LGPD (Brazil)

Introduction: The LGPD Deep-Dive Guide

The Lei Geral de Protecao de Dados Pessoais (LGPD), formally Federal Law No. 13,709 of 14 August 2018, is Brazil's comprehensive personal data protection statute. It came into force on 18 September 2020, with the administrative sanctions provisions taking effect on 1 August 2021. Heavily inspired by the European Union's General Data Protection Regulation (GDPR), the LGPD establishes a unified, principles-based framework that governs the processing of personal data of natural persons located in Brazil, regardless of where the processing organisation (the controller or operator) is domiciled. It replaced a fragmented patchwork of more than 40 sectoral instruments with a single, horizontal law.

This guide is written from the perspective of an assessor conducting a readiness or conformity review against the LGPD. It walks through the legal bases, data subject rights, principles, governance obligations, security expectations, cross-border transfer rules, incident response duties, and the powers of the Autoridade Nacional de Protecao de Dados (ANPD). Crucially, it provides a master assessment checklist that enumerates every obligation area, so that an auditor, Data Protection Officer (Encarregado), or compliance lead can systematically verify posture and marshal defensible evidence. Throughout, we translate the abstract legal language of the statute into concrete 'what to verify' and 'typical evidence' pairings that stand up to regulatory scrutiny.

What is the LGPD?

The LGPD is an omnibus data protection law that regulates any operation involving personal data (tratamento) carried out by natural persons or by public and private legal entities. 'Processing' is defined expansively to include collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation, control, modification, communication, transfer, dissemination and extraction. The law is deliberately technology-neutral and applies whether data is processed by automated or non-automated means.

The statute pursues a dual objective: protecting the fundamental rights of freedom, privacy and the free development of the personality of the natural person, while enabling economic and technological development and the free flow of data within a framework of trust. It rests on ten foundational principles (Article 6) and grants data subjects (titulares) a suite of enforceable rights (Article 18). Every act of processing must be anchored to at least one of ten legal bases for personal data (Article 7), or one of the specific legal bases for sensitive personal data (Article 11).

Two categories of processing agents bear obligations: the controller (controlador), who takes decisions regarding the processing, and the operator (operador), who processes data on behalf of the controller. The Encarregado (Data Protection Officer / DPO) is the individual appointed to act as the communication channel between the controller, data subjects, and the ANPD. Enforcement sits with the ANPD, a federal autarchy with regulatory, supervisory and sanctioning powers, empowered to impose fines of up to 2% of a company's revenue in Brazil, capped at BRL 50 million per infraction.

Key terminology (glossary)

Who must comply?

The LGPD has broad, extraterritorial scope. Under Article 3, the law applies to any processing operation regardless of the medium, the country where the controller/operator is headquartered, or the country where the data is located, provided any one of three connecting factors is met: (i) the processing is carried out in Brazilian territory; (ii) the processing activity aims to offer or supply goods or services to, or process data of, individuals located in Brazil; or (iii) the personal data was collected in Brazilian territory (a data subject located in Brazil at the time of collection).

Article 4 sets out express exclusions: processing done by a natural person for exclusively private and non-economic purposes; processing done exclusively for journalistic, artistic or academic purposes; and processing for purposes of public safety, national defence, State security, or investigation and prosecution of criminal offences (the latter reserved for separate specific legislation). Data whose provenance is entirely outside Brazil and which merely transits Brazil without being processed here (unless subject to international cooperation rules) is also excluded.

Structure of the LGPD

The LGPD is organised into ten chapters and 65 articles. Unlike a controls-based standard such as ISO 27001, the LGPD is a principles-and-rights statute; its 'control families' are best understood as the thematic obligation domains that flow from its chapters. The table below maps those domains for assessment purposes.

Master assessment checklist

This is the core of the guide. Each obligation domain below is presented with the specific items an assessor must verify and the evidence that typically demonstrates conformity. Work through every table; do not skip any domain, as ANPD enforcement and civil litigation both examine the totality of the accountability programme, not isolated controls.

1. The ten principles (Article 6)

Every processing activity must simultaneously satisfy all ten principles. These are not optional and are frequently the anchor of ANPD findings.

