LGPD Compliance: Brazil's Data Protection Law

LGPD Compliance: A Guide to Brazil's Data Protection Law

The LGPD (Lei Geral de Proteção de Dados Pessoais, Law No. 13.709/2018) is Brazil's General Data Protection Law, the country's first comprehensive privacy law. It has been in force since September 2020, its administrative sanctions have applied since 1 August 2021, and it is enforced by the ANPD, Brazil's national data protection authority. Any business that processes personal data of people in Brazil, including websites that set tracking cookies for Brazilian visitors, needs a plan for LGPD compliance.

What Is the LGPD?

The LGPD sets the rules for collecting, using, storing and sharing personal data in Brazil. It is closely modelled on the EU GDPR: it defines controllers and processors, requires a legal basis for every processing activity, gives individuals ("titulares") enforceable rights, and lets the regulator issue fines and other sanctions.

Who Does the LGPD Apply To?

Article 3 gives the LGPD extraterritorial reach. It applies to any processing by an individual or a public or private organization, wherever the organization is based or the data is stored, when:

1. The processing takes place in Brazil;
2. The purpose is to offer or supply goods or services to, or to process the data of, individuals located in Brazil; or
3. The personal data was collected in Brazil (data is treated as collected in Brazil if the person was in Brazil at the time of collection).

In practice, an online store, SaaS product, publisher or app outside Brazil that targets or tracks Brazilian users falls within scope. The law does not apply to purely personal, non-economic processing, or to processing solely for journalistic, artistic or academic purposes, public safety or national defence (Article 4).

The 10 Legal Bases for Processing Under the LGPD

Article 7 lists ten legal bases (hipóteses). You need at least one for each purpose:

1. Consent of the data subject
2. Compliance with a legal or regulatory obligation
3. Execution of public policies by the public administration
4. Studies by research bodies, with anonymization where possible
5. Performance of a contract, or preliminary steps to a contract, at the data subject's request
6. Regular exercise of rights in judicial, administrative or arbitration proceedings
7. Protection of the life or physical safety of the data subject or a third party
8. Protection of health, by health professionals, health services or health authorities
9. Legitimate interests of the controller or a third party, unless the data subject's fundamental rights prevail
10. Protection of credit

Sensitive personal data, such as health, biometric, religious, political or ethnic data, has a narrower list of bases under Article 11.

LGPD Consent Requirements and Cookies

What valid consent looks like

The LGPD defines consent as a free, informed and unambiguous expression of will for a specific purpose. Article 8 adds that:

• Consent must relate to specific purposes. Generic authorizations are void.
• The controller carries the burden of proving that consent was obtained correctly.
• Consent can be withdrawn at any time, free of charge, through an easy procedure.
• Sharing data with other controllers on the basis of consent needs specific consent for that sharing.

Does the LGPD require cookie consent?

Cookies that identify or can identify a person, such as advertising, tracking and many analytics cookies, are personal data processing under the LGPD. In October 2022 the ANPD published its guidance on cookies and personal data protection (Guia Orientativo: Cookies e Proteção de Dados Pessoais). According to that guidance:

• Strictly necessary cookies do not need consent; legitimate interest can be an appropriate basis.
• Non-necessary cookies (advertising, profiling and similar) should generally rely on consent. Legitimate interest is unlikely to be appropriate where cookie data is used for advertising.
• Analytics cookies, such as audience measurement, may in some cases rely on legitimate interest, after a careful assessment.
• Good practice is a clearly visible button to reject all non-necessary cookies in both the first-layer banner and the second-layer settings.
• Practices to avoid include making use of the site conditional on accepting all cookies, and failing to offer a simple way to withdraw consent.

For most websites, the safe approach is a cookie banner in Portuguese that blocks non-essential cookies until the visitor opts in, offers "Accept all" and "Reject all" with equal prominence, and lets the visitor change their choice later.

Data Subject Rights Under the LGPD

Article 18 gives individuals the right to:

• Confirmation that their data is being processed
• Access to their data
• Correction of incomplete, inaccurate or out-of-date data
• Anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data
• Portability to another provider
• Deletion of data processed on the basis of consent
• Information about the public and private entities the data was shared with
• Information about the option to refuse consent and its consequences
• Withdrawal of consent

They may also object to processing based on a legal basis other than consent if the law is breached, and request review of decisions made solely by automated processing (Article 20).

Response times: Under Article 19, confirmation of processing or access must be provided immediately in a simplified format, or within 15 days of the request as a clear and complete declaration. Requests must be handled free of charge. A DSAR workflow or self-service privacy portal helps you meet these deadlines and keep a record of every request.

Is a DPO (Encarregado) Required Under the LGPD?

