LGPD
Lei Geral de Proteção de Dados Pessoais (Lei nº 13.709/2018), Brazil — ANPD (Autoridade Nacional de Proteção de Dados, Brazil)
Also known as: LGPD, Lei 13.709, Lei Geral de Protecao de Dados, Brazil LGPD
At a glance
- Current version
- Lei nº 13.709/2018 as amended by Lei nº 15.352/2026
- Published 25 February 2026. source
- Status
- In force
- Next deadline
- None announced
- Who must comply
- Any processing by individuals or public or private legal entities, wherever based, when it takes place in Brazil, offers goods or services to or processes data of people in Brazil, or concerns data collected in Brazil. source
- How it is assessed
- Controllers appoint a data protection officer and report security incidents that may cause relevant risk or harm to the ANPD and to data subjects within three business days. source
- Authority
- A federal law enforced by the Agência Nacional de Proteção de Dados (ANPD), a special autonomous agency (autarquia de natureza especial). source
- Enforced by
- The ANPD imposes administrative sanctions from warnings to fines of up to 2% of Brazilian revenue, capped at R$50 million per infraction, and data blocking or deletion. source
- Last change
Brazil's data protection statute, close enough to the GDPR in shape that most programmes answer both together: ten lawful bases, data subject rights, a data protection officer, breach notification and fines of up to two per cent of turnover, capped at R$50 million per infraction. Data protection is a fundamental right in the Brazilian constitution, and the operative detail sits in resolutions from the national data protection agency rather than in the law's text.
Recent changes
-
Info
ANPD holds public hearing on update to Dosimetry Regulation
ANPD holds a public hearing to discuss the update of its Dosimetry Regulation, with emphasis on issues of classification and cumulativity of violations. The virtual meeting …
-
Medium
ANPD publishes guide on platform responsibilities under ECA Digital
ANPD releases explanatory guide on ECA Digital application, clarifying which products and services are subject to the law and what responsibilities digital service providers must fulfill. …
-
Info
ANPD establishes corrective measures against Feira de Santana Municipality for medical data breach
ANPD established corrective measures against Feira de Santana Municipality after inspection process confirmed exposure of medical data of 1,200 people. The breach involved sensitive information of …
-
Info
ANPD opens stakeholder consultation for personal data subjects' rights standard
The ANPD (National Data Protection Authority) opened a stakeholder consultation to develop a standard on the rights of personal data subjects. The consultation will remain open …
-
Info
ANPD requests clarifications from Meta regarding account suspension and content removal violations
The National Data Protection Authority (ANPD) has opened an administrative proceeding against Meta following reports of potential violations in account suspension and content removal practices. The …
-
Info
ANPD opens public consultation and hearing on Data Protection Dosimetry and Sanctions Application Regulation
The ANPD (National Data Protection Agency) opened a public consultation and hearing for updating the Regulation of Dosimetry and Application of Sanctions. The agency will receive …
-
Info
ANPD opens registrations for hearing and launches public consultation on Supervisory Regulation update
ANPD (Autoridade Nacional de Proteção de Dados) has opened public consultation for updates to its Supervisory Regulation and is accepting registrations for a virtual hearing scheduled …
-
Info
ANPD fines TikTok R$ 153.7 million for data protection failures involving minors
ANPD (Brazil's personal data protection authority) issued a fine of R$ 153.7 million to TikTok for violations of LGPD requirements on protection of minors' data. ByteDance, …
-
Low
ANPD publishes testing methodology for Regulatory Sandbox in AI and Data Protection
ANPD (Brazil's data protection authority) has published the testing methodology for its Regulatory Sandbox pilot project in artificial intelligence and data protection. The methodology outlines different …
-
Info
ANPD orders Discord to suspend live streaming in Brazil over child protection failures
Brazil's data protection authority (ANPD) has issued a preventive order requiring Discord to suspend its live streaming functionality in the country, citing identified failures in structural …
That is the last 90 days. Sign in to read further back.