2. Legal bases for personal data (Article 7)

3. Legal bases for sensitive personal data (Article 11)

4. Processing of children's and adolescents' data (Article 14)

5. Consent management (Articles 8-9)

6. Data subject rights (Articles 17-22)

7. Transparency and information duties

8. Controller and operator obligations (Articles 37-40)

9. Data Protection Officer / Encarregado (Article 41)

10. Security, technical and administrative measures (Articles 46-47)

11. Good-practice and governance programme (Articles 50-51)

12. Data Protection Impact Assessment (RIPD, Article 38)

13. Security incident management and breach notification (Article 48)

14. International data transfers (Articles 33-36)

15. Termination of processing and retention (Articles 15-16)

16. Liability, redress and accountability (Articles 42-45)

Scoping the assessment

Accurate scoping prevents both under-assessment (which leaves regulatory exposure) and over-assessment (which wastes effort on out-of-scope activities). LGPD scoping is data-flow-driven rather than system-driven: begin from the personal data itself and follow it across people, processes, systems and third parties.

• Determine territorial applicability: identify processing carried out in Brazil, processing offering goods/services to individuals in Brazil, and data collected while subjects were in Brazil.
• Inventory all personal and sensitive data categories, sources and data subjects (customers, employees, prospects, minors, patients).
• Map data flows end to end, including collection points, storage locations, internal transfers, operators, sub-operators and cross-border transfers.
• Classify processing activities by risk to identify those requiring a RIPD (large-scale, sensitive, systematic monitoring, or novel technologies).
• Identify all processing agents and their roles (controller, joint controllers, operator) and confirm contractual coverage.
• Determine applicability of the simplified small-business regime (ANPD Resolution 2/2022) and any sectoral overlays (financial, health, telecom).
• Exclude clearly out-of-scope activities under Article 4 (purely private, journalistic/artistic, public-safety/national-defence reserved processing).
• Define the assessment boundary, in-scope systems, and the reporting period.

Implementation approach (phased)

A defensible LGPD programme is built in phases. Each phase produces deliverables that become the evidence base for both internal accountability and any ANPD interaction.

Phase 1: Discovery and data mapping

• Activities: run data-discovery workshops, deploy discovery tooling, interview process owners, and inventory data categories, systems and flows.
• Deliverables: personal-data inventory, data-flow maps, initial Register of Processing Operations (RoPA), and a preliminary applicability memo.

Phase 2: Gap assessment and legal-basis mapping

• Activities: assess each processing activity against principles, legal bases, rights and security duties; perform Legitimate Interest Assessments; identify gaps.
• Deliverables: gap-assessment report, legal-basis register, LIAs, and a prioritised remediation roadmap with risk ratings.

Phase 3: Governance and documentation

• Activities: appoint the Encarregado, draft/update the privacy governance programme, policies, privacy notices, consent flows and DPAs.
• Deliverables: appointment record, privacy programme charter, policy suite, layered privacy notices, consent-management design, and standard DPA templates.

Phase 4: Technical and security remediation

• Activities: implement access controls, encryption, logging, pseudonymisation, retention automation and privacy-by-design gates in the SDLC.
• Deliverables: security control implementation records, key-management procedures, retention schedules, and updated architecture documentation.

Phase 5: Rights, incidents and third-party operationalisation

• Activities: stand up DSAR handling, breach detection and notification workflows, RIPD process, and third-party/operator due-diligence programme.
• Deliverables: DSAR procedure and portal, incident response plan, breach-notification templates, RIPD methodology, and vendor risk register.

Phase 6: Embedding, monitoring and continuous improvement

• Activities: deliver training and awareness, run tabletop exercises, establish KPI monitoring, and schedule periodic reassessment and internal audit.
• Deliverables: training records, exercise reports, KPI dashboard, internal audit plan, and management review minutes.

Maturity and capability model

The LGPD does not prescribe a maturity model, but assessors commonly apply a five-level capability scale to communicate posture and prioritise investment. The scale below is calibrated to LGPD accountability expectations.

Assessment and audit approach

1. Define objectives, scope and the reporting period; confirm applicability under Article 3 and any exclusions under Article 4.
2. Request and review documentation: RoPA, privacy notices, policies, DPAs, consent records, RIPDs and incident logs.
3. Conduct data-flow validation through interviews and system walkthroughs to confirm the RoPA reflects reality.
4. Test legal bases: for each activity, verify a valid Article 7/11 basis and, for legitimate interest, a documented balancing test.
5. Assess data subject rights operation by submitting or tracing test/real requests and measuring SLA adherence.
6. Evaluate technical and administrative security measures against Articles 46-47, including access, encryption and logging.
7. Review the incident and breach-notification process against Article 48 and ANPD Resolution 15/2024 timelines.
8. Examine cross-border transfer mechanisms against Articles 33-36 and current ANPD SCC/BCR requirements.
9. Assess the governance programme, Encarregado function and accountability evidence dossier.
10. Rate findings by risk, assign a maturity level, and produce a remediation roadmap with owners and timelines.
11. Validate remediation in a follow-up review and maintain the evidence base for ongoing accountability.

