Brazil Data Removal Guide (2026)
Brazilian residents are protected by the LGPD (Lei Geral de Proteção de Dados), which grants comprehensive rights to confirm, access, correct, anonymize, and delete personal data from corporate registries, credit bureaus, and international data brokers.
Research status: published guide pending fresh official-source re-verification.
This page is educational orientation, not legal advice. The legal fields below are a research snapshot; eligibility, exemptions, deadlines, penalty rules and broker routes can change. Verify the current statute and regulator guidance before relying on a right or filing a complaint.
At a glance
- Governing law
- LGPD
- Response deadline
- 15 days for simplified requests; immediate for confirmation of processing
- Regulator
- Autoridade Nacional de Proteção de Dados (ANPD)
- Private right of action
- Yes: civil compensation under Article 42 LGPD and Código de Defesa do Consumidor
Lei Geral de Proteção de Dados Pessoais (LGPD, Lei nº 13.709/2018)
Enacted as Federal Law No. 13,709/2018, the LGPD governs public and private data processing across Brazil. Enforced by the ANPD (Autoridade Nacional de Proteção de Dados), it gives data subjects statutory rights to eliminate data processed under consent and revoke consent at any time without fees.
Read the full LGPDexplainer →Scope, penalties, private right of action, enforcement history.
What rights do Brazil residents have?
- →Right to confirmation of the existence of data processing (Article 18, I)
- →Right of access to personal data (Article 18, II)
- →Right to correction of incomplete, inaccurate, or outdated data (Article 18, III)
- →Right to anonymization, blocking, or elimination of unnecessary or excessive data (Article 18, IV)
- →Right to elimination of personal data processed with consent (Article 18, VI)
- →Right to information about public and private entities with which data is shared (Article 18, VII)
- →Right to revoke consent (Article 18, IX)
Who holds your data in Brazil?
In Brazil, personal data aggregation is heavily driven by credit intelligence bureaus (Serasa Experian, Boa Vista SCPC, Quod), marketing data brokers, and government registry scraping (CNPJ company records, Receita Federal public databases). Leakage of CPF numbers, phone numbers, and addresses is commonly exploited by unauthorized telemarketing lists and B2B aggregators.
Public-record sources brokers scrape
- Receita Federal public databases and corporate partner registries (Redesim / CNPJ records)
- Credit bureau databases (Serasa Experian, SPC Brasil, Boa Vista SCPC)
- Cartórios de Registro de Imóveis (Real Estate Notary Records)
- Telecom operator directories and marketing lead aggregators
How to remove your data in Brazil
- 1Submit Article 18 deletion and consent revocation requests to major Brazilian credit bureaus and marketing list brokers.
- 2Register on the official Anatel "Não Me Perturbe" national telemarketing blocklist (naomeperturbe.com.br).
- 3Request removal of personal phone and address details from CNPJ aggregation websites and business directories.
- 4Send formal LGPD deletion notices to international data brokers profiling Brazilian consumers.
- 5File a formal petition (Peticionamento Eletrônico) with the ANPD if a broker fails to respond within 15 days.
Ready to remove
Review 1009 US/global broker workflows for $9
Much of Brazil residents' data is held by US-based people-search brokers. OfflistMe drafts a legally structured deletion email for each one, sent from your own inbox, no account, no ID upload. Pair it with the Brazil-specific steps above.
Request Removal NowWhat if a company ignores your request?
File a complaint with the Autoridade Nacional de Proteção de Dados (ANPD). The maximum penalty in Brazil is R$ 50 million per infraction or 2% of annual revenue in Brazil, and you may have a private right of action (Yes: civil compensation under Article 42 LGPD and Código de Defesa do Consumidor).
File a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) ↗FAQ: Brazil data removal
How long do Brazilian data brokers have to answer an LGPD request?+
Under Article 19 of the LGPD, data controllers must provide a simplified confirmation of processing immediately, or provide a complete, detailed response within 15 days from the date of the request.
Can I remove my CPF and home address from Brazilian websites?+
Yes. Under Article 18 of the LGPD, you have the statutory right to demand the anonymization, blocking, or elimination of unnecessary or excessive personal data, as well as the deletion of data processed without a valid legal basis.