latam
Brazil
Brazil's LGPD established a broad cross-sector privacy framework with ANPD oversight.
Editorial caveat
Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.
Breach
- Breach deadline (hours)
- 48
- Breach notification required
- Yes
Marketing
- Cookie consent rule
- Consent is expected for many tracking scenarios, with ANPD guidance evolving.
Transfers
- Cross-border transfer restricted
- Yes
- Data localization required
- No
Governance
- DPO required
- Yes
- Impact assessment required
- Yes
- Records of processing required
- Yes
Identity
- Effective date
- 2020-09-18
- Effective status
- in-force
- Last amended
- 2023-04-24
- Law status
- active
Scope
- Extraterritorial application
- Yes
- Private sector coverage
- Yes
- Public sector coverage
- Yes
- Territorial scope
- Applies to processing operations carried out in Brazil or targeting individuals in Brazil.
Legal Basis
- Legal bases
- consent, legal obligation, public task, legitimate interests
- Requires legal basis
- Yes
Enforcement
- Maximum fine
- Up to 2% of a private legal entity's revenue in Brazil, capped at BRL 50 million per infraction.
- Private right of action
- Yes
Definitions
- Personal data definition
- Information regarding an identified or identifiable natural person.
- Sensitive data recognized
- Yes
Rights
- Right of access
- Yes
- Right to appeal
- Yes
- Right to deletion
- Yes
- Right to object
- Yes
- Right to portability
- Yes
Official sources
- ANPD guidanceofficial-regulator • pt-BR • html
- Planalto LGPD textofficial-law • pt-BR • html
Recent change workflow
- 48 hours (editorial estimate pending manual confirmation)edited • extractor openclaw