What Is LGPD? Lei Geral de Proteção de Dados Pessoais
The Lei Geral de Proteção de Dados Pessoais (General Personal Data Protection Law, Law No. 13,709 of 2018) is Brazil's comprehensive data protection framework. In force since 18 September 2020, with administrative sanctions enforceable from 1 August 2021, LGPD is closely modelled on EU GDPR and governs the processing of personal data by any entity, public or private, in Brazil. LGPD Article 7 lists ten legal bases for ordinary personal-data processing, including consent, legal obligation, public administration, research, contract, exercise of rights, protection of life, health care, legitimate interests, and credit protection. Sensitive data has a separate and narrower Article 11 list. LGPD also establishes the Autoridade Nacional de Proteção de Dados (ANPD) as the federal regulator. ANPD became fully operational in 2021 and publishes guidance and regulations on topics including administrative penalties, cookies, data protection officers, and international transfers. LGPD has extraterritorial scope: it applies to any processing operation where data was collected in Brazil, where the data subject was in Brazil at collection time, or where processing aims to offer goods or services to individuals in Brazil (Article 3).
At a glance
- Full name
- Lei Geral de Proteção de Dados Pessoais
- Short code
- LGPD
- Jurisdiction
- Brazil
- Enacted
- 2018
- Last major update
- In force 18 September 2020; administrative penalties enforceable from August 2021
- Regulator
- Autoridade Nacional de Proteção de Dados (ANPD)
- Private right of action
- Yes
- Statutory citation
- Lei nº 13.709, de 14 de agosto de 2018
International privacy-law explainer timeline
Enacted years are counted by decade from the published explainer dataset; the table lists the laws in each decade.
- Decade containing a highlighted explainer
- Other decades
195
Planning jurisdictions
167
Published law explainers
92
Partial official reviews
The ledger coverage split is 195 planning jurisdictions, 167 published law explainers, and 92 partial official reviews. 4 of 167 explainers lack an enacted year, so they are omitted from the decade counts.
Show the data as a table
| Decade | Explainers with an enacted year | Laws (short codes) |
|---|---|---|
| 1970s | 1 | Loi Informatique et Libertés |
| 1980s | 2 | Privacy Act 1988, Privacy Law 5741-1981 |
| 1990s | 2 | DSG, Constitution Article 28 |
| 2000s | 15 | PIPEDA, APPI, Law 25.326, Law on Personal Data Protection, Law 09-08, 152-FZ, Law No. 2008-12, Organic Law No. 2004-63, PDPA, DPA 2003, Art. 21(2), 25, 130–131 + Law 254, Lei n.º 133/V/2001, Uruguay Ley 18.331, Iran Electronic Commerce Act 2003, Saint Vincent and the Grenadines Privacy Act No. 18 of 2003 |
| 2010s | 81 | UK GDPR, LGPD (highlighted), BDSG, RA 10173, POPIA, Malaysia PDPA, Korea PIPA, UAVG, PECA + Art. 14, Law 29733, Thai PDPA, KVKK, Poland GDPR + UODO Act, Portugal GDPR + Lei 58/2019, Romania GDPR + Law 190/2018, Law 1581, Law No. 94-V, HO-49-N, Law 998-IIIQ, Info tv. + GDPR, Act No. 90/2018 + GDPR, Data Protection Act 2019, PDL, Law of 1 August 2018, Chapter 586, IKS, Act 843, Law 4624/2019, Law 87/2018, Act No. 18/2018 Coll., Law No. 2297-VI, Act on the Implementation of the GDPR, Law 125(I)/2018, Act No. 110/2019 Coll., Belgian Data Protection Act, Databeskyttelsesloven, Data Protection Act 1050/2018, Personal Data Act, Sectoral Privacy Protections, Law No. 18-07 + Law No. 25-11, Law No. 22/11, Data Protection Act 2013, Law No. 30 of 2018, Data Protection Act 2019-29, Code du numérique, Book V, ICM Act 2018 + NDGF 2025, Fragmented privacy framework, Ley 8968, Ley 172-13, GDPR + Data Protection Act, Mali Law 2013-015, Mauritania Law 2017-020, Mauritius DPA 2017, Nepal Privacy Act 2075, Panama Ley 81/2019, Qatar Law No. 13 of 2016, Saint Lucia DPA 2011, Togo Law 2019-014, Turkmenistan Law 519-V, Chad Law 007/PR/2015, Congo Law 29-2019, Côte d'Ivoire Law 2013-450, Equatorial Guinea Law 1/2016, Fiji Privacy Framework, Guinea Law L/2016/037/AN, Haiti 2018 Data Privacy Order, Lao Law 25/NA, Lebanon Law 81/2018, Lesotho Data Protection Act 2011, Madagascar Law 2014-038, Myanmar Privacy and Security Law, Nicaragua Law No. 787, Saint Kitts and Nevis DPA No. 5 of 2018, San Marino Law No. 171/2018, Lei n.º 03/2016, Law No. 1537, Trinidad and Tobago DPA 2011, Uganda DPA 2019, U.S. Privacy Law, Law No. O‘RQ-547, Law No. 13 of 2012 |
| 2020s | 62 | DPDP Act, PIPL, UAE PDPL, NDPA, PDPL, Law No. 91/2025, Act No. 63 of 2026, Law 21.719, Law No. 151 of 2020, UU PDP, LFPDPPP (2025), Law 124/2024, Law 12/25, Data Protection Act 2020, Digital Code, Law no. 195/2024, Law on Personal Data Protection, Law No. 3144, Law 42/2020, ZVOP-2, PDPA, LQPD, Law No. 99-Z, Data Protection Act 2021, Data Protection Act 2024, PDPO 2025, Loi n°001-2021/AN, Law No. 1/03 of 2026, Law No. 2024/017, Law No. 24.001, LOPDP, LPDP, Malawi DPA 2024, Monaco Law 1.565, Oman PDPL, Paraguay Law 7593/2025, Rwanda Law 058/2021, Tanzania PDPA 2022, Vanuatu DPPA 2024, Zimbabwe Cyber and Data Protection Act, Cuba Law 149/2022, DPRK Information Law materials, DRC Digital Code 2023, Djibouti Digital Code 2025, Eswatini Data Protection Act 2022, Ethiopia Proclamation No. 1321/2024, Gabon Law 025/2023, Grenada Data Protection Act 2023, Guyana Data Protection Act 2023, Jordan Personal Data Protection Law No. 24 of 2023, Kiribati Data Protection Act 2025, Kuwait CITRA Decision 2024/26, Libya Law No. 6 of 2022, Liechtenstein DSG 2026, Marshall Islands PDPA 2025, Niger Law No. 2022-59, Seychelles Data Protection Act 2023, Somalia Data Protection Act 2023, Law No. 12 of 2024, Privacy Act 2025, Zambia Data Protection Act 2021, Decree DCLVII |
Sources: LGPD statutory citation · OfflistMe jurisdiction research ledger · Checked international explainers 2026-10-12; coverage ledger 2026-10-12
Scope, who LGPD covers
Continue with related privacy resources
Follow the route that matches your next question. Each link stays within a documented topic cluster and points to a canonical content page.
