Regulationsby GlyphBrazil LGPD
In force Brazil · In force Sep 18, 2020 · no upcoming deadlines
Deadlines
Deadline to adopt ANPD standard contractual clausesAgents relying on contractual clauses for international transfers must incorporate the ANPD-approved SCCs into their contracts within 12 months of publication.
International transfer regulation publishedResolution CD/ANPD 19/2024 on international transfers and standard contractual clauses published and in force.
ANPD sanctions enforceableAdministrative sanctions (Arts. 52-54) become applicable per Law 14.010/2020.
LGPD in forceMain LGPD provisions take effect.
Summaries for reference, not legal advice. Check the official text.
What it does
Brazil's GDPR-style general data protection law: ten legal bases, data subject rights, DPO (encarregado), incident reporting and international transfer rules. ANPD's Resolution CD/ANPD 19/2024 set the international transfer regime and mandatory standard contractual clauses.
- Who it applies to
- Any processing carried out in Brazil, targeting individuals in Brazil, or of data collected in Brazil, regardless of the controller's location. Simplified rules for small-scale agents (Resolution CD/ANPD 2/2022).
- Penalties
- Fines up to 2% of the company's/group's revenue in Brazil in the prior fiscal year, capped at BRL 50 million per infraction; daily fines; publicisation; blocking or deletion of data; suspension of processing.
- Enforced by
- Autoridade Nacional de Proteção de Dados (ANPD)
- Official name
- Lei Geral de Proteção de Dados Pessoais (Law No. 13.709/2018)
- Citation
- Lei nº 13.709, de 14 de agosto de 2018
- Topics
- Privacy, Breach notification, Data residency
Research notes
In 2025 the ANPD was restructured into a regulatory agency (MP 1.317/2025); not separately verified.
Related
Alberta POPAReplaces the privacy part of Alberta's FOIP Act for public bodies. It adds mandatory breach notification where there is a real risk of significant harm, privacy management programs, privacy impact assessments, rules for creating and using non-personal data, and notice when personal information will be fed into automated systems. It also bans selling personal information and adds large offence fines.In effect since Jun 11, 2025Argentina Law 25.326Argentina's habeas data and personal data protection law. It covers consent, data quality, sensitive data, security and confidentiality, international transfers to countries with adequate protection, and access, rectification and deletion rights. Argentina holds EU adequacy status based on this law.No date set
Brazil AI Bill (PL 2338/2023)Risk-based AI framework inspired by the EU AI Act: prohibited (excessive-risk) uses, high-risk system obligations, algorithmic impact assessments, rights for affected persons and copyright remuneration provisions, coordinated by a national AI regulation system (SIA) led by the ANPD.No date setBrazil ECA DigitalRequires digital products and services likely to be accessed by children and adolescents to apply protection by design and default, reliable age verification, parental supervision tools, links between under-16 accounts and guardians, and swift removal of harmful content; bans profiling-based advertising to children and loot boxes in games for minors.In effect since Mar 17, 2026
Canada Bill C-36 (PPCDA)Would replace PIPEDA's private-sector rules with a modernised statute (successor to C-27's CPPA) including stronger consent, de-identification and re-identification rules, and administrative penalties, with oversight housed in a new Digital Safety and Data Protection Commission. Does not include an AI act.No date setCanada Bill C-8 / CCSPARequires designated operators in federally regulated critical sectors to establish cyber security programs, mitigate supply-chain risks, report cyber incidents and comply with government cyber security directions; also amends the Telecommunications Act to let government order telecom providers to secure their networks.No date setChile Personal Data Protection Law (Ley 21.719)Replaces Chile's 1999 data law with a GDPR-style regime: legal bases, data subject rights (including portability and objection to automated decisions), security and breach notification, international transfer rules, a voluntary compliance (crime-prevention-style) model, and a new independent Personal Data Protection Agency.Next: Dec 1 Law in force · in 35 daysMexico LFPDPPP 2025New federal private-sector data protection law replacing the 2010 law after the dissolution of INAI; keeps the ARCO rights and privacy-notice model, broadens the personal data definition and moves enforcement to the Secretaría Anticorrupción y Buen Gobierno.In effect since Mar 21, 2025
Questions about Brazil LGPD
- What are the Brazil LGPD compliance deadlines?
- Sep 18, 2020: LGPD in force. Aug 1, 2021: ANPD sanctions enforceable. Aug 23, 2024: International transfer regulation published. Aug 23, 2025: Deadline to adopt ANPD standard contractual clauses.
- When does Brazil LGPD take effect?
- Brazil LGPD took effect on Sep 18, 2020.
- Who does Brazil LGPD apply to?
- Any processing carried out in Brazil, targeting individuals in Brazil, or of data collected in Brazil, regardless of the controller's location. Simplified rules for small-scale agents (Resolution CD/ANPD 2/2022).
- What are the penalties under Brazil LGPD?
- Fines up to 2% of the company's/group's revenue in Brazil in the prior fiscal year, capped at BRL 50 million per infraction; daily fines; publicisation; blocking or deletion of data; suspension of processing.