Loading…
Lei Geral de Proteção de Dados Pessoais (Lei nº 13.709/2018) entered into force in August 2020, with administrative sanctions applicable since August 2021. The law applies extraterritorially to any processing involving data subjects in Brazil.
Enforcement is held by the Autoridade Nacional de Proteção de Dados (ANPD), which has issued binding resolutions on incident notification, international transfers, and small-controller exemptions.
Plus free access, transparency, non-discrimination, and accountability.
Processing only for legitimate, specific, explicit, and informed purposes (Art. 6, I).
Processing must be compatible with the purposes communicated to the data subject (Art. 6, II).
Limitation of processing to the minimum necessary for the stated purposes (Art. 6, III).
Accuracy, clarity, relevance, and updating of personal data (Art. 6, V).
Technical and administrative measures to protect personal data from unauthorized access (Art. 6, VII).
Adopt measures to prevent damages from data processing (Art. 6, VIII).
Processing carried out in Brazilian territory — regardless of where the controller is based (Art. 3, I).
When processing aims to offer goods or services to individuals in Brazil (Art. 3, II).
When personal data was collected in Brazilian territory (Art. 3, III).
Sectors with high enforcement priority and overlapping BCB / ANS regulation.
Appointed Encarregado as required under Art. 41 LGPD — communications channel with ANPD and data subjects.
Article 37 records of processing activities — maintained in Portuguese and synchronised with global ROPA.
Relatório de Impacto à Proteção de Dados Pessoais for high-risk processing and ANPD requests.
Notification, consultation, and inspection response with the Autoridade Nacional de Proteção de Dados.
Adequacy, contractual clauses, BCRs, and specific consent — aligned with ANPD Resolution 19/2024.
ANPD breach notification (Resolution CD/ANPD No. 15/2024) within a reasonable time, plus data subject communication.
We act as your Encarregado de Proteção de Dados, manage ANPD interactions, and run incident response — in Portuguese and English.