Brazil as unregulated for AI until PL 2338 passes has misread the position, and the ANPD’s existing enforcement record demonstrates why.
Brazil LGPD Compared to GDPR
| Feature | LGPD | GDPR |
|---|---|---|
| Legal bases | 10, Article 7 | 6, Article 6 |
| Legitimate interests | Narrower, restricted by Article 10 | Article 6(1)(f), broader |
| Automated decisions | Right to request review, Article 20. Human review not required | Prohibition with three exceptions, Article 22 |
| Data subject response time | 15 days | One month, extendable by two |
| DPO (encarregado) | Required for controllers, with ANPD discretion to set exemptions | Required in defined circumstances, Article 37 |
| Breach notification | To the ANPD and the data subject within a reasonable time, specified by the ANPD at two business days | 72 hours to the authority, Article 33 |
| Maximum fine | 2% of Brazilian revenue, capped at BRL 50 million per infraction | 4% of worldwide annual turnover or €20 million |
| Operational sanctions | Blocking, suspension, prohibition of processing | Available but less prominent in practice |
| Impact assessment | Report may be required by the ANPD, Article 38 | DPIA mandatory for high-risk processing, Article 35 |
| Constitutional status | Fundamental right under EC 115/2022 | Charter Article 8 |
| Adequacy with the other | Mutual adequacy adopted 26 January 2026 | Mutual adequacy adopted 26 January 2026 |
The practical conclusion for multinationals is that a GDPR programme covers most of the LGPD, with four specific gaps to close: the 15-day response deadline, the two business day breach notification window, the additional legal bases, and the Article 20 review right, which operates differently enough that a GDPR Article 22 architecture does not map onto it cleanly.
LGPD Compliance Checklist
| Step | Action |
|---|---|
| 1 | Confirm whether Article 3 brings your processing into scope, including through the offer of goods or services to people in Brazil |
| 2 | Map processing activities and assign a legal basis from Article 7, or Article 11 for sensitive data |
| 3 | Test any reliance on legitimate interests against the narrower Article 10 restrictions |
| 4 | Appoint an encarregado and publish the contact details |
| 5 | Build rights handling to the 15-day Article 19 deadline, not the GDPR month |
| 6 | Establish breach notification to the ANPD within two business days |
| 7 | Identify every automated decision affecting data subjects’ interests and build the Article 20 review route |
| 8 | Document the criteria and procedures behind automated decisions, with trade secret boundaries defined in advance |
| 9 | Retire EU SCCs for EU to Brazil transfers following the January 2026 adequacy decision |
| 10 | Put Brazilian SCCs in place for transfers from Brazil to non-adequate jurisdictions, including the UK and the US |
| 11 | Prepare an impact report under Article 38 for high-risk processing, particularly AI involving biometric, health or financial data |
| 12 | Document a privacy governance programme under Article 50, which is a statutory mitigating factor |
| 13 | Track PL 2338/2023 without treating it as law |
Where Grecta Fits
Brazil is a good illustration of why product compliance and organisational compliance are different problems.
An organisational compliance programme answers whether the company has a policy, a DPO, and a training record. It does not answer whether a specific credit scoring model operating in São Paulo has an Article 7 basis, falls within Article 20, needs an Article 38 impact report, and transfers training data to a jurisdiction requiring Brazilian SCCs. Those questions attach to the product, and they change when the product changes.
Grecta determines which obligations reach a product across the LGPD, the EU AI Act, GDPR, the Cyber Resilience Act, the GPSR and the other regimes in scope, then builds the infrastructure around each one: evidence bound to the obligation, recalculation when the law or the product changes, an audit trail of every evaluation, the reports each authority expects, and retention for as long as the obligation runs.
For Brazil specifically, that means the Article 20 position on each automated decision is documented rather than assumed, the impact report exists before the ANPD asks for it, and the transfer mechanism for each data flow is recorded against the jurisdiction it actually goes to. When PL 2338 is enacted, the obligations it adds map onto the same product record rather than requiring a separate exercise.
Book a Grecta demo to see how obligations are mapped to a specific product and what the evidence set looks like.
