LGPD

What is LGPD?

The LGPD is Brazil’s comprehensive data protection law. Its structure will be familiar to anyone who knows the GDPR: principles, legal bases, data subject rights, controller and processor roles, a data protection officer, breach notification and cross-border transfer rules.

Who does it apply to?

Any processing of personal data carried out in Brazil, of data about individuals located in Brazil, or for the purpose of offering goods or services in Brazil, regardless of where the organisation is based. Some processing is excluded, such as purely personal use, journalism and art, and certain public security matters.

Key duties

• Legal bases: processing needs one of ten legal bases, including consent, legal obligation, contract, legitimate interest and credit protection, the last being specific to Brazil. Sensitive data has a narrower list.
• Rights: confirmation and access, correction, anonymisation, blocking or deletion of unnecessary data, portability, information about sharing, and review of automated decisions.
• Encarregado (DPO): controllers appoint a person in charge of data processing as the contact point for data subjects and the ANPD. The ANPD has issued rules on this role, with relief for small processing agents.
• Security and incidents: adopt security measures and report security incidents that may cause relevant risk or damage to the ANPD and to data subjects within the deadlines set in ANPD regulation.
• International transfers: only through recognised mechanisms. The ANPD has adopted standard contractual clauses.

Enforcement

The ANPD can warn, publicise violations, block or delete data and fine up to 2% of the group’s revenue in Brazil, limited to R$50 million per infraction.

How does it relate to other frameworks?

A GDPR programme covers much of the LGPD, but legal bases, incident deadlines and transfer tools differ. Check the ANPD’s regulations for the details.