Compliance
LGPD for Companies: The Complete Guide to Compliance and Data Protection
The LGPD imposes strict rules on the protection of personal data. Learn how to bring your company into compliance, avoid multi-million fines, and ensure legal compliance.
Table of Contents
What is the LGPD and how does it affect my company?
The LGPD (Lei Geral de Proteção de Dados, Brazil's General Data Protection Law) is the Brazilian legislation that regulates the processing of personal data. It applies to personal data processed in Brazil, aimed at people located in the country, or collected there, and requires a legal basis for each processing activity, adequate security measures, and processes to handle data subjects' rights. Non-compliance can lead to sanctions, including fines of up to R$ 50 million per violation.
The LGPD (Lei Geral de Proteção de Dados, Brazil's General Data Protection Law) - Law No. 13,709/2018 - set rules for the processing of personal data in Brazil. Beyond being a legal obligation, non-compliance can lead to sanctions that include fines of up to 2% of revenue, capped at R$ 50 million (BRL) per violation.
What Is the LGPD?
The LGPD is the Brazilian law that regulates the processing of personal data by individuals and legal entities, whether public or private. Inspired by the European GDPR, it came into force in September 2020.
Objectives of the Law:
- Protect the fundamental rights of freedom and privacy
- Guarantee the free development of personality
- Promote economic and technological development
- Encourage fair competition
Who Needs to Comply?
The LGPD applies to personal data processing carried out by individuals or legal entities, public or private, when (Art. 3):
- the processing takes place in Brazil;
- the processing aims to offer goods or services to, or process the data of, people located in Brazil; or
- the personal data was collected in Brazil.
The law sets out exceptions (Art. 4), such as processing by an individual for strictly private, non-economic purposes.
Company size: size does not exempt a company from the law, but it can change some obligations. ANPD Resolution CD/ANPD No. 2/2022 provides differentiated treatment for small processing agents: micro and small enterprises, including individual microentrepreneurs (MEI), as defined in Complementary Law No. 123/2006; startups, as defined in Complementary Law No. 182/2021; private legal entities, including non-profits; and individuals and unincorporated private entities that process personal data (Art. 2).
The regime is not available to agents that carry out high-risk processing, except in the cases set out in the resolution itself, whose gross revenue exceeds the legal limits, or that belong to an economic group whose global revenue exceeds those limits (Art. 3). High-risk processing is processing that meets, at the same time, a general criterion (large scale, or the potential to significantly affect data subjects' interests and fundamental rights) and a specific criterion (emerging or innovative technologies, surveillance of publicly accessible areas, decisions based solely on automated processing, or sensitive data or data of children, adolescents and the elderly) (Art. 4).
For those that qualify, the resolution provides, among other things: a simplified record of processing operations (Art. 9); no obligation to appoint a data protection officer, provided a communication channel with data subjects is available (Art. 11); a simplified information security policy (Art. 13); and doubled deadlines to respond to data subject requests, report security incidents and provide the complete statement to the data subject, among others (Art. 14). The regime does not exempt compliance with the other LGPD rules, including legal bases and principles (Art. 6), and the ANPD may require compliance with the waived obligations depending on the circumstances (Art. 16). Each company's situation should be assessed case by case.
Fundamental Concepts
Personal Data
Any information that identifies or could identify a person:
- Name, CPF, RG, driver's license (CNH)
- Email, phone number, address
- IP address, cookies, geolocation
- Photos, videos, audio
- Banking and financial data
Sensitive Data
Data concerning:
- Racial or ethnic origin
- Religious beliefs
- Political opinions
- Union membership
- Health or sex life
- Genetic or biometric data
Sensitive data is subject to stricter processing rules (Art. 11).
Processing Agents
- Controller: The party that makes decisions about processing
- Processor: The party that carries out the processing
- Officer (DPO): The channel between the company, data subjects, and the ANPD
Legal Bases for Processing
Personal data may only be processed on one of the legal bases in Art. 7 (for sensitive data, the bases in Art. 11 apply):
- Consent: The data subject explicitly authorizes it
- Compliance with a legal obligation
- Execution of public policies
- Studies by a research body
- Performance of a contract
- Regular exercise of rights
- Protection of life
- Protection of health
- Legitimate interest
- Credit protection
Data Subject Rights
Individuals have the right to:
- Confirmation: Know whether the company holds their data
- Access: See which data the company holds
- Correction: Correct inaccurate data
- Anonymization, blocking, or deletion: Of unnecessary data
- Portability: Receive their data in an interoperable format
- Deletion: Of data processed on the basis of consent
- Information: About whom the data has been shared with
- Withdrawal of consent: At any time
Penalties
The ANPD may impose:
- Warning: With a deadline for remediation
- Simple fine: Up to 2% of revenue (capped at R$ 50 million per violation)
- Daily fine: For each day of non-compliance
- Publicization: Public disclosure of the violation
- Blocking or deletion: Of the data
- Partial suspension: Of the database
- Total suspension: Of data processing
- Partial or total ban: On activities
Step-by-Step Compliance
1. Data Mapping
- What data do we collect?
