LGPD Compliance Guide (2026): Brazil's Data Protection Law Explained

Who it applies to

• Controllers (controladores) and operators (operadores) of any size, sector, or legal form, including government bodies. The territorial tests are in Art. 3: processing in Brazil, offering goods or services to people in Brazil, or processing data of individuals located there.
• Small processing agents follow a simplified regulation, Resolution CD/ANPD 2/2022 (ANPD regulations).

Key requirements

Legal bases (Art. 7)

The law lists the bases, which include:

• consent
• legal or regulatory obligation
• public policy execution by public administration
• research bodies, anonymised where possible
• contract performance
• exercise of rights in proceedings
• protection of life
• health protection
• legitimate interests
• credit protection

Sensitive data has a narrower list (Art. 11) (LGPD).

Data subject rights (Art. 18)

• confirmation that processing exists
• access
• correction
• anonymisation, blocking or deletion of unnecessary or unlawful data
• portability
• deletion of data processed under consent
• information about sharing
• information about refusing consent and its consequences
• withdrawal of consent

Governance

• Records of processing (Art. 37). Both controllers and operators must keep them, "especially when based on legitimate interest."
• Data protection impact report (RIPD, Art. 38). The ANPD can require one. At a minimum it describes the data types, the collection method, the security methodology, and the mitigations.
• Encarregado (Art. 41).
• The controller must appoint one and publish their identity and contact details, preferably on its website.
• Duties: receive complaints from data subjects, receive communications from the ANPD, and guide staff.
• Resolution CD/ANPD 18/2024 regulates the role.
• Security (Art. 46). Technical and administrative measures protecting against unauthorised access, loss, or unlawful processing, applied "from the design phase of the product or service through to its execution."

Incident notification (Art. 48 and Resolution 15/2024)

When to notify. Notify the ANPD and affected data subjects when an incident meets all three conditions:

• it's confirmed
• it involves personal data subject to the LGPD
• it may cause relevant risk or harm

Deadline. The deadline is three business days, unless a sector-specific law sets a different one. If information is incomplete, a preliminary notice can be followed by supplementary information within 20 business days (ANPD).

How. The encarregado or a legal representative files through the SEI!ANPD system.

Notifying data subjects. The ANPD stresses that notifying it alone does not satisfy Art. 48. Data subjects must also be told, in plain language, about:

• the data affected
• the risks
• the mitigations
• the date the incident became known
• a contact point

Processors must inform the controller without undue delay.

International transfers

Art. 33 permits transfers on the following grounds (LGPD):

• adequacy
• specific clauses
• standard contractual clauses
• global corporate rules
• seals and certifications
• other listed grounds

Resolution CD/ANPD 19/2024 put these into practice (ANPD transfers):

• Standard contractual clauses (Annex II) must be used without modification. The 12-month adoption window ended in August 2025.
• Adequacy. The European Union was recognised as adequate by Resolution 32 of 26 January 2026 (ANPD regulations). Adequacy decisions issued by other countries don't count in Brazil.
• No other mechanisms approved yet. As of the page, no equivalent foreign clauses, specific clauses, or global corporate rules had been approved.

Penalties (Art. 52)

The ANPD can impose these sanctions (LGPD):

• a warning with a deadline for corrective action
• a simple fine of up to 2% of the revenue of the company, group or conglomerate in Brazil in its last financial year, net of taxes, limited to R$50,000,000 per infraction
• daily fines, subject to the same cap
• publication of the infraction
• blocking or deletion of the personal data concerned

The sanction articles took effect on 1 August 2021 (Art. 65). Resolution 4/2023 sets how fines are calculated (ANPD regulations).

Certification

There's no LGPD certification. Art. 33 does recognise "seals, certificates and codes of conduct" as transfer tools, but the ANPD hasn't approved any.

Mapping to related frameworks

ISO/IEC 27001 and 27701 controls help evidence Art. 46 security and governance.

Readiness checklist

1. Confirm scope under Art. 3, and check whether the small-agent regulation applies.
2. Build a record of processing and assign a legal basis to each activity. Run legitimate interest assessments.
3. Appoint and publish the encarregado.
4. Set up a rights request channel covering all Art. 18 rights.
5. Prepare RIPD templates for high-risk and sensitive data processing.
6. Write a playbook for incidents: the three-business-day notice, SEI!ANPD filing, data subject letters, and processor clauses.
7. Inventory transfers. Embed the ANPD SCCs unchanged, or rely on EU adequacy where it applies.
8. Implement security by design and document the measures.
9. Train staff and keep the evidence.

Common pitfalls

• Relying on EU SCCs for transfers out of Brazil. The ANPD requires its own clauses.
• Notifying only the ANPD. Affected data subjects must also be told.
• Treating the encarregado as optional. Art. 41 requires one, unless a regulation exempts you.
• Treating three business days as starting from the end of the investigation. File a preliminary notice and supplement it later.
• Editing the standard clauses. They must be used without modification.

How AssureCore helps

• The Risk Register and Policy Management (AI-assisted writing and gap analysis) support RIPDs and policies.
• Evidence Management, with control linking and expiry alerts, keeps SCCs and records current.
• Cross-framework Mapping reuses GDPR and ISO 27001 controls for the LGPD.

Frequently asked questions

Official references

• Lei nº 13.709/2018 (LGPD) – Planalto
• ANPD – Regulamentações da ANPD
• ANPD – Comunicação de Incidente de Segurança
• ANPD – Transferência Internacional de Dados

Related frameworks

• GDPR guide
• UK GDPR guide
• CCPA guide
• HIPAA guide