Data & Privacy · Brazil
Data protection & privacy law in Brazil (2026)
Brazil shaded by its data & privacy status
Data protection in Brazil: comprehensive law.
FrameworkLei Geral de Proteção de Dados Pessoais (LGPD) — Lei nº 13.709/2018, in force since September 2020; supervised by the Autoridade Nacional de Proteção de Dados (ANPD), which became a fully autonomous regulatory agency in February 2026 under Lei nº 15.352/2026. Data protection is a fundamental right under Article 5, LXXIX of the Federal Constitution (EC 115/2022).
Brazil operates a comprehensive, GDPR-inspired data protection regime centred on the LGPD (Law 13.709/2018), applicable to any natural or legal person processing personal data in Brazil or of Brazilian data subjects. It is enforced by the ANPD, which in February 2026 was upgraded to an independent regulatory agency and has significantly escalated sanctioning activity, imposing over BRL 98 million in fines cumulatively between 2023-2025. On 26-27 January 2026, Brazil and the European Union adopted mutual adequacy decisions, allowing personal data to flow between the two jurisdictions without additional transfer safeguards.
Key points
Lei nº 13.709/2018 (LGPD), effective 18 September 2020 (administrative sanctions from 1 August 2021), consolidates rules for the processing of personal data by public and private entities across all sectors, both online and offline.
The Autoridade Nacional de Proteção de Dados (ANPD), headquartered in Brasília, is the regulator. Under Lei nº 15.352/2026 (conversion of MP 1.317/2025), it became a fully autonomous federal regulatory agency in February 2026, with six superintendencies including a dedicated Enforcement Superintendency.
The LGPD grants rights of access, correction, anonymisation/blocking, portability, deletion, information about sharing, and revocation of consent, generally to be answered within 15 days. Controllers must have a lawful basis (10 hypotheses under Art. 7), appoint a Data Protection Officer (encarregado) under Art. 41, keep records of processing (Art. 37), and implement technical/administrative security measures.
Constitutional Amendment nº 115/2022 elevated the protection of personal data — including in digital media — to an autonomous fundamental right in Article 5, LXXIX of the Federal Constitution and assigned the Union exclusive competence to legislate on it.
Sanctions under Art. 52 LGPD include warnings, publicity of the violation, blocking/erasure of data, partial or total suspension of processing, and administrative fines of up to 2% of Brazilian revenue, capped at BRL 50 million per infraction. The ANPD has cumulatively imposed over BRL 98 million in fines from 2023 through 2025, with 2026 priorities focused on biometric data, health data, financial data and children's data.
On 26 January 2026 the European Commission adopted an adequacy decision on Brazil, and on 27 January 2026 the ANPD issued Resolução CD/ANPD nº 32/2026 recognising the EU as providing an adequate level of protection. Personal data may now flow bidirectionally between Brazil and the EU without SCCs or other supplementary transfer mechanisms; the decisions will be reviewed within four years and exclude transfers for public-security, defence or criminal-law-enforcement purposes.
Timeline - major decisions & events
The European Data Protection Board adopted Opinion 28/2025 broadly endorsing the European Commission's draft decision (published 5 Sep 2025) that Brazil offers adequate protection under the GDPR, paving the way for free EU-Brazil data flows; mutual adequacy was announced 27 Jan 2026.
EDPB ↗Brazil transformed the ANPD from a special autarchy into a full regulatory agency with functional, technical, decision-making, administrative and financial autonomy, cementing it as an independent data-protection regulator.
IAPP ↗The ANPD approved the regulation governing cross-border transfers and published Standard Contractual Clauses, operationalising the LGPD's international transfer regime (controllers had until 22 Aug 2025 to adopt the new SCCs).
IAPP ↗The ANPD issued a preventive measure suspending Meta's use of personal data to train generative AI under a BRL 50,000/day fine, citing inadequate transparency and risks to minors; the measure was lifted on 30 Aug 2024 after Meta submitted a compliance plan.
Future of Privacy Forum ↗The ANPD imposed its first fine on a microenterprise for telemarketing-related LGPD violations, marking the start of active enforcement of the law's penalty regime.
IAPP ↗The ANPD was converted from a body linked to the Presidency into an independent special autarchy with technical, decision-making and budgetary autonomy, strengthening its impartiality as the national regulator.
Lexology ↗Congress added the protection of personal data, including in digital media, to the fundamental rights in Article 5 of the Constitution (and federal exclusive competence to legislate), entrenching the principles underpinning the LGPD.
Government of Brazil ↗The LGPD's penalty provisions (fines up to 2% of Brazilian revenue, capped at BRL 50 million per infraction) became enforceable, giving the ANPD power to sanction non-compliance.
ICLG ↗By 10-1 the Supreme Federal Court suspended MP 954/2020, which forced telecoms to hand subscriber data to statistics agency IBGE; its reasoning recognised data protection as an autonomous fundamental right derived from the Constitution.
Supremo Tribunal Federal ↗President Michel Temer signed Brazil's first comprehensive, GDPR-inspired data protection statute into law, creating the framework that governs personal data processing nationwide.
ANPD ↗Brazil's 'Internet Bill of Rights' established net neutrality, intermediary liability rules, and the first binding privacy and personal-data protection principles for online activity, laying the groundwork for the LGPD.
Câmara dos Deputados ↗Brazil - other topics
Data & Privacy in other countries
Last verified 8/13/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →