Quick LGPD Primer: Scope, Principles, and Rights
Who Must Comply
Brazil's Lei Geral de Proteção de Dados (Law 13,709/2018) applies to any personal data processing conducted by natural persons or legal entities, regardless of processing location, when:
- Processing occurs in Brazilian territory
- Targeting individuals in Brazil with goods or services
- Data was collected in Brazil
Personal data encompasses any information linked to an identified or identifiable natural person. This broad definition captures names, email addresses, device identifiers, IP addresses, cookies, behavioral data, and any information that could identify someone directly or indirectly.
Exemptions include: personal/household processing, artistic/journalistic/academic purposes (with LGPD principles still applying), public security/national defense activities, anonymized data (where anonymization is irreversible with reasonable effort), and data originating outside Brazil not shared with Brazilian processing agents.
Core LGPD Principles
Article 6 establishes ten processing principles — four more than GDPR's six — that govern all personal data handling:
Purpose — Processing limited to legitimate, specific, explicit purposes disclosed to data subjects. Secondary use incompatible with original purpose is prohibited.
Adequacy — Processing must be compatible with stated purpose in collection context.
Necessity — Data minimization; collect only the minimum required for purpose achievement.
Free Access — Data subjects guaranteed facilitated, free consultation on form, duration, and data integrity.
Data Quality — Accuracy, clarity, relevance, and currency assured per context and purpose.
Transparency — Clear, accessible information on processing and agents, subject to trade secrets.
Security — Technical and administrative measures protecting against unauthorized access, destruction, loss, alteration, or dissemination.
Prevention — Measures to prevent harm from processing.
Non-discrimination — No processing for discriminatory, unlawful, or abusive purposes.
Accountability — Controllers and processors must prove effective compliance measures.
Article 18 grants data subjects nine rights exercisable at any time, free of charge:
Confirmation and access — Verify whether data is being processed and receive personal data. Controllers must provide immediate confirmation in simplified form, with detailed access within 15 days (half GDPR's 30-day timeline).
Correction — Fix incomplete, inaccurate, or outdated data immediately unless factually or legally impossible.
Deletion and blocking — Remove unnecessary, excessive, or non-compliant data. Article 16 establishes retention exceptions for legal obligations, regulatory requirements, and study by research entities.
Data portability — Receive data in structured, interoperable format for transfer to another provider, enabling switching services without losing information.
Information on sharing — Learn which public or private entities received their data, promoting transparency about data flows beyond the original controller.
Consent revocation — Withdraw consent without prejudice to processing completed before revocation.
These faster timelines create operational pressure compared to GDPR. Small-scale agents receive doubled timelines (30 days instead of 15), but most organizations face the standard deadline requiring automated fulfillment systems.
LGPD Compliance Roadmap: End-to-End Implementation
Phase 0: Governance and Leadership Buy-In
Successful LGPD compliance requires executive sponsorship and cross-functional coordination. Establish a privacy steering committee including legal counsel, IT/security, compliance, and business unit leaders. This committee provides strategic oversight, resolves conflicts, allocates resources, and approves policies.
Secure budget allocation for privacy software, counsel, training, and staff time. Calculate non-compliance costs — ANPD fines reach 2% of Brazilian revenue (capped at R$ 50M per infraction), plus reputational damage.
Phase 1: Data Mapping and Records of Processing
Article 37 requires comprehensive Records of Processing Activities, especially when processing relies on legitimate interest.
Data mapping workflow:
System inventory — Catalog all systems: CRMs, marketing platforms, analytics tools, databases, backup systems, email servers, file shares, cloud applications.
Data categorization — Classify by sensitivity. Regular personal data includes names, emails, addresses. Sensitive personal data includes racial/ethnic origin, religious beliefs, political opinions, health data, sexual life information, genetic data, biometric data.
Legal basis identification — Map each activity to one of LGPD's ten legal bases. Document why that basis applies and maintain evidence.
Retention determination — Establish retention periods with justification. Indefinite retention violates the necessity principle. Consider business needs, legal requirements, regulatory obligations.
Recipient identification — List all entities receiving data: internal departments, service providers, processors, marketing platforms, analytics providers.
Phase 2: Legal Bases and Lawful Processing Model
Article 7 establishes ten legal bases for processing — critically, there is no hierarchy; all are equally valid. Controllers must identify and document one applicable basis per processing activity.
