Brazil
Tier 2 Comprehensive law AmericasPrincipal framework: LGPD (2018). Regulator: ANPD. Mutual EU adequacy announced 27 Jan 2026 — the newest adequacy partner. The ANPD has an active regulatory agenda (transfers 2024, breach rules, AI overlap).
At a glance
- Principal law
- LGPD
- Regulator
- ANPD
- Breach notification
- 3 working days to the ANPD (Resolution 15/2024) and affected subjects
- Maximum penalty
- Up to 2% of Brazil revenue, capped R$50m per infraction
- DPO required
- Encarregado required as a rule; flexibility for small processors
- Digital consent age
- Parental consent for children under 12; best-interests rule for adolescents
- Extraterritorial reach
- Yes — offering goods or services in Brazil
Structure
- Structural pattern
- Not assessed
- Sub-jurisdictions
- None — no sub-national axis
- ISO code
- BR
A Pattern 4 jurisdiction has no sub-national layer to model. Devolution elsewhere in the legal system does not imply it here — check each Act rather than reasoning from the country.
Transfers and adequacy
- EU member
- No
- EEA member
- No
- Holds EU adequacy
- Yes
- Granted
- 26 January 2026
- Review
- 4-year periodic review
GDPR Art.45; mutual adequacy announced 27 Jan 2026. CORRECTION: Brazil now HOLDS adequacy (previously did not).
Instruments
How the concepts differ here
The governance concepts are written from a GDPR-family default. These are the recorded departures for this jurisdiction, including those inherited from its legal family. An absent entry means nobody has checked, not that the position matches the default.
| Concept | How it differs | Position here | Scope |
|---|---|---|---|
| Choosing and documenting a lawful basis | Works differently | Ten legal bases rather than six, including credit protection and health protection as free-standing grounds. | This jurisdiction |
| The rights, and how they interact | Additional requirement | Includes a right to information about public and private entities with which the controller has shared data, and an explicit right to review of automated decisions. | This jurisdiction |
Sources
- Regulator Agência Nacional de Proteção de Dados (ANPD)
- Primary Adequacy decision
- Primary LGPD — Planalto
- Regulator ANPD — regulator
Never independently verified — seeded from the prototype.