Countries › Brazil › Guide › 13. Regulation › Personal data protection in Brazil (LGPD): legal bases, data subject rights, officer, breaches, transfers and how ANPD fines are calculated

Personal data protection in Brazil (LGPD): legal bases, data subject rights, officer, breaches, transfers and how ANPD fines are calculated

Argentina. For full detail on Argentina, go to The Argentine Thread.

Last verified: 2026-10-27 · Status: Changing

The LGPD applies to any company that processes data in Brazil, offers goods or services to people in Brazil or uses data collected here, wherever it is based. Each use of data needs a legal basis, access requests must be answered within 15 days, breaches reported within 3 business days, and transfers abroad need an approved mechanism such as the ANPD standard clauses. Fines reach 2 percent of Brazilian revenue, capped at R$50,000,000 per infraction, and the ANPD became a full regulatory agency in February 2026.

USD figures use the Banco Central do Brasil PTAX selling rate of R$5.3346 per US dollar for 27 October 2026. Conversions are for orientation only.

Key facts

Deadline for a complete response to a data subject access request	15 daysLei nº 13.709 art. 19 II, as of 2018-08-14 · in force
Period to supplement an incident notice to the ANPD	20 business daysResolução CD/ANPD nº 15/2024, as of 2024-04-24 · in force
Revenue above which a company loses the small processing agent relief (small company limit)	4800000 BRLResolução CD/ANPD nº 2/2022 art. 3 II; LC nº 123 art. 3 II, as of 2022-01-27 · in force
Fine reduction for waiving the appeal and paying on time	25 %Resolução CD/ANPD nº 4/2023 Annex art. 18, as of 2023-02-27 · in force
Deadline to pay an ANPD fine	20 business daysResolução CD/ANPD nº 4/2023 Annex art. 17, as of 2023-02-27 · in force
Maximum suspension of a processing activity, extendable once	6 monthsLei nº 13.709 art. 52 X and XI, as of 2019-12-20 · in force

The rule

1. The LGPD applies to processing by any individual or company, wherever headquartered or wherever the data is stored, when the processing takes place in Brazil, aims to offer or supply goods or services to individuals in Brazil, or concerns data collected in Brazil. It does not apply to purely private non economic processing, to exclusively journalistic, artistic or academic purposes (arts. 7 and 11 still apply to academic processing), to public security, defense and criminal investigation, or to data from abroad that is not shared with Brazilian agents or transferred to a third country, if the country of origin offers adequate protection.Lei nº 13.709 of 14 August 2018 (LGPD), Arts. 3 and 4, 2018-08-14 official text · verified 2026-10-27

2. Processing is lawful only on one of the legal bases of art. 7, such as consent, legal or regulatory obligation, performance of a contract, exercise of rights in proceedings, protection of life, health protection, legitimate interest or credit protection. Sensitive data (racial or ethnic origin, religion, political opinion, union membership, health, sex life, genetic or biometric data) may be processed only with specific and highlighted consent or where indispensable for a narrower list of purposes in art. 11, including legal obligations, exercise of rights and fraud prevention in identification and authentication. Children's data requires specific consent from a parent or guardian, with narrow exceptions.Lei nº 13.709 of 14 August 2018 (LGPD), Arts. 5 II, 7, 11 and 14 § 1, 2018-08-14 official text · verified 2026-10-27

3. Data subjects may obtain confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary or unlawful data, portability, deletion of consent based data, information on sharing and revocation of consent, free of charge. Confirmation or access must be given immediately in simplified form, or within 15 days of the request through a complete statement of origin, criteria and purpose.Lei nº 13.709 of 14 August 2018 (LGPD), Arts. 18 and 19 items I and II, 2018-08-14 official text · verified 2026-10-27

4. Controllers and processors must keep records of their processing operations, especially those based on legitimate interest. The ANPD may require a data protection impact report describing the data, collection and security methods and risk mitigation. The controller must appoint a data protection officer (encarregado), publish the officer's identity and contact details, preferably on its website, and have the officer handle complaints, ANPD communications and staff guidance.
Cost to do it: No registration fee; the cost is internal or outsourced compliance work.Lei nº 13.709 of 14 August 2018 (LGPD), Arts. 37, 38 and 41, 2018-08-14 official text · verified 2026-10-27

