Brazil's Lei Geral de Proteção de Dados (LGPD, Lei 13.709/2018) applies to any organisation that processes personal data of people in Brazil, wherever that organisation is based, and its regulator now enforces it with a three working day breach notification rule. Treating it as "GDPR in Portuguese" misses what catches organisations out: ten legal bases, binding ANPD regulations on incidents, transfers and sanctions, and a regulator that became a full agency in 2026. This guide covers scope, obligations, current status as of October 2026, enforcement, what the law means for AI agents and machine identities, and a phased compliance plan. It is for security, privacy and engineering leads supporting Brazilian processing. For the cross-jurisdiction picture, see the Global Privacy Regulatory Map.
Key takeaways
- Extraterritorial by design: Art. 3 applies the LGPD when processing happens in Brazil, when the aim is to offer goods or services to people in Brazil, or when the data was collected in Brazil, regardless of where the controller sits.
- Three working days to notify: Resolution CD/ANPD 15/2024 requires controllers to tell the ANPD and affected data subjects within 3 working days of learning that an incident with relevant risk or damage affected personal data.
- Authentication data is a trigger: an incident involving system authentication data is one of the listed criteria for relevant risk, so leaked passwords, tokens and keys tied to personal data are squarely in scope.
- Fines are per infraction: Art. 52 caps a simple fine at 2% of the group's revenue in Brazil in its last financial year, up to R$50 million per infraction, with daily fines, publicity, blocking and processing suspensions also available.
- The regulator is stronger now: Lei 15.352/2026 turned the ANPD into the Agência Nacional de Proteção de Dados, a special autarquia with financial and decision-making autonomy and new duties under the ECA Digital children's statute.
Scope: who and what is covered
The LGPD governs processing of personal data, online or offline, by individuals and by public or private entities (Art. 1). Personal data is information related to an identified or identifiable natural person (Art. 5, I). There is no turnover threshold for applicability, although small processing agents get lighter procedural treatment in some ANPD regulations.
| Element | LGPD position | Article |
|---|---|---|
| Territorial reach | Processing in Brazil, offering goods or services to people in Brazil, or data collected in Brazil | Art. 3 |
| Exclusions | Purely personal non-economic use; exclusively journalistic, artistic or academic purposes; exclusively public security, national defence, state security or criminal investigation; certain foreign data not shared with Brazilian agents | Art. 4 |
| Sensitive data | Racial or ethnic origin, religious belief, political opinion, union membership, health, sex life, genetic or biometric data | Art. 5, II |
| Controller (controlador) | The party that makes the decisions about processing | Art. 5, VI |
| Operator (operador) | The party that processes on the controller's behalf (the GDPR "processor") | Art. 5, VII |
| Encarregado | The person appointed as the channel between the agents, data subjects and the ANPD (definition amended by Lei 15.352/2026) | Art. 5, VIII; Art. 41 |
Scope boundary: sector rules and the Marco Civil da Internet sit alongside the LGPD and can set different deadlines, which Resolution 15/2024 respects.
Key obligations
Legal bases
Art. 7 lists ten bases for processing ordinary personal data. Two have no direct GDPR equivalent and matter in practice.
| Art. 7 basis | Typical security or IT use | Watch point |
|---|---|---|
| I. Consent | Marketing, optional analytics | Must be revocable (Art. 18); avoid it for core security processing |
| II. Legal or regulatory obligation | Retention required by sector rules, ANPD incident records | Name the specific rule in the record of processing |
| V. Performance of a contract | Account management, customer authentication | Covers what the contract needs, not every telemetry stream |
| VI. Exercise of rights in proceedings | Forensic evidence preservation, litigation holds | Scope the hold; release when proceedings end |
| IX. Legitimate interests | Security monitoring, fraud analytics, log retention | Art. 37 requires records of processing, especially when this basis is used; balance against the data subject's fundamental rights |
| X. Credit protection | Credit scoring and bureau checks | Specific to Brazil; does not cover general fraud analytics on its own |
The other four bases are public policy execution by public administration, research bodies, protection of life or physical safety, and health protection by health professionals or authorities. Sensitive data has its own narrower list under Art. 11, which requires specific and highlighted consent or one of the listed purposes. Art. 11 allows sensitive data processing without consent where it is indispensable for fraud prevention and the security of the data subject in identification and authentication processes. Biometric login therefore has a route, but it still needs to be documented and proportionate.