- Where does it come from?
- How is it stored?
- Who has access?
- Whom do we share it with?
2. Data Classification
- Ordinary personal data
- Sensitive data
- Data of children/adolescents
3. Identify Legal Bases
For each processing activity, what is the legal basis?
4. Review Contracts
- Contracts with suppliers
- Contracts with customers
- Terms of use
- Privacy policy
5. Implement Technical Measures
- Data encryption
- Access control (RBAC)
- Audit logs
- Secure backups
- Anonymization whenever possible
6. Appoint a DPO
Designate a Data Protection Officer (in-house or outsourced). Small processing agents may be exempt from this appointment, as long as they keep a communication channel with data subjects.
7. Create Processes
- Handling data subject requests
- Incident response
- Breach notification
- Data Protection Impact Assessment (RIPD)
8. Train the Team
Employees who handle personal data need to know the applicable rules and their responsibilities.
Security Incidents
Not every security incident has to be reported. Under the Security Incident Reporting Regulation (Resolution CD/ANPD No. 15/2024), reporting is mandatory when the incident may cause relevant risk or harm to data subjects (Art. 48 of the LGPD and Art. 4 of the resolution). That is the case when the incident may significantly affect data subjects' interests and fundamental rights and, cumulatively, involves at least one of these criteria: sensitive personal data; data of children, adolescents or the elderly; financial data; system authentication data; data protected by legal, judicial or professional secrecy; or large-scale data (Art. 5).
In those cases, the controller must:
- Notify the ANPD within three business days, counted from when the controller becomes aware that the incident affected personal data, unless specific legislation sets another deadline (Art. 6)
- Notify the affected data subjects within the same three business days, counted from the same moment (Art. 9)
- Take measures to reverse or mitigate the effects of the incident
The information reported to the ANPD may be supplemented, with justification, within twenty business days from the date of the notification (Art. 6, § 3). That is the deadline to supplement a notification already made, not to report the incident. For small processing agents, the reporting and supplementing deadlines are doubled (Art. 6, § 8, and Art. 9, § 6).
Whether or not it is reported, the controller must keep a record of every security incident, including those not reported to the ANPD and the data subjects, for at least five years from the date of the record, unless other obligations require a longer period (Art. 10).
LGPD Checklist
- Data mapping completed
- Legal bases identified
- Privacy Policy updated
- Consent form created (if applicable)
- Data protection officer appointed, when required, and contact channel published
- Supplier contracts reviewed
- Security measures implemented
- Incident response process created
- Team trained
- RIPD prepared (if applicable)
Need Help?
LoPrestiSec supports LGPD compliance on the information security side:
- Security assessment and gap analysis
- Support implementing technical controls
- Security documentation (policies and impact reports)
- Pentests to validate protection measures
- Audit preparation
Legal analysis should be handled by specialized counsel. Contact: Request a quote
Useful Resources
Frequently Asked Questions
Get answers to the most common questions
Does my small business need to comply with the LGPD?
Yes. The LGPD applies regardless of company size. Small processing agents, such as micro and small enterprises (including individual microentrepreneurs) and startups, may receive differentiated treatment under ANPD Resolution CD/ANPD No. 2/2022, such as no obligation to appoint a data protection officer, provided a communication channel with data subjects is available, and doubled deadlines. The regime does not apply to agents that carry out high-risk processing, whose gross revenue exceeds the legal limits or that belong to an economic group exceeding them, and the ANPD may require compliance with the waived obligations.
What are the LGPD fines?
A simple fine can reach 2% of the legal entity's revenue in Brazil in the last fiscal year, excluding taxes, capped at R$ 50 million per violation. The law also provides for warnings, daily fines, publicization of the violation, blocking or deletion of the data, and suspension or prohibition of processing activities.
Do I need a DPO (Data Protection Officer)?
As a rule, yes: the controller must appoint a Data Protection Officer (DPO), who can be on the internal team or outsourced and is the point of contact between the company, data subjects, and the ANPD. Small processing agents that qualify under Resolution CD/ANPD No. 2/2022 are not required to appoint one, but must provide a communication channel with data subjects (Art. 11).
How do I bring my company into compliance with the LGPD?
Essential steps: (1) Map all personal data collected, (2) Create clear privacy policies, (3) Implement technical and administrative security measures, (4) Train the team, (5) Appoint a DPO, when required, (6) Prepare processes to handle data subjects' rights.
Still have questions? Reach out to us through the contact form or via WhatsApp.