5. Small processing agents, which include micro and small companies, startups and non profit entities, are exempt from appointing an officer (they must still offer a communication channel), get double deadlines for data subject requests, incident notices to the ANPD and data subjects, and ANPD information requests, and may give the simplified access statement within 15 days. The relief is lost by agents that carry out high risk processing, have gross revenue above the small company limit of Lei Complementar nº 123 (R$4,800,000) or the startup limit, or belong to a group whose global revenue exceeds those limits. High risk means at least one general criterion (large scale, or significant effect on fundamental rights) plus one specific criterion (emerging technology, surveillance of public areas, solely automated decisions, or sensitive data or data of children, adolescents or the elderly).
Cost to do it: Officer exemption saves the cost of a dedicated function for qualifying small businesses.
Example: A software startup with R$3,000,000 of revenue that does not process data at high risk can skip the officer appointment; at R$5,000,000 of revenue it loses the relief. / About US$562,366 and US$937,277; the small company limit is about US$899,786.Resolução CD/ANPD nº 2 of 27 January 2022 (small agents regulation); Lei Complementar nº 123 of 14 December 2006, Res. nº 2 Annex arts. 2, 3, 4, 11, 14 and 15; LC nº 123 art. 3 II, 2022-01-27 official text · verified 2026-10-27

6. The controller must notify the ANPD and affected data subjects of a security incident that may cause relevant risk or damage within 3 business days, unless specific legislation sets another deadline (small agents get double the time), and may supplement the notice within 20 business days.
Cost to do it: Filing through the ANPD form is free; incident response and forensic work are the real cost.Lei nº 13.709 of 14 August 2018 (LGPD); Resolução CD/ANPD nº 15 of 24 April 2024, LGPD art. 48; Resolução nº 15 Annex arts. 6 and 9, 2024-04-24 official text · verified 2026-10-27

7. International transfers are allowed on the grounds in art. 33, including an ANPD adequacy decision and guarantees shown by the controller through specific contractual clauses, standard contractual clauses or global corporate rules. The Brazilian standard clauses are valid only if adopted in full, without changes, and controllers using contractual clauses had 12 months from publication on 23 August 2024 to incorporate them.Lei nº 13.709 of 14 August 2018 (LGPD); Resolução CD/ANPD nº 19 of 23 August 2024, LGPD art. 33; Resolução nº 19 Annex I arts. 1 and 16 and art. 2, 2024-08-23 official text · verified 2026-10-27

8. Controllers and processors that cause material, moral, individual or collective damage in breach of data protection law must compensate it. Processors are jointly liable when they breach the law or the controller's lawful instructions, and controllers directly involved are jointly liable. Courts may reverse the burden of proof in favor of the data subject, and collective actions are allowed.Lei nº 13.709 of 14 August 2018 (LGPD), Art. 42 §§ 1 to 4, 2018-08-14 official text · verified 2026-10-27

9. The ANPD may impose warnings, a simple fine of up to 2 percent of the revenue in Brazil of the private legal entity, group or conglomerate in its last fiscal year, net of taxes, capped at R$50,000,000 per infraction, daily fines within the same cap, publication of the infraction, blocking or deletion of data, partial suspension of the database or of the processing for up to 6 months extendable for 6 more, and partial or total prohibition of processing activities. Sanctions apply from 1 August 2021.
Cost to do it: Exposure up to 2 percent of Brazilian revenue, at most R$50,000,000 per infraction.
Example: A group with R$1,500,000,000 of Brazilian revenue net of taxes: 2 percent is R$30,000,000, below the cap. / About US$5,623,664 on revenue of about US$281,183,219; the cap is about US$9,372,774.Lei nº 13.709 of 14 August 2018 (LGPD), as amended by Lei nº 13.853 of 2019 and Lei nº 14.010 of 2020, Art. 52 items I to VI and X to XII; art. 65 item I-A, 2018-08-14 official text · verified 2026-10-27

10. The ANPD classifies infractions as light, medium or serious. Serious ones are medium infractions that also involve large scale processing, economic advantage, risk to life, sensitive data or data of children, adolescents or the elderly, processing without a legal basis, unlawful discrimination or systematic irregular practices, or any obstruction of inspection. Warnings are used for light or medium infractions without specific recidivism; simple fines for serious infractions or unmet corrective measures. The base value depends on the classification, revenue in the affected business line and degree of harm, and is increased by 10 percent per specific repeat offense (up to 40 percent), 5 percent per generic repeat (up to 20 percent), 20 percent per ignored preventive measure (up to 80 percent) and 30 percent per ignored corrective measure (up to 90 percent). It is reduced by 75, 50 or 30 percent for ceasing the infraction before a preparatory procedure, before the sanction proceeding or before the first instance decision, 20 percent for a good practices and governance program, 20 or 10 percent for mitigation, and 5 percent for cooperation. Waiving the appeal and paying within 20 business days gives a further 25 percent cut. The result never exceeds 2 percent of revenue or R$50,000,000 and, where the advantage can be estimated, is at least twice the advantage.
Cost to do it: Payment within 20 business days; late payment adds Selic interest and 0.33 percent per day up to 20 percent.
Example: A base fine of R$2,000,000 for a serious infraction with one ignored corrective measure (+30 percent) and a governance program (minus 20 percent) becomes R$2,200,000; waiving the appeal cuts it to R$1,650,000. / About US$374,911 becoming US$412,402, then US$309,302.Resolução CD/ANPD nº 4 of 24 February 2023 (Regulation on Dosimetry and Application of Administrative Sanctions), Annex arts. 8 to 13, 15, 17 and 18, 2023-02-24 official text · verified 2026-10-27

11. Lei nº 15.352 of 25 February 2026 turned the authority into the Agência Nacional de Proteção de Dados (ANPD), a special autarchy linked to the Ministry of Justice with functional, technical, decision making, administrative and financial autonomy under the regulatory agencies law (Lei nº 13.848 of 2019), and created a dedicated regulation and inspection career.Lei nº 15.352 of 25 February 2026, Arts. 1 (LGPD arts. 5 VIII and XIX and 55-A), 2 and 8, 2026-02-25 official text · verified 2026-10-27 · changed: Lei nº 15.352 of 25 February 2026 made the ANPD a regulatory agency with financial autonomy (LGPD art. 55-A) and added it to the regulatory agencies law.

Factor	Adjustment	Article
Specific recidivism	+10 percent each, up to +40 percent	Art. 12 I
Generic recidivism	+5 percent each, up to +20 percent	Art. 12 II
Ignored guidance or preventive measure	+20 percent each, up to +80 percent	Art. 12 III
Ignored corrective measure	+30 percent each, up to +90 percent	Art. 12 IV
Infraction ceased before preparatory procedure / before sanction proceeding / before first decision	minus 75 / 50 / 30 percent	Art. 13 I
Good practices and governance program	minus 20 percent	Art. 13 II
Mitigation of effects before / after preparatory procedure	minus 20 / 10 percent	Art. 13 III
Cooperation or good faith	minus 5 percent	Art. 13 IV
Waiver of appeal with payment in 20 business days	minus 25 percent of the fine applied	Art. 18

ANPD fine adjustments under Resolução CD/ANPD nº 4/2023 (applied to the base value; final fine capped at 2 percent of revenue or R$50,000,000).

Worked example

Foreign e commerce site. A company based abroad sells to consumers in Brazil and processes their data on servers abroad. The LGPD applies (art. 3 II). It needs a legal basis for each purpose, an officer, records of processing, the ANPD standard clauses or another art. 33 mechanism for transfers, and the ability to answer access requests within 15 days.
Fine math. A retailer with R$4,000,000,000 (about US$749,821,917) of Brazilian revenue suffers a breach of customer data processed without adequate security. If the ANPD imposes a fine, 2 percent would be R$80,000,000, so the R$50,000,000 (about US$9,372,774) cap per infraction applies (art. 52 II). Reporting within 3 business days and showing a governance program support mitigation (Resolução nº 4 art. 13 II).

Step by step

1. Map data flows of the Brazilian business: categories, purposes, legal bases, sharing and transfers abroad.
2. Check small agent status under Resolução nº 2 (revenue, group revenue and high risk criteria); otherwise appoint and publish the officer.
3. Keep processing records, and prepare impact reports for high risk or sensitive data processing.
4. Sign the ANPD standard clauses, adopted without changes, for transfers to the parent and vendors abroad.
5. Set up a data subject request channel able to answer within 15 days and an incident plan able to notify within 3 business days.
6. Train staff and document the governance program; it counts as a 20 percent mitigating factor in any fine.

Common traps

Assuming servers abroad avoid the LGPD. Location of the company or of the data does not matter (art. 3).
Editing the standard clauses. They are valid only if adopted in full and unchanged (Resolução nº 19 Annex I art. 16).
Using legitimate interest for sensitive data. It is not a basis for sensitive data under art. 11.
Counting group revenue wrongly. A small Brazilian subsidiary of a large group cannot use the small agent relief (Resolução nº 2 art. 3 III), and fines are calculated on group revenue in Brazil (art. 52 II).
Letting corrective orders slide. Each ignored corrective measure adds 30 percent to the fine (Resolução nº 4 art. 12 IV).

Sources

← Cartels and abuse of dominance in Brazil: CADE fines, leniency, settlements, criminal exposure and double damagesInternet platforms and children online in Brazil: Marco Civil log retention, platform liability after the 2025 Supreme Court ruling and the ECA Digital →