Rights, records and governance
- Data subject rights (Art. 18): confirmation, access, correction, anonymisation, blocking or deletion, portability, information on sharing, and revocation of consent.
- Automated decisions (Art. 20): data subjects may ask for review of decisions taken solely on automated processing that affect their interests, including profiling, and can request clear information on the criteria used, subject to trade secrets. The ANPD may audit for discriminatory effects.
- Records of processing (Art. 37): both controllers and operators must keep records of processing operations.
- Impact report, RIPD (Art. 38): the ANPD may require a Relatório de Impacto à Proteção de Dados Pessoais describing data types, collection methods, security measures and risk mitigation. Keep one ready for high-risk processing rather than writing it on demand. See the DPIA Guide.
- Encarregado (Art. 41 and Resolution CD/ANPD 18/2024): appointed by formal act; can be an employee, an external individual or a legal entity; must communicate with data subjects and the ANPD clearly and in Portuguese; identity and contact details must be published prominently on the website. Combining the role with strategic decisions about processing can create a conflict of interest that the ANPD assesses case by case.
- Governance programme (Art. 50): optional, but adopting it is a mitigating factor in sanctions dosimetry.
Security measures and incidents
Art. 46 requires processing agents to adopt technical and administrative security measures to protect personal data, from the design stage onwards, and lets the ANPD set minimum technical standards. Art. 47 makes the duty continue after processing ends, and Art. 49 requires systems to meet security and governance standards. The LGPD does not list controls, so the practical benchmark is a recognised framework mapped to your processing (see the mapping table below).
Art. 48 requires the controller to notify the ANPD and the data subject of incidents that may cause relevant risk or damage. Resolution CD/ANPD 15/2024 (dated 24 April 2024, published 26 April 2024) turned "reasonable time" into concrete rules:
| Requirement | Resolution 15/2024 rule |
|---|---|
| Threshold | Incident that may significantly affect data subjects' fundamental interests or rights AND involves at least one of: sensitive data; data of children, adolescents or the elderly; financial data; system authentication data; data protected by legal, judicial or professional secrecy; large-scale data |
| Notice to ANPD | 3 working days from the controller learning that the incident affected personal data, unless specific legislation sets another period |
| Supplementary information | May be provided, with justification, within 20 working days of the notice |
| Notice to data subjects | 3 working days, in plain language, individually where they can be identified; otherwise public channels kept visible for at least three months |
| Small processing agents | Deadlines doubled; small-agent status must be declared in the notice |
| ANPD notice contents | Nature and categories of data, number of data subjects (including children, adolescents, elderly), measures before and after, risks, reasons for delay, mitigation, incident and awareness dates, encarregado contact, description and root cause if known |
| Incident record | Every incident, including those not notified, kept for at least five years, with the risk assessment and the reasons for not notifying |
The five-year record covers incidents you decided not to report. The ANPD can request it at any time and can open a verification procedure on its own initiative. For a multi-jurisdiction notification workflow, see the Data Breach Notification Checklist and the Breach Notification Laws by Country Guide.
International transfers
Art. 33 permits transfers to adequate countries, under safeguards (specific clauses, standard clauses, global corporate rules, certifications and codes of conduct) and in listed cases such as specific consent or international legal cooperation. Resolution CD/ANPD 19/2024, published on 23 August 2024, approved the International Data Transfer Regulation and Brazil's standard contractual clauses:
- Standard clauses must be adopted in full and unaltered, either in a dedicated transfer contract or in a broader agreement or amendment.
- Existing contracts had up to 12 months from publication to move onto the standard clauses.
- Specific clauses are only for duly proven exceptional circumstances and need ANPD approval.
- Global corporate rules cover intra-group transfers and must be tied to a governance programme meeting Art. 50 minimum conditions.
- Transparency: publish a Portuguese-language page describing the transfer, destination country, purpose and security measures, and provide the full clauses to a data subject on request within 15 days.
Check that each foreign vendor's data processing agreement includes the Brazilian clauses verbatim; a GDPR SCC annex does not substitute.
