BrazilLei Geral de Proteção de Dados Pessoais (LGPD)
Lei nº 13.709 de 14 de agosto de 2018 (LGPD), arts. 1º-10, 15-16, 23-32, 37-41, 46-47, 49-51 (general regime, principles, lawful basis, public-sector processing, agents and governance)
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting, User location
- Obligation class
- Consent, Security, Retention, Governance, DPIA
- Audit expectation
- on_request
- Who audits it
- Self
- Where the report goes
- Produced on request
What it requires
- Establish a lawful basis under article 7 before processing personal data, including data the person has made public.NIST Privacy FrameworkCT.PO-P1
- Take consent only when it is provided in writing or by another means demonstrating the data subject's free will, in a clause set apart from the other contract terms, and be ready to prove it meets these requirements.NIST Privacy FrameworkCT.PO-P1
- Keep a record of your processing operations, especially those based on legitimate interest, and name a person in charge (encarregado) whose identity and contact details you publish, preferably on your website.NIST Privacy FrameworkID.IM-P4NIST Privacy FrameworkGV.PO-P3
- Adopt technical and administrative security measures suited to protect personal data against unauthorized access and accidental or unlawful destruction, loss, alteration, communication, or improper processing, from the design of the product or service through its execution.NIST Privacy FrameworkPR.DS-P5
- Delete personal data once processing ends, unless retention is needed to comply with a legal or regulatory obligation, for research with anonymization where possible, for an authorized transfer, or for your own exclusive anonymized use.NIST Privacy FrameworkCT.DM-P5
- As a public body, publish clear, up to date information about the legal basis, purpose and procedures for any processing you carry out, name a person in charge for it, and do not pass on personal data you hold to a private entity except in the cases the law lists.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.DM-P5Data are destroyed according to policy.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
1 more
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Article 37 requires the controller and the operator to keep a record of the processing operations they carry out, especially where the processing rests on legitimate interest. Article 8, paragraph 2 puts on the controller the burden of proving that consent was obtained in line with the Law, which a controller can meet only from a record of the consent. The articles name no format, no contents and no period for the record. Article 3, item I (processing carried out in Brazilian territory) is a scope prong that turns on where the processing happens and is left out of the hook values; items II and III give the two values recorded.
- Kind
- Explicit
- As of
- Provision
- Article 37, and Article 8, paragraph 2
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
The LGPD applies to any operation processing personal data by a natural or legal person, public or private, wherever performed, when the operation happens in Brazil, aims to offer goods or services to a person in Brazil, or processes data collected in Brazil, and article 4 exempts processing for exclusively personal and non-economic purposes, for journalistic, artistic or academic purposes, for public safety, national defense, state security or criminal investigation and enforcement under specific legislation, and data originating outside Brazil that is never shared with a Brazilian controller or transferred onward.
Article 5 defines the personal data, controller, operator and encarregado (data protection officer) roles that anchor the regime, and its most recent redação, given by Lei nº 15.352, de 2026, confirms that the body those roles report to is now the Agência Nacional de Proteção de Dados (ANPD), not the Autoridade Nacional de Proteção de Dados the LGPD originally created.
Article 6 states the purpose limitation, necessity, transparency, security and accountability principles that govern every processing operation, and article 7 lists ten lawful bases for ordinary personal data, from consent to legitimate interest, while article 8 sets consent's formal requirements, including a clause set apart from other contract terms and a burden of proof on the controller.
Article 9 requires clear, adequate and prominent information about the processing, and article 10 conditions a legitimate-interest basis on strictly necessary data and transparency measures. Articles 15 and 16 require personal data to be deleted once processing ends, unless retention is needed for a legal obligation, anonymized research, an authorized transfer, or the controller's own anonymized use.
Articles 23 to 32 require a public body to publish the legal basis, purpose and procedures for any processing it carries out, bar it from transferring personal data to a private entity outside the listed cases, and let the ANPD demand a report or issue guidance where a public body's processing violates the law.
Article 37 requires a record of processing operations, especially those resting on legitimate interest, article 38 lets the ANPD demand a data protection impact report, and article 41 requires the controller to name an encarregado and publish their contact details.
Articles 46, 47 and 49 require technical and administrative security measures against unauthorized access and accidental or unlawful destruction, loss, alteration or improper processing, from a product's design through its operation, and articles 50 and 51 encourage a governance program with internal rules, risk-mitigation mechanisms and complaint channels.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .