Lei Geral de Proteção de Dados Pessoais (LGPD)

The LGPD applies to any operation processing personal data by a natural or legal person, public or private, wherever performed, when the operation happens in Brazil, aims to offer goods or services to a person in Brazil, or processes data collected in Brazil, and article 4 exempts processing for exclusively personal and non-economic purposes, for journalistic, artistic or academic purposes, for public safety, national defense, state security or criminal investigation and enforcement under specific legislation, and data originating outside Brazil that is never shared with a Brazilian controller or transferred onward.

Article 5 defines the personal data, controller, operator and encarregado (data protection officer) roles that anchor the regime, and its most recent redação, given by Lei nº 15.352, de 2026, confirms that the body those roles report to is now the Agência Nacional de Proteção de Dados (ANPD), not the Autoridade Nacional de Proteção de Dados the LGPD originally created.

Article 6 states the purpose limitation, necessity, transparency, security and accountability principles that govern every processing operation, and article 7 lists ten lawful bases for ordinary personal data, from consent to legitimate interest, while article 8 sets consent's formal requirements, including a clause set apart from other contract terms and a burden of proof on the controller.

Article 9 requires clear, adequate and prominent information about the processing, and article 10 conditions a legitimate-interest basis on strictly necessary data and transparency measures. Articles 15 and 16 require personal data to be deleted once processing ends, unless retention is needed for a legal obligation, anonymized research, an authorized transfer, or the controller's own anonymized use.

Articles 23 to 32 require a public body to publish the legal basis, purpose and procedures for any processing it carries out, bar it from transferring personal data to a private entity outside the listed cases, and let the ANPD demand a report or issue guidance where a public body's processing violates the law.

Article 37 requires a record of processing operations, especially those resting on legitimate interest, article 38 lets the ANPD demand a data protection impact report, and article 41 requires the controller to name an encarregado and publish their contact details.

Articles 46, 47 and 49 require technical and administrative security measures against unauthorized access and accidental or unlawful destruction, loss, alteration or improper processing, from a product's design through its operation, and articles 50 and 51 encourage a governance program with internal rules, risk-mitigation mechanisms and complaint channels.