Brazil LGPD
In force Brazil · In force Sep 18, 2020 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Brazil's GDPR-style general data protection law: ten legal bases, data subject rights, DPO (encarregado), incident reporting and international transfer rules. ANPD's Resolution CD/ANPD 19/2024 set the international transfer regime and mandatory standard contractual clauses.
- Who it applies to
- Any processing carried out in Brazil, targeting individuals in Brazil, or of data collected in Brazil, regardless of the controller's location. Simplified rules for small-scale agents (Resolution CD/ANPD 2/2022).
- Penalties
- Fines up to 2% of the company's/group's revenue in Brazil in the prior fiscal year, capped at BRL 50 million per infraction; daily fines; publicisation; blocking or deletion of data; suspension of processing.
- Enforced by
- Autoridade Nacional de Proteção de Dados (ANPD)
- Official name
- Lei Geral de Proteção de Dados Pessoais (Law No. 13.709/2018)
- Citation
- Lei nº 13.709, de 14 de agosto de 2018
- Topics
- privacy, breach-notification, data-residency
Research notes
In 2025 the ANPD was restructured into a regulatory agency (MP 1.317/2025); not separately verified.
Related
Questions about Brazil LGPD
- What are the Brazil LGPD compliance deadlines?
- Sep 18, 2020: LGPD in force. Aug 1, 2021: ANPD sanctions enforceable. Aug 23, 2024: International transfer regulation published. Aug 23, 2025: Deadline to adopt ANPD standard contractual clauses.
- When does Brazil LGPD take effect?
- Brazil LGPD took effect on Sep 18, 2020.
- Who does Brazil LGPD apply to?
- Any processing carried out in Brazil, targeting individuals in Brazil, or of data collected in Brazil, regardless of the controller's location. Simplified rules for small-scale agents (Resolution CD/ANPD 2/2022).
- What are the penalties under Brazil LGPD?
- Fines up to 2% of the company's/group's revenue in Brazil in the prior fiscal year, capped at BRL 50 million per infraction; daily fines; publicisation; blocking or deletion of data; suspension of processing.