LGPD (Brazil)
Also known as: LGPD, Lei Geral de Proteção de Dados, Brazilian General Data Protection Law, Brazil data protection law
The LGPD (Lei Geral de Proteção de Dados) is Brazil's general data protection law, modelled closely on Europe's GDPR.
It applies to any organization that processes personal data of people in Brazil or offers goods and services there. While it borrowed GDPR's structure, it added more legal bases for processing and a fine cap that's lower than GDPR's, which says a lot about how Brazil balanced protection with business concerns.
LGPD (Brazil), explained at three levels
At home
Think of the LGPD as a permission slip system for your data in Brazil. A company can only use your personal data if it fits one of the reasons the law allows, such as your consent, a contract with you, or a legal duty. You can see what it holds, correct it, have unnecessary data deleted, and find out who it was shared with.
At work
The LGPD is Brazil's general data protection law, closely modelled on GDPR. It covers any organization that processes personal data in Brazil, offers goods or services to people there, or collects data there, even if the company is based abroad. Businesses care because it requires a legal basis for every use of data, a named data protection officer, incident reporting, and controls on transfers out of Brazil.
At home
The LGPD's engine is its list of ten legal bases. Every use of your data must fit one, such as consent, performing a contract, a legal obligation, protecting life, health care, research, legitimate interest, or credit protection, which reflects how central credit scoring is in Brazil. Sensitive data, like health, religion, biometrics, or political opinions, has a shorter and stricter list. You can also ask for a review of decisions made solely by automated processing.
At work
Organizations act as controllers, which decide how data is used, or operators, which process it on their behalf. Controllers must appoint an encarregado, the LGPD's data protection officer, keep records of processing, produce impact reports when the ANPD asks, and report serious security incidents to the ANPD and affected people within three business days under its 2024 regulation. Transfers abroad need a mechanism such as the ANPD's standard contractual clauses, or adequacy, which Brazil and the EU granted each other in January 2026.
At home
Penalties under the LGPD range from warnings to fines of up to 2% of a company's revenue in Brazil, capped at 50 million reais per violation, plus orders to block or delete data and suspend processing. That cap is far below GDPR's 4% of global turnover. While the cap limits the deterrent for large multinationals, in my opinion suspension orders and lawsuits are the real pressure, because stopping a data operation in Brazil can cost far more than any fine.
At work
The LGPD is enforced on several fronts. The ANPD supervises and fines, but consumer protection agencies, public prosecutors, and courts also act, and Brazilian courts can award damages, including collective damages. That makes outcomes harder to predict than under a single regulator. Multinationals usually extend their GDPR program to Brazil, then adjust for local differences: the three-business-day incident deadline, the encarregado's role, ANPD-approved transfer clauses, and Portuguese-language notices.
Real-world examples
At home
Nadia, living in São Paulo, kept getting calls from a telemarketing firm she'd never heard of. Using her LGPD rights, she asked the company where it got her data. It couldn't name a valid source, and she filed a complaint with the ANPD.
At work
Carlos manages compliance at a Canadian online education company expanding into Brazil. His team appointed an encarregado, translated privacy notices into Portuguese, and signed the ANPD's standard contractual clauses with their cloud provider before launch.
How it compares
| feature | LGPD (Brazil) | GDPR |
|---|---|---|
| Legal bases | Ten, including credit protection | Six |
| Maximum fine | 2% of Brazilian revenue, capped at R$50 million per violation | 4% of global turnover or €20 million |
| Regulator | ANPD, plus consumer agencies and courts | National data protection authorities |
| DPO requirement | Generally required, with exceptions for small entities | Required in specific cases |
| In force | September 2020 | May 2018 |
The LGPD is a close cousin of GDPR with Brazilian adaptations and lower fines.
For analysts
For companies expanding into Brazil, I'd budget for local legal review rather than assuming GDPR compliance covers everything. The overlap is large, but the enforcement landscape, with courts and consumer agencies involved, is very different.
History & origin
Brazil enacted the LGPD as Law No. 13.709 on August 14, 2018, a few months after GDPR took effect. After delays and political wrangling, the law came into force on September 18, 2020, and its administrative sanctions became enforceable on August 1, 2021. The national data protection authority, ANPD, was created in 2019 and later became an independent agency. The ANPD has since issued regulations on small businesses, sanctions, international transfers, and breach reporting, and its first fine landed in 2023 against a small telemarketing company. In my view, the LGPD's importance is less about enforcement so far and more about signal: Latin America's largest economy adopted the European model rather than the American one. That bet paid off in January 2026, when Brazil and the EU adopted mutual adequacy decisions.