Evidence request list

The following categorised evidence set should be requested at the outset of any LGPD assessment.

• Governance and accountability: privacy programme charter; Encarregado appointment and published contact; policy library; management review minutes.
• Data mapping: Register of Processing Operations (RoPA); data-flow diagrams; personal and sensitive data inventory; retention schedules.
• Legal bases and consent: legal-basis register; Legitimate Interest Assessments; consent capture and withdrawal logs; consent text version history.
• Transparency: published privacy notices; just-in-time notices; cookie/tracking disclosures.
• Data subject rights: DSAR procedure; request log with SLA metrics; response templates; automated-decision review process.
• Security: ISMS policies; access-control matrix and access reviews; encryption and key-management standards; logging/monitoring configuration.
• Impact assessments: completed RIPDs; RIPD methodology; remediation trackers.
• Incidents: incident response plan; incident register; ANPD and data-subject notification records; post-incident reports.
• Third parties and transfers: DPAs and sub-processor register; vendor risk assessments; cross-border transfer register and SCCs/BCRs/adequacy references.
• Training and awareness: training curriculum and completion records; tabletop exercise reports.

Roles and responsibilities

KPIs to track

• Percentage of processing activities with a documented and valid legal basis.
• Data subject request (DSAR) volume and percentage answered within statutory timeframes (immediate simplified / 15 days full).
• Mean time to detect, contain and notify security incidents; percentage of breaches notified within the ANPD timeline.
• Percentage of high-risk processing activities with a completed and current RIPD.
• Consent withdrawal processing rate and average time to honour withdrawals.
• Percentage of operators/sub-processors under an executed DPA and assessed for security.
• RoPA completeness and freshness (percentage of activities reviewed within the review cycle).
• Staff privacy-training completion rate and phishing/awareness scores.
• Number of open versus closed remediation items and average time to closure.
• Percentage of cross-border transfers covered by a valid Article 33 mechanism.

Readiness checklist

• Territorial applicability under Article 3 confirmed and documented.
• Complete personal and sensitive data inventory and data-flow maps produced.
• Register of Processing Operations (RoPA) established and current.
• A valid legal basis mapped to every processing activity, with LIAs where legitimate interest is used.
• Layered, accurate privacy notices published in Portuguese.
• Consent capture, granularity and withdrawal mechanisms operational and logged.
• Data subject rights (access, correction, deletion, portability, objection, automated-decision review) handled within SLA.
• Encarregado appointed and contact details publicly disclosed.
• Privacy governance programme documented, endorsed and reviewed.
• Technical and administrative security measures implemented per Articles 46-47.
• RIPD process defined and applied to high-risk processing.
• Security incident and breach-notification process aligned to Article 48 and ANPD Resolution 15/2024.
• Cross-border transfer mechanisms in place per Articles 33-36 and current ANPD templates.
• DPAs executed with all operators and sub-processors; vendor risk assessed.
• Retention schedules and secure elimination procedures implemented.
• Staff trained; tabletop exercises conducted; KPIs monitored.

Common gaps

• Treating consent as the default legal basis when a more appropriate basis (legitimate interest, legal obligation, contract) applies, creating fragile compliance.
• Incomplete or out-of-date RoPA that does not reflect actual data flows, undermining every downstream control.
• Legitimate interest relied upon without a documented balancing test (LIA) or opt-out mechanism.
• No formal Encarregado, or an appointed Encarregado whose contact details are not publicly disclosed.
• Bundled consent that mixes marketing, profiling and service terms in a single non-granular acceptance.
• Weak or absent breach-notification readiness, missing the ANPD three-business-day expectation.
• Cross-border transfers made with no valid Article 33 mechanism, often to cloud/SaaS providers.
• Sensitive data (health, biometric) processed without the specific Article 11 basis or heightened safeguards.
• Data subject rights handled ad hoc, with no SLA tracking or identity-verification procedure.
• Operators engaged without a DPA, leaving instructions and liability undefined.
• Retention 'forever' with no schedule, breaching necessity and elimination duties.
• No RIPD for high-risk or large-scale processing, weakening the accountability defence.
• Privacy notices copied from GDPR templates without adaptation to LGPD terminology and Portuguese-language requirements.

LGPD mapped to other frameworks

Organisations rarely comply with the LGPD in isolation. The mapping below helps assessors reuse controls and evidence across frameworks, while noting that mappings are indicative and each framework retains distinct obligations.

How CyberSigma helps

Frequently asked questions

Need help with LGPD?

CERT-In empanelled, PCI QSA senior auditors can take you from reading about it to compliant — with a scoped, guided programme.