What is LGPD (Brazil’s General Data Protection Law)?

How LGPD Works

LGPD establishes a framework built around two principal actors: the controller and the operator. The controller determines the purposes and means of processing personal data. The operator processes that data on the controller's behalf. Both are accountable to the ANPD (IAPP), Brazil's independent supervisory authority, which issues regulations, conducts audits, and applies sanctions.

Before processing any personal data, a controller must identify a valid legal basis from LGPD's ten enumerated options. These include consent, contract execution, legal obligation, legitimate interest, and credit protection, among others. This list is broader than GDPR's six legal bases, which means a controller may have more options available but also faces additional complexity in selecting and documenting the correct one.

Controllers must appoint a Data Protection Officer to serve as the formal point of contact between the organization, data subjects, and the ANPD. Small processing agents, as defined by ANPD resolution, are exempt from this requirement. All other controllers must maintain this appointment regardless of processing volume or organization size.

When a security incident occurs that may cause risk or harm to data subjects, the controller must notify the ANPD and affected individuals within three working days of discovery. That notification must describe the nature of the incident, the categories of data affected, the technical security controls required under data protection laws in place, and the remediation steps being taken.

Why LGPD Matters

Organizations that process personal data of Brazilian residents without a valid legal basis or without the required technical controls face administrative sanctions that include fines up to BRL 50 million (~$10M USD) per violation, data blocking, suspension of processing activities, and public disclosure of the violation. The ANPD initiated its first private-sector sanction in July 2023 and has since disclosed nine formal sanctioning proceedings, with enforcement expanding into facial recognition, AI training, and children's data (ICLG, 2025).

For IT managers responsible for security controls, access management, and incident response, LGPD creates direct technical obligations. Encryption, access controls, and breach notification procedures are not optional additions to structured compliance programs for IT teams. They are requirements with documented enforcement consequences. Organizations operating in or selling into the Brazilian market need to assess their data handling practices against LGPD's requirements, independent of any GDPR compliance program already in place.

LGPD vs. GDPR

LGPD and GDPR share the same foundational structure, but LGPD's broader set of legal bases and its universal DPO requirement mean that organizations operating in both jurisdictions cannot treat GDPR compliance as a substitute for a separate LGPD assessment.

Common Misconceptions

LGPD does not apply only to Brazilian companies. The law's extraterritorial scope covers any organization that processes personal data of individuals located in Brazil at the time of collection, regardless of where the organization is headquartered or where the data is stored.

LGPD is not satisfied by GDPR compliance alone. Although both frameworks share common principles, LGPD includes four additional legal bases, a broader DPO mandate, and Brazil-specific breach notification procedures that require separate implementation and documentation.