Timeline and current status
| Date | Event |
|---|---|
| 14 August 2018 | Lei 13.709/2018 enacted |
| September 2020 | Main obligations in force |
| 1 August 2021 | Administrative sanctions (Arts. 52-54) enforceable |
| 27 February 2023 | Resolution CD/ANPD 4/2023, dosimetry and sanctions regulation, published |
| 26 April 2024 | Resolution CD/ANPD 15/2024, security incident communication regulation, published |
| 17 July 2024 | Resolution CD/ANPD 18/2024 on the encarregado published |
| 23 August 2024 | Resolution CD/ANPD 19/2024, international transfers and standard clauses, published |
| 25 February 2026 | Lei 15.352/2026 published: the ANPD becomes the Agência Nacional de Proteção de Dados |
| 17 March 2026 | ECA Digital (Lei 15.211/2025), regulated by the ANPD, takes effect |
Status as of October 2026: the LGPD is in force as amended, most recently by Lei 15.352/2026. The ANPD has announced a revision of the dosimetry regulation (Resolution 4/2023) and of the inspection and sanctioning process regulation (Resolution CD/ANPD 1/2021) so that they also cover the ECA Digital and recent Marco Civil da Internet decrees, and has consulted on a draft enforcement regulation. Until revised texts are published, Resolution 4/2023 remains the applicable method. Check gov.br/anpd before relying on any figure in this table for a filing.
Enforcement and penalties
Art. 52 sanctions, applied after an administrative process:
| Sanction | Detail |
|---|---|
| Warning | With a deadline for corrective measures |
| Simple fine | Up to 2% of revenue of the private entity, group or conglomerate in Brazil in its last financial year, excluding taxes, capped at R$50 million per infraction |
| Daily fine | Within the same overall cap |
| Publicity | Publication of the infraction once confirmed |
| Blocking | Personal data affected blocked until regularised |
| Deletion | Of the personal data to which the infraction relates |
| Partial database suspension | Up to 6 months, extendable |
| Processing suspension | Up to 6 months, extendable |
| Prohibition | Partial or total ban on processing activities |
Resolution CD/ANPD 4/2023 sets how fines are calculated. Infractions are classified as leve (minor, the residual category), média (medium, significantly affecting data subjects' rights, for example by blocking a service or causing material or moral harm) or grave (serious, adding factors such as large-scale processing, economic advantage, risk to life, sensitive or children's data, processing without a legal basis or systematic irregular practice). The base value considers the classification, the relevant revenue and a damage grade from 0 to 3. Recidivism within five years and ignoring ANPD orders raise the fine by 5% to 90%; ending the infraction early, adopting good practice and governance, and mitigating harm reduce it by 5% to 75%. Waiving the right to appeal the first-instance decision earns a 25% reduction.
What this means for security teams: the mitigating factors are things you control before an incident. Failing to notify within the Resolution 15/2024 window is a separate infraction from the incident itself.
What it means for AI agents and non-human identities
The LGPD is technology-neutral, but several articles bite hard on automated systems and the credentials they run on.
- Authentication data is a notification trigger: service account passwords, API keys and OAuth tokens that grant access to personal data are "system authentication data" when they belong to a data subject or open access to their data. Leaked machine credentials in a repository or chat tool can turn an exposure into a 3 working day notification. The Snowflake breach shows the pattern: valid credentials without MFA, held by customers rather than the platform, opened data warehouses holding customer records. See the Secrets Management Guide.
- Agents act for the controller: an AI agent that queries a CRM, summarises tickets or calls APIs is processing personal data on behalf of the controller. Its purpose, legal basis and access scope belong in the Art. 37 record like any other processing operation.
- Art. 20 review rights: if an agent or model makes or materially shapes decisions about people (credit, eligibility, fraud blocks), you need a review path and an explanation of criteria. Log the inputs, model version and output that drove each decision.
- Operators and model providers: a third-party LLM or agent platform that receives personal data is an operator, and if it is outside Brazil you need an Art. 33 mechanism, normally the Resolution 19/2024 clauses.
- Least privilege for machine identities: scoping agent credentials is an Art. 46 measure and limits incident scale.
See the AI and Privacy Guide.
Framework mapping
| LGPD requirement | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Legal bases (Arts. 7, 11) | GV.OC-03 | PT-2, PT-3 | A.5.34 |
| Records of processing, data inventory (Art. 37) | ID.AM-07 | PT-3, SI-12 | A.5.9, A.5.34 |
| RIPD (Art. 38) | GV.OC-03 | RA-8 | A.5.34 |
| Security measures (Arts. 46-49) | PR.DS-01, PR.AA-05 | AC-6 | A.8.2, A.8.24 |
| Incident notification (Art. 48, Res. 15/2024) | RS.CO-02, RS.CO-03 | IR-6, IR-8 | A.5.24, A.5.26 |
| Operators and transfers (Arts. 5, VII; 33) | GV.OC-03 | SA-9 | A.5.19, A.5.20 |
| Five-year incident record | RS.CO-02 | AU-11, SI-12 | A.5.28 |
Compliance steps
- Confirm applicability: list every product, site and system that processes data of people in Brazil or collects data in Brazil, including support desks and SaaS used by Brazilian staff.