Key dates
No upcoming dates- Lei nº 15.352 converts MP nº 1.317/2025 and reorganises the ANPD as an agency
- ANPD Resolution No. 32 recognises the European Union as providing adequate protection for international transfers
- ANPD Resolution No. 19 adopts the international transfer regulation and standard contractual clauses; existing contracts had 12 months to incorporate them
- ANPD Resolution No. 18 adopts the regulation on the data protection officer (encarregado)
Amendments
-
Lei nº 13.709/2018 as amended by Lei nº 15.352/2026 AmendmentCurrent text
Lei nº 15.352, converting Medida Provisória nº 1.317/2025, rewrote the provisions on the national authority, now the Agência Nacional de Proteção de Dados (ANPD). source
-
Medida Provisória nº 1.317/2025 Amendment
A provisional measure with force of law amended the LGPD to deal with the Agência Nacional de Proteção de Dados and created a regulation and inspection career for data protection. source
-
Lei nº 14.460/2022 Amendment
Transformed the ANPD into a special autonomous agency (autarquia de natureza especial). source
-
Lei nº 14.010/2020 Amendment
Set 1 August 2021 as the date from which the administrative sanctions in Articles 52 to 54 apply. source
-
Lei nº 13.853/2019 Amendment
Amended the LGPD and created the national data protection authority (ANPD). source
Show 1 older amendment
-
Lei nº 13.709/2018 Major version
The Lei Geral de Proteção de Dados Pessoais was enacted on 14 August 2018. source
Who it applies to
The LGPD applies to public and private processing anywhere in the world that is carried out in Brazil, targets people in Brazil or uses data collected in Brazil.
- Territorial scope
- Any processing by a natural person or a public or private legal entity, regardless of the country of its seat or where the data are located, if the processing occurs in Brazil, aims to offer goods or services to or process data of individuals in Brazil, or concerns data collected in Brazil (Article 3). source
- Collected in Brazil
- Data count as collected in Brazil if the data subject was in Brazil at the time of collection (Article 3, §1). source
- International transfers
- Contracts using clauses for international transfers had to incorporate the ANPD standard contractual clauses within 12 months of Resolution No. 19's publication. source
How compliance is assessed
Controllers appoint a data protection officer and report security incidents that may cause relevant risk or harm to the ANPD and to data subjects within three business days.
- Encarregado
- The controller must appoint a data protection officer (encarregado) (Article 41). source
- Incident notification
- The controller must communicate to the ANPD and to data subjects any security incident that may create relevant risk or harm to them (Article 48). source
- Three business days
- The communication to the ANPD, and to data subjects, is due within three business days; details may be supplemented within 20 business days (Resolution CD/ANPD No. 15/2024, Articles 6 and 9). source
Enforcement and penalties
The ANPD imposes administrative sanctions from warnings to fines of up to 2% of Brazilian revenue, capped at R$50 million per infraction, and data blocking or deletion.
Up to 2% of revenue, max R$50 million
Article 52(II): a simple fine of up to 2% of the revenue of the private legal entity, group or conglomerate in Brazil in its last financial year, excluding taxes, limited to R$50,000,000 per infraction. source
- Other sanctions
- Sanctions also include daily fines, publicising the infraction, blocking or deleting the data concerned and suspending the database for up to six months (Article 52). source
- Dosimetry
- The ANPD calculates sanctions under its Regulation on Dosimetry and Application of Administrative Sanctions (Resolution CD/ANPD No. 4/2023). source
Documents
- Law text Lei nº 13.709/2018 (texto compilado)
- Law text Lei nº 15.352/2026
- Guidance Regulamentações da ANPD (list of ANPD resolutions)
- Law text Resolução CD/ANPD nº 15/2024 (security incident communication)
- Law text Resolução CD/ANPD nº 19/2024 (international transfers and standard clauses)
Show 1 more document
Frequently asked questions
What is the maximum LGPD fine?
A simple fine of up to 2% of the company's or group's revenue in Brazil in its last financial year, excluding taxes, limited to R$50 million per infraction (Article 52). source
How fast must a security incident be reported under the LGPD?
Within three business days to the ANPD, and within three business days to affected data subjects from when the controller learns the incident affected personal data (Resolution CD/ANPD No. 15/2024). source
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to LGPD (RSS)