Brazil Data Removal Guide (2026)
Brazilian residents may exercise LGPD rights against covered controllers, including requests to confirm, access, correct, anonymize, block, or eliminate certain personal data. Those rights are not a universal command to delete an underlying public record, credit-bureau entry, or every international copy; legal bases, exceptions, retention duties, and the specific provider matter.
Research status: sources last checked 2026-09-07.
This page is educational orientation, not legal advice. The legal fields below are a research snapshot; eligibility, exemptions, deadlines, penalty rules and broker routes can change. Verify the current statute and regulator guidance before relying on a right or filing a complaint.
At a glance
- Governing law
- LGPD
- Response deadline
- Article 19 base rule: simplified confirmation/access immediately, or a clear and complete declaration within up to 15 days; sector-specific exceptions and qualifying small-agent rules may alter the period
- Regulator
- Autoridade Nacional de Proteรงรฃo de Dados (ANPD)
- Private right of action
- Potential civil compensation under Article 42 LGPD; applicable consumer-law remedies are separate
Lei Geral de Proteรงรฃo de Dados Pessoais (LGPD, Lei nยบ 13.709/2018)
Enacted as Federal Law No. 13,709/2018, the LGPD governs public and private data processing across Brazil. Enforced by the ANPD (Autoridade Nacional de Proteรงรฃo de Dados), it gives data subjects rights that can include confirmation, access, correction, anonymization, blocking, elimination, and consent withdrawal, subject to the legal basis, statutory exceptions, retention duties, and the request procedure.
Read the full LGPDexplainer โScope, penalties, private right of action, enforcement history.
What rights do Brazil residents have?
- โRight to confirmation of the existence of data processing (Article 18, I)
- โRight of access to personal data (Article 18, II)
- โRight to correction of incomplete, inaccurate, or outdated data (Article 18, III)
- โRight to anonymization, blocking, or elimination of unnecessary or excessive data (Article 18, IV)
- โRight to elimination of personal data processed with consent (Article 18, VI)
- โRight to information about public and private entities with which data is shared (Article 18, VII)
- โRight to revoke consent (Article 18, IX)
Who holds your data in Brazil?
A Brazilian request may involve a credit bureau, business or public-record source, directory, marketing provider, or international broker. Identify the controller, the exact listing, the source of the data, and the legal basis before choosing an LGPD request. A provider-level response does not automatically change an underlying government record or a separate copy held elsewhere.
Public-record sources brokers scrape
- Business and public-record sources such as CNPJ records; review the source's publication and correction rules
- Credit bureaus and provider profiles; use each provider's current privacy or rights route
- Property and notary records; source access, correction, and suppression depend on the applicable rules
- Telemarketing and lead sources; combine provider requests with relevant sector-specific controls
How to remove your data in Brazil
- 1Identify the controller and request the Article 18 right that fits the facts, such as access, correction, objection, anonymization, blocking, elimination, or consent revocation. Do not assume every request is a deletion request.
- 2For unwanted calls, use Anatel's current guidance and the official "Nรฃo Me Perturbe" service where its limited sector scope fits; it is not a general data-broker deletion tool.
- 3For CNPJ, business-directory, property, or other public-record copies, contact the relevant site and review the underlying source process separately. A site-level request does not automatically amend the official record.
- 4For an international broker, check whether LGPD Article 3 applies and use that provider's current privacy or rights route. Keep the exact listing and request evidence.
- 5If a controller does not handle the request or the response is unsatisfactory, preserve proof of the prior request and use the current ANPD petition route. ANPD review is generally aggregated and is not a guaranteed individual deletion or enforcement result.
Generate requests in under 60 seconds
Generate requests for 1,034 US/global broker workflows for $9
What if a company ignores your request?
Consider the Autoridade Nacional de Proteรงรฃo de Dados (ANPD) information or complaint route above if the controller does not respond or the response is unsatisfactory. This guide records the following penalty orientation: ANPD administrative simple fine: up to 2% of Brazil revenue, capped at R$ 50 million per infraction. The private-action note is: Potential civil compensation under Article 42 LGPD; applicable consumer-law remedies are separate. Neither field is an individual award or a promise of enforcement.
Open the Autoridade Nacional de Proteรงรฃo de Dados (ANPD) information or complaint route โFAQ: Brazil data removal
How long do Brazilian data brokers have to answer an LGPD request?+
Article 19 sets immediate simplified or up-to-15-day clear-and-complete confirmation/access timing. That rule is specific to confirmation or access requests; it is not a universal 15-day deadline for every correction, objection, anonymization, blocking, elimination, or consent-revocation request.
Can I remove my CPF and home address from Brazilian websites?+
You can request anonymization, blocking, or elimination of unnecessary or excessive data and may have deletion or consent-withdrawal rights under Article 18. Whether a provider must remove a particular CPF or address record depends on the legal basis, exceptions, retention duties, and the facts of the processing.