What Is LGPD?

The Lei Geral de Proteção de Dados is Brazil's general data protection law. It is closely modelled on European regulation, which makes it familiar to organisations that have already addressed GDPR.

It applies to processing carried out in Brazil, processing aimed at offering goods or services in Brazil, and processing of data collected in Brazil — so it reaches organisations with no Brazilian entity.

What it shares with European law

A legal basis requirement for every processing activity, with ten bases rather than six. A comparable set of individual rights: access, correction, deletion, portability and information about sharing.

A requirement to appoint a data protection officer. Obligations to report security incidents to the authority and to affected individuals. And extraterritorial reach on the same logic.

Where it differs

The additional legal bases include credit protection and health protection, reflecting Brazilian context. Notification timing is expressed as a reasonable period rather than a fixed count of hours, with guidance from the authority.

Penalties are capped in absolute terms as well as by percentage of Brazilian revenue, which produces a lower ceiling than the European equivalent for large multinationals.

The authority and its guidance

The national data protection authority was established after the law itself and has issued regulation progressively — on incident reporting, on the officer role, on penalties and on treatment by smaller organisations.

That phased guidance means requirements have clarified over time, and compliance positions established early are worth revisiting against current regulation rather than the original text.

Practical approach for multinationals

An organisation with a functioning European privacy programme has done most of this work. What remains is mapping processing to the Brazilian legal bases, addressing the officer requirement, adjusting notices, and handling local incident reporting.

Attempting a separate parallel programme duplicates effort. Extending the existing one with Brazilian specifics is considerably cheaper and produces more consistent practice.

Where it is enforced in practice

Enforcement has concentrated on transparency, security incidents and processing without a clear basis, which mirrors the pattern elsewhere.

For most organisations the operational question is the same as everywhere: can you say what personal data you hold, why, on what basis, and can you act on an individual's request within the required period.

The officer role and local presence

The law requires a data protection officer whose identity is published, and while the authority has clarified that the role may be filled flexibly, the appointment and the published contact point are expectations rather than options.

For organisations with no Brazilian entity, that means designating someone reachable for Brazilian data subjects and the authority. It is a small obligation and one of the few that does not transfer from an existing European programme.

Smaller organisations receive some proportionality in how the authority expects requirements to be met, including simplified records and more flexible arrangements for the officer role. That relief is real and it is not an exemption — the rights, the legal basis requirement and the incident obligations all still apply in full.

Where to start

If you already meet European requirements, map your existing processing records to the Brazilian legal bases and address the officer and incident reporting obligations. That is most of the remaining gap.

See GDPR. GuardsArm runs compliance auditing.