The ten legal bases:
- Consent — Freely given, informed, active, unambiguous manifestation
- Legal/regulatory obligation — Compliance with statutory duties
- Public administration — Public policy execution by government entities
- Research purposes — By research entities, with anonymization where possible
- Contract performance — Necessary for contract execution or preliminary negotiation
- Exercise of legal rights — In judicial, administrative, or arbitration proceedings
- Life or physical safety — Protection of data subject or third parties
- Health protection — By health professionals or sanitary entities
- Legitimate interests — Controller/third-party interests when fundamental rights do not prevail
- Credit protection — Credit analysis and risk assessment
Consent as legal basis requires:
- Free consent (no coercion; easy withdrawal without penalty)
- Informed consent (clear information on purposes, retention, sharing, rights)
- Active consent (opt-in; pre-checked boxes are void)
- Purpose-specific consent (generic authorizations are void)
- Revocable consent (withdraw at any time without affecting non-consent-dependent services)
- Controller bears burden of proof—must document compliance with LGPD consent rules
Legitimate interest as legal basis requires a three-part assessment (though not statutorily mandated, ANPD enforcement has made it practically mandatory):
Legitimacy — Interest must be lawful, precisely articulated (not vague), and real/concrete (not speculative).
Necessity — Processing must be necessary; less intrusive alternatives must be ruled out.
Balancing — Controller's interest must not disproportionately override data subject rights/freedoms. Mitigation measures required if imbalance exists.
ANPD's Meta and X Corp rulings established that children and adolescents' data require heightened scrutiny. Controllers must explicitly document how processing serves the "best interest" of minors and provide risk mitigation like pseudonymization or consent mechanisms.
Phase 3: Data Protection Impact Assessments
Unlike GDPR Article 35, LGPD Article 38 grants ANPD discretion—the authority may request a Relatório de Impacto à Proteção de Dados (RIPD), particularly for legitimate interest processing.
Controllers in high-risk domains should prepare RIPDs proactively. ANPD's 2024-2025 roadmap prioritizes AI/facial recognition and children's data protection.
RIPD content: Processing description, risk assessment, technical/organizational measures, mitigation mechanisms, residual risk analysis.
Conduct DPIAs before implementing large-scale processing, systematic monitoring, automated decision-making, sensitive data processing, AI/machine learning systems, or children's data processing.
Phase 4: Data Subject Request Processes
Controllers must operationalize DSAR workflows with documented procedures.
Intake systems accept requests through web portals, dedicated email, postal mail, and phone lines. Identity verification prevents unauthorized access through government ID, security questions, or two-factor authentication.
Data retrieval requires mapping where personal data resides. Redaction procedures protect trade secrets and third-party data. Audit logs document who fulfilled requests, when, in what format.
The 15-day detailed access deadline is half GDPR's timeline. Organizations without automation struggle meeting this consistently.
Phase 5: Vendor and Subprocessor Controls
Processor obligations (Article 39) require controllers to implement comprehensive vendor management:
Processor contracts should specify processing scope (what data, for what purposes, how long), controller instructions (processor processes only per documented instructions), confidentiality commitments, security obligations, subprocessor restrictions, data subject request assistance, deletion/return on termination, and audit rights.
While LGPD doesn't mandate processor contracts (unlike GDPR Article 28), they're practically essential. Without formal agreements, responsibility allocation becomes ambiguous, and both parties face regulatory risk.
Vendor due diligence involves security assessments before engagement, annual security questionnaires, certification verification (ISO 27001, SOC 2), breach notification procedures, and subprocessor approval processes.
Contract templates should incorporate LGPD-specific clauses including Article 39 obligations, security measure requirements, breach notification (3-business-day ANPD timeline), data subject assistance, termination data handling, and audit cooperation.
Phase 6: Incident Response and Breach Notification
Resolution CD/ANPD No. 15 (April 2024) operationalized Article 48's breach notification requirements. A notifiable incident requires notification if it creates potential relevant risk involving:
- Sensitive data (racial, religious, political, health, biometric, genetic)
- Children or elderly data
- Financial data
- Authentication/system credentials
- Legally/judicially/professionally privileged data
- Large-scale data
Critical point: Actual harm is not required—potential relevant risk suffices.
Notification timelines:
- ANPD: 3 business days (6 for small-scale agents) via electronic form
- Data subjects: 3 business days (6 for small-scale agents) via direct communication or public channels
Incident registry must be maintained for 5 years minimum, even for non-notified incidents. ANPD may investigate unreported incidents independently and impose sanctions.
IAMSPE's 2023 sanction for failing to notify a 1.5M-record breach for three months demonstrated ANPD's strict enforcement of the 3-business-day threshold.
Phase 7: Monitoring, Auditing, and Continuous Improvement
Compliance is not a one-time project but an ongoing operational commitment.
Quarterly compliance reviews assess data processing changes, vendor additions/removals, policy updates, security incident patterns, and DSAR fulfillment metrics.
Annual comprehensive audits include full RoPA review, legitimate interest assessment updates, processor contract verification, security control testing, and staff training completion verification.
Continuous monitoring dashboards track DSAR response times, consent withdrawal rates, security incident frequency, vendor compliance scores, and training completion percentages.
