LGPD
Lei Geral de Proteção de Dados Pessoais (General Personal Data Protection Law)
Key Facts
Overview
The LGPD is Brazil's comprehensive data protection law, modeled after the GDPR with extraterritorial scope. It requires explicit consent with separate authorization per processing purpose. The ANPD has issued specific cookie guidance clarifying that non-essential cookies require prior consent.
What This Means for Your Website
- Explicit consent with separate authorization per purpose is required for Brazilian visitors
- Non-essential cookies require prior consent per ANPD cookie guidance
- A Data Protection Officer (Encarregado) must be appointed
- Penalties include publicization of the infraction, creating reputational risk beyond fines
- Extraterritorial scope applies to any processing of data of individuals in Brazil
- Data subject rights include access, correction, deletion, portability, and information on sharing
Key Requirements
The ANPD enforces the LGPD with penalties of up to 2% of annual revenue in Brazil, capped at BRL 50 million per infraction. Additional sanctions include daily fines, publicization of the infraction, and blocking or deletion of data. Data subject requests must be fulfilled within 15 days. The ANPD was elevated to independent authority status, strengthening enforcement capacity.
How ConsentStack Handles This
ConsentStack detects Brazilian visitors and presents a consent banner requiring explicit opt-in per purpose category, meeting ANPD cookie guidance requirements. Consent records are maintained for audit compliance.
Penalties
2% of annual revenue in Brazil, capped at BRL 50 million per infraction; daily fines; publicization of infraction; blocking/deletion of data.
Key Requirements
- Explicit consent with separate authorization per processing purpose
- Consent for non-essential cookies per ANPD guidance
- Appoint a Data Protection Officer (Encarregado)
- Data subject rights: access, correction, deletion, portability
- Data Protection Impact Assessments for high-risk processing
- Breach notification to ANPD and data subjects within reasonable time
Notable Provisions
- GDPR-modeled with extraterritorial reach
- ANPD elevated to independent authority status
- Separate consent per purpose required
- Penalties include publicization of infraction (reputational impact)
Data Subject Rights
Revoke consent at any time by express request through a free and easy procedure; processing done before the revocation stays valid unless you also ask for deletion.
Have easy access to clear information on the specific purpose, form and duration of the processing, the controller's identity and contact details, data sharing and its purpose, the processing agents' responsibilities and your rights, and be told whether you may refuse consent and what follows if you do.
Confirm whether a controller processes your personal data and access it, immediately in simplified form or as a complete declaration of the data's origin, the criteria used and the purpose; small processing agents get double time for the declaration.
Have incomplete, inaccurate or outdated personal data corrected; the LGPD leaves the response deadline to ANPD regulation.
Have unnecessary or excessive data, or data processed in breach of the LGPD, anonymized or blocked (processing temporarily suspended while the data is kept); the LGPD leaves the response deadline to ANPD regulation.
Have unnecessary, excessive or unlawfully processed data deleted, and data processed on the basis of your consent deleted unless article 16 lets the controller keep it (for example to meet a legal obligation); the LGPD leaves the response deadline to ANPD regulation.
Have your data ported to another provider on express request (not data the controller has anonymized), and get a full electronic copy in a reusable format where processing rests on consent or contract, both under ANPD regulation and subject to trade secrets; the LGPD leaves the deadline to ANPD regulation.
Learn which public and private entities the controller has shared your data with; the LGPD leaves the response deadline to ANPD regulation.
Petition the ANPD against the controller about your data, or take the matter to consumer protection bodies; the ANPD asks for proof that you first tried to exercise the right with the controller.
Oppose processing carried out under a legal basis other than consent when it does not comply with the LGPD; the LGPD leaves the response deadline to ANPD regulation.
Exercise these rights by express request, yourself or through a legally constituted representative, at no cost to you.
Request review of decisions made solely by automated processing that affect your interests, including decisions that define your personal, professional, consumer or credit profile or aspects of your personality, and get clear information on the criteria and procedures used, subject to trade secrets.
Personal data about your regular exercise of your rights cannot be used to your detriment.
Send complaints and communications to the controller's data protection officer (encarregado), whose duties include accepting them, giving clarifications and taking action; small processing agents without one must offer a communication channel.
Other Latin America & Caribbean Regulations
Frequently Asked Questions
Stay compliant with LGPD
ConsentStack helps you implement Opt-in consent for Brazil automatically.