Data & Privacy - Brazil

The LGPD (Law No. 13.709/2018) is a cross-sector statute modeled on the EU GDPR, regulating processing of personal data of natural persons by both public and private controllers and processors, whether by manual or digital means. It took full effect in 2020 (with administrative sanctions effective from August 2021).

The Autoridade Nacional de Proteção de Dados, created by Law No. 13.853/2019, is the autonomous federal authority that regulates, supervises, guides, and enforces the LGPD; its competence over personal-data protection prevails over correlated powers of other public bodies.

Processing must rely on one of ten legal bases set out in the law (e.g., consent, legitimate interest, legal/contractual obligation, public-policy execution); there is no hierarchy among them, and consent must be specific, informed, and revocable.

Article 18 guarantees rights including confirmation/access, correction, anonymization or deletion of unnecessary or unlawfully processed data, portability, information on sharing, and the right to object to processing carried out without consent.

Penalties (Arts. 52–53) range from warnings to fines of up to 2% of the entity's Brazilian revenue, capped at R$50 million per infraction, plus daily fines, publicization, blocking or deletion of data. ANPD Resolution CD/ANPD No. 4 of 24 Feb 2023 sets the methodology (dosimetria) for calculating these fines.

Constitutional Amendment No. 115/2022 (promulgated 10 Feb 2022) added the protection of personal data, including in digital media, to Article 5 of the Federal Constitution as an autonomous fundamental right and assigned the Union exclusive competence to legislate on and supervise the matter.