- Build the Art. 37 record: one entry per processing operation with legal basis, data categories, systems, operators, transfers and retention. Include machine identities and agents as processing actors.
- Appoint and publish the encarregado: formal act, Portuguese-speaking channel, website disclosure, and a documented conflict-of-interest check.
- Fix transfers: insert the Resolution 19/2024 standard clauses unaltered in each relevant contract and publish the transparency page in Portuguese.
- Rewrite the incident runbook for 3 working days: add the Resolution 15/2024 criteria as a triage checklist, pre-draft ANPD and data subject notices in Portuguese, and name who files. Test it in a tabletop that starts on a Friday afternoon.
- Stand up the five-year incident register: record every incident, the risk assessment and the reason for any decision not to notify.
- Prepare RIPDs for high-risk processing (sensitive data, biometrics, large-scale profiling, automated decisions).
- Implement Art. 20 review for automated decisions and log the evidence needed to explain them.
- Exit cleanly: when retiring a system or vendor, prove deletion or return of data (Art. 47) and revoke the credentials that reached it.
Small versus large organisations: a small processing agent gets doubled incident deadlines but the same substantive duties, and should prioritise the incident runbook, encarregado channel and transfer clauses. A multinational should run the LGPD inside its global privacy programme but keep Brazilian artefacts separate: Portuguese notices, Brazilian clauses and a distinct 3 working day clock that runs alongside, not instead of, the GDPR 72 hours.
Detection and measurement
- Time from awareness to ANPD notice in working days, per incident and in exercises (target: within 3).
- Percentage of incidents with a completed risk assessment in the register, including non-notified ones (target: 100%).
- Percentage of transfer contracts on the Brazilian standard clauses (target: 100% of in-scope vendors).
- Data subject request completion time against your published commitment, and the share closed without escalation.
- Machine credentials with access to personal data that have an owner and rotation date, and the count found in secret scanning per month.
Common failure patterns
- Using the GDPR clock: teams plan for 72 hours and miss that Resolution 15/2024 also sets the same short window for notifying data subjects, not only the regulator.
- Not recording "no notify" decisions: the five-year register must include below-threshold incidents with the reasoning.
- Treating GDPR SCCs as enough: Brazilian transfers need the ANPD's own standard clauses, adopted without changes.
- Ignoring authentication data: a leaked token is dismissed as "no personal data in the file", when the token opened a system full of it and is itself a listed criterion.
- No Portuguese channel: an encarregado reachable only in English does not meet Resolution 18/2024.
Practitioner checklist
- Map every system, vendor and agent that touches personal data of people in Brazil into an Art. 37 record.
- Document the legal basis for each security and fraud processing operation, using Art. 11 for biometrics.
- Publish the encarregado's identity and a Portuguese contact channel on the website.
- Embed the Resolution 15/2024 relevant-risk criteria, including authentication data, in incident triage.
- Pre-approve Portuguese notice templates for the ANPD and data subjects and test the 3 working day path.
- Keep the incident register for at least five years, covering non-notified incidents.
- Put the Resolution 19/2024 standard clauses, unaltered, in every cross-border vendor contract.
- Scope and rotate service accounts, API keys and agent credentials that reach personal data.
Standards and references
- Presidência da República: Lei nº 13.709/2018, Lei Geral de Proteção de Dados Pessoais (compiled text)
- Agência Nacional de Proteção de Dados: official website
- Câmara dos Deputados: Entra em vigor lei que cria a Agência Nacional de Proteção de Dados
- Mattos Filho: ANPD publica regulamento de comunicação de incidente de segurança
- Demarest: ANPD aprova o regulamento de transferência internacional de dados
- Cescon Barrieu: ANPD publica Regulamento de Dosimetria e Aplicação de Sanções Administrativas
- Mattos Filho: ANPD publica resolução sobre a atuação do encarregado
- NIST: Cybersecurity Framework 2.0
This guide summarises Brazil's LGPD and ANPD regulations as of October 2026 and is not legal advice. Related NHI Mgmt Group resources: Global Privacy Regulatory Map · Data Breach Notification Checklist · GDPR Compliance Guide for Security Teams · Canada PIPEDA and Bill C-27 Guide