Article 41 requires controllers to appoint an encarregado, the LGPD's equivalent of a Data Protection Officer (DPO). Their identity and contact details must be published, preferably on the controller's website. The encarregado receives complaints from data subjects, handles communications from the ANPD and guides staff on data protection practices.

The ANPD has eased this duty for smaller organizations:

• Resolution CD/ANPD No. 2/2022 exempts small processing agents (micro and small businesses, startups and similar entities) from appointing an encarregado, as long as they offer a channel for data subjects to contact them. The relief does not apply to high-risk processing.
• Resolution CD/ANPD No. 18/2024, the DPO Regulation, confirms the appointment is mandatory for other controllers, optional for small processing agents and processors, and requires a formal written appointment.

International Data Transfers

Article 33 only allows personal data to leave Brazil under specific mechanisms, such as an adequacy decision, standard contractual clauses, specific contractual clauses, global corporate rules, or specific and highlighted consent.

Resolution CD/ANPD No. 19/2024 (August 2024) approved the International Data Transfer Regulation and Brazil's own standard contractual clauses (SCCs). Organizations had until 23 August 2025 to put the ANPD clauses into their contracts. Since then, contractual transfers are valid only with the ANPD SCCs or specific clauses approved by the ANPD. EU SCCs alone are not enough for transfers out of Brazil.

Data Breach Notification

Article 48 requires controllers to notify the ANPD and affected individuals of a security incident that may cause relevant risk or harm. Resolution CD/ANPD No. 15/2024 (April 2024), the Security Incident Reporting Regulation, sets the deadline at 3 business days from when the controller learns the incident affected personal data. Small processing agents get double the time. All incidents, including those not reported, must be recorded and the records kept for at least five years.

LGPD Penalties and Fines

Under Article 52, the ANPD can impose:

• A warning, with a deadline for corrective measures
• A simple fine of up to 2% of the revenue of the company, group or conglomerate in Brazil in its last financial year, excluding taxes, capped at R$50 million per infraction
• A daily fine, subject to the same cap
• Publication of the infraction
• Blocking or deletion of the personal data involved
• Partial suspension of the database, or suspension of the processing activity, for up to six months (extendable once)
• Partial or total prohibition of data processing activities

Sanctions are applied after an administrative procedure, taking into account the seriousness of the infraction, good faith, cooperation and the measures the organization had adopted.

LGPD vs GDPR: Key Differences

If you already comply with the GDPR, you have a strong base, but you still need Portuguese-language notices, the Brazilian SCCs, an encarregado, and processes for the shorter LGPD deadlines. See our global privacy laws overview for how other countries compare.

LGPD Compliance Checklist for Websites

1. Map your data. List the personal data, cookies and third-party tags your website and apps collect, with the purpose and legal basis for each.
2. Scan and classify cookies. Group cookies into necessary, analytics, functional and advertising categories.
3. Deploy a consent banner in Portuguese. Block non-essential cookies before consent, and give "Accept all" and "Reject all" equal prominence.
4. Store proof of consent. Keep consent records with timestamp, choices and banner version, because the controller bears the burden of proof.
5. Make withdrawal easy. Offer a persistent link or preference centre where visitors can change their choice at any time.
6. Update your privacy notice. Explain purposes, legal bases, data sharing, international transfers, retention, rights and how to contact the encarregado.
7. Appoint an encarregado (or confirm your small-agent exemption) and publish their contact details.
8. Set up a rights request process that meets the immediate and 15-day deadlines.
9. Review vendor and transfer contracts. Add the ANPD standard contractual clauses for data leaving Brazil.
10. Prepare an incident response plan that can notify the ANPD and data subjects within 3 business days, and keep an incident register.

How UniConsent Helps You Comply With the LGPD

UniConsent is a consent management platform built to help websites and apps meet LGPD requirements quickly:

• Cookie banner in Brazilian Portuguese, matched automatically to the visitor's language, with geo-targeting to apply the right rules to visitors in Brazil.
• Prior blocking of scripts and cookies until the visitor gives consent, with automatic cookie scanning and categorization.
• Accept all and Reject all options in the first layer, in line with ANPD good practice.
• Consent logs that record each visitor's choices, so you can prove valid consent to the ANPD.
• Preference centre where visitors can review and withdraw consent at any time.
• Privacy portal and DSAR management to receive, track and answer data subject requests within LGPD deadlines.
• Google Consent Mode v2 and IAB TCF support, so your analytics and advertising keep working with consent signals.

One tag covers the LGPD, the GDPR, US state privacy laws and 40+ other regulations. Start free and launch an LGPD-ready cookie banner in minutes.