Lei Geral de Proteção de Dados (Brazil)
Tier 2 In forceTen chapters, 65 articles — visibly GDPR-inspired but with Brazilian choices: ten legal bases instead of six, credit protection as its own basis, and a lighter fine cap. Mutual EU adequacy since January 2026.
Identity
- Citation
- Lei Geral de Proteção de Dados Pessoais, Lei No. 13.709/2018, Brazil
- Jurisdiction
- Brazil
- Type
- comprehensive
Adopted 14 Aug 2018; in force 18 Sep 2020 (sanctions from Aug 2021)
Amended by: Law No. 13,853/2019 — created the ANPD
Structure
What each Part or Chapter does, and the provisions worth knowing inside it. An orientation to the shape of the instrument — not a substitute for reading the official text.
Chapter I — Preliminary provisions (Arts 1–6)
Scope, extraterritorial reach and the ten principles.
- Art 3 Territorial scope — processing in Brazil or aimed at people in Brazil.
- Art 6 Ten principles, including purpose, necessity and non-discrimination.
Chapter II — Processing (Arts 7–16)
The legal bases and the special rules for sensitive and children’s data.
- Art 7 Ten legal bases — including credit protection, unique to the LGPD.
- Art 11 Sensitive data.
- Art 14 Children and adolescents — best interests; parental consent under 12.
Chapter III — Data subject rights (Arts 17–22)
The rights list and the review of automated decisions.
- Art 18 Nine rights — confirmation, access, correction, anonymisation, portability, deletion.
- Art 20 Review of decisions taken solely by automated means.
Chapter IV — Public sector (Arts 23–32)
How government bodies process and share personal data.
Chapter V — International transfers (Arts 33–36)
The transfer routes the ANPD has since operationalised with its own SCCs.
- Art 33 Permitted transfer grounds, adequacy included.
Chapters VI–VII — Agents, the DPO and security (Arts 37–49)
Records, the encarregado, and breach duties.
- Art 41 The encarregado (DPO) — required as a rule.
- Art 48 Breach notification — now 3 working days under ANPD Resolution 15/2024.
Chapters VIII–X — Supervision, sanctions and the ANPD (Arts 52–65)
The sanctions ladder and the authority’s design.
- Art 52 Fines — up to 2% of Brazil revenue, capped R$50m per infraction.
Regulatory enforcement
Interactions and conflicts
Overlaps online with the Marco Civil da Internet (2014) and sector rules such as banking secrecy. The ANPD’s regulations (breach, SCCs, DPO guidance) carry much of the operational detail. Mutual adequacy with the EU announced 27 Jan 2026.
Sources
Never independently verified — seeded from the prototype.