Protected data
Data subject rights
Right of confirmation that the processing exists (Article 18 I)
Right of access to data (Article 18 II)
Right of correction of incomplete, inaccurate, or outdated data (Article 18 III)
Right to anonymization, blocking, or deletion of unnecessary/excessive data (Article 18 IV)
Right of data portability to another provider (Article 18 V)
Right to deletion of personal data processed with consent (Article 18 VI)
Right to information about public and private entities with which data was shared (Article 18 VII)
Right to information about the possibility of denying consent and the consequences (Article 18 VIII)
Right to revocation of consent (Article 18 IX)
Notable features
LGPD's distinctive features include ten Article 7 legal bases for ordinary personal data, a separate regime for sensitive data, a specific framework for processing by public authorities, and a strong connection to Brazil's Federal Constitution right to data protection (added by Constitutional Amendment No. 115/2022 as a fundamental right). ANPD has also issued an International Data Transfer Regulation (Resolution 19/2024). In January 2026, ANPD announced mutual adequacy recognition with the European Union; the operative decision and its conditions still govern any transfer analysis.
Enforcement & penalties
Regulator: Autoridade Nacional de Proteção de Dados (ANPD)
Penalties: Administrative sanctions under Article 52: warning; simple fine up to 2% of revenue from the previous financial year in Brazil, capped at R$50 million per violation; daily fine up to R$50 million; publication of the violation; blocking of personal data; elimination of personal data; partial suspension of database operations (up to 6 months); partial or total prohibition of data-processing activities.
Private right of action: Article 42 LGPD creates an express right to compensation (material, moral, individual, or collective damages). Joint and several liability between controllers and processors applies. Consumer class actions (ações civis públicas) brought by Public Prosecutors (Ministério Público) and consumer protection authorities (Procons) have driven several high-profile LGPD settlements.
Relevance to data brokers
LGPD may apply to a data broker when the Article 3 territorial conditions are met, such as processing in Brazil, collection in Brazil, or offering goods or services to people in Brazil. The ANPD publishes current guidance and enforcement materials, but a named company investigation or a broker's legal status requires a separate current source review. Brazilian residents can use the ANPD's current complaint and petition routes. The statute's administrative sanctions and any collective or individual remedies depend on the applicable provision and facts.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Does LGPD apply to companies outside Brazil?+
Potentially. Article 3 gives LGPD extraterritorial scope when the processing operation is carried out in Brazil, the personal data were collected in Brazil, or the processing aims to offer goods or services to individuals located in Brazil. A US data broker is not subject solely to the LGPD because it holds information about a Brazilian resident; the relevant territorial facts and processing purpose must be assessed.
How do I file a complaint with ANPD?+
First make the rights request through the controller's official channel and keep proof of the request and response. If it is not resolved, use ANPD's current denúncia/petição route; a titular petition requires identification and evidence of the prior controller request, and ANPD says these submissions may inform broader supervision rather than guarantee direct resolution of an individual case. ANPD can apply LGPD administrative sanctions within its authority; the Ministério Público and consumer-protection authorities (Procons) are separate channels for matters within their competence.
What are the 10 legal bases for processing under LGPD?+
Per Article 7: (1) consent, (2) compliance with legal/regulatory obligation, (3) public administration processing, (4) studies by research bodies, (5) contract performance, (6) judicial proceedings, (7) legitimate interest, (8) credit protection, (9) protection of life/physical safety, (10) health protection. Sensitive data has a separate, narrower set of legal bases under Article 11.
Official sources & citations
- LGPD. Full Statutory Text (Portuguese)
- ANPD. Official Site
- ANPD. Resolution on Administrative Penalties (CD/ANPD No. 4/2023)
- ANPD. Frequently asked questions: legal bases
- ANPD. Resolution No. 32/2026: EU adequacy decision
- ANPD. Data-subject rights and petitions
- LGPD. Unofficial English Translation (IAPP)
- ANPD: Brazil and EU mutual adequacy recognition announcement (January 2026)
Other international privacy regimes
LGPD sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: