Brazil

Open in Knowledge map

Sources last checked: 2026-11-09

The General Data Protection Law, the LGPD, is Brazil’s main privacy law. It is enforced by the National Data Protection Authority, the ANPD.¹

Source note: Brazil’s official legal site could not be reached, so the law’s own text was not read. This whole page relies on the European Commission’s 2026 decision on Brazil, which sets out the LGPD article by article.

At a glance

Question	Answer
Main law	Law 13.709/2018 (LGPD)1
Answer an access request	Within 15 days1
Report an incident	To the ANPD and the people affected, within a reasonable time set by the ANPD1
Highest fine	2% of revenue in Brazil, up to R$ 50 million per infringement1

Who it covers

Processing carried out in Brazil, processing that offers goods or services to people in Brazil, and processing of data about people located there.¹

Legal reasons to use data

Every use needs a legal basis, such as consent, a contract, a legal obligation, protecting life or safety, carrying out public policy, or legitimate interests unless the person’s rights prevail.¹

Your rights

You can obtain information about and access to your data, have it corrected or erased, object, move it elsewhere, and ask for a review of decisions made solely by automated means.¹ You can also complain to the ANPD and go to court for compensation.¹

Sending data abroad

Transfers are allowed only in the circumstances the law sets out.¹ The EU and Brazil recognised each other’s protection as adequate in January 2026, so data can move between them without further safeguards.¹²

Data protection officer

The law requires a publicly identified data protection officer. The ANPD exempts some small organisations.¹

References

1. European Commission, Implementing Decision (EU) 2026/179 on Brazil, which describes the LGPD article by article ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹²

2. ANPD, Resolution No. 32 of 26 January 2026 ↩