After several discussions and postponements, the Brazilian General Data Protection Law (LGPD), Federal Law no. 13,709/2018, entered into force on September 18, 2020. The LGPD is Brazil’s first comprehensive data protection regulation, and it broadly aligns with the EU General Data Protection Act (GDPR).
Although the law has been in force since 2020, the penalties issued by the LGPD only became enforceable on August 1, 2021. However, public authorities (such as consumer protection bodies and public prosecutors) and data subjects could enforce their rights under the LGPD as of September 18, 2020.
Before the enactment of the LGPD, data privacy regulations in Brazil consisted of various provisions spread across Brazilian legislation. For example, Federal Law no. 12,965/2014 and its regulating Decree no. 8,771/16 (together, the Brazilian Internet Act) imposed requirements regarding security and the processing of personal data and other obligations on service providers, networks, and applications providers, and provided rights for Internet users.
The following laws also contain general provisions and principles applicable to data protection:
Additionally, there are laws that regulate the processing and safeguarding of documents and information handled by governmental entities and public bodies.
The LGPD applies to any processing operation carried out by a natural person or a legal entity (of public or private law), irrespective of (1) the means used for the processing, (2) the country in which its headquarter is located, or (3) the country where the data are located, provided that:
On the other hand, the law does not apply to the processing of personal data that is:
In addition, on October 20, 2021, the Brazilian Senate unanimously approved the Proposed Amendment to the Constitution (“PEC”) no. 17/2019, which includes in the Federal Constitution the protection of personal data, including in digital media, as a fundamental right, and to refer privately to the Union (federal government) the responsibility to legislate on this subject. As of February 10, 2022, data protection is now encompassed by the Federal Constitution as a fundamental right.
After several discussions and postponements, the Brazilian General Data Protection Law (LGPD), Federal Law no. 13,709/2018, entered into force on September 18, 2020. The LGPD is Brazil’s first comprehensive data protection regulation, and it broadly aligns with the EU General Data Protection Act (GDPR).
Although the law has been in force since 2020, the penalties issued by the LGPD only became enforceable on August 1, 2021. However, public authorities (such as consumer protection bodies and public prosecutors) and data subjects could enforce their rights under the LGPD as of September 18, 2020.
Before the enactment of the LGPD, data privacy regulations in Brazil consisted of various provisions spread across Brazilian legislation. For example, Federal Law no. 12,965/2014 and its regulating Decree no. 8,771/16 (together, the Brazilian Internet Act) imposed requirements regarding security and the processing of personal data and other obligations on service providers, networks, and applications providers, and provided rights for Internet users.
The following laws also contain general provisions and principles applicable to data protection:
Additionally, there are laws that regulate the processing and safeguarding of documents and information handled by governmental entities and public bodies.
The LGPD applies to any processing operation carried out by a natural person or a legal entity (of public or private law), irrespective of (1) the means used for the processing, (2) the country in which its headquarter is located, or (3) the country where the data are located, provided that:
On the other hand, the law does not apply to the processing of personal data that is:
In addition, on October 20, 2021, the Brazilian Senate unanimously approved the Proposed Amendment to the Constitution (“PEC”) no. 17/2019, which includes in the Federal Constitution the protection of personal data, including in digital media, as a fundamental right, and to refer privately to the Union (federal government) the responsibility to legislate on this subject. As of February 10, 2022, data protection is now encompassed by the Federal Constitution as a fundamental right.
The LGPD defines personal data as any information related to an identified or identifiable natural person.
Anonymized data is not considered personal data, except when the process of anonymization has been reversed or if it can be reversed applying reasonable efforts.
The LGPD defines sensitive personal data as any personal data concerning:
The LGPD established the National Data Protection Authority (ANPD). On October 25, 2022, Law 14,460/2022 was published, altering ANPD’s role into a special and independent autarchic regime with administrative and budgetary autonomy as opposed to linking the ANPD to the Presidency of the Republic. The ANPD is also given technical and decision-making autonomy with jurisdiction over the Brazilian territory. In addition, the ANPD will have its own appointed public attorneys, which enables the National Authority to independently take judicial measures that it deems appropriate.
The ANPD is now in operation and it is headquartered in the Federal District. Its structuring process started on August 27, 2020, with the publication of Decree No. 10,474/2020, which approved and regulated the regulatory structure of the ANPD, and its board of commissioned positions and nominated trust functions. On November 6, 2020, this Decree entered into force with the appointment of the Director-President and the members of the Board of Directors of the ANPD, after having been approved by the plenary of the Federal Senate. On March 9, 2021, the ANPD’s Internal Regulations were published, establishing the competencies and organization of the National Authority.
The ANPD is composed of:
The ANPD has the authority to issue sanctions for violations of the LGPD. This sanctions authority came into force on August 1, 2021. On October 29, 2021, the ANPD issued Regulation CD/ANPD 01/2021 for the Regulation of the Inspection Process and the Sanctioning Administrative Process, establishing the procedures regarding the supervision and enforcement of the LGPD. However, the Regulation is still pending further instructions relating to the parameters of calculation of such penalties, which are expected to be regulated by the end of 2023.
In August 2021, the President of the Republic appointed representatives of the National Council for Personal Data and Privacy Protection (Council). The Council contributes to the performance of the ANPD and has the authority to, among other things:
In addition, the ANPD Council is responsible for, among other functions:
Since the ANPD started its operations, several actions have already been implemented to protect personal data, including:
However, there are still several provisions of the LGPD requiring further regulation and interpretation by the ANPD, which stakeholders should monitor for future compliance.
Last modified 28 Jan 2024There is currently no requirement to register with the National Data Protection Authority under Brazilian law.
Last modified 28 Jan 2024The LGPD creates the position of Chief of Data Processing, which is the data protection officer (DPO) in charge of data processing operations. The DPO is responsible for the following:
The LGPD provides the National Data Protection Authority the power to further establish supplementary rules concerning the definition and the duties of the DPO, including scenarios in which the appointment of such person may be waived, according to the nature and the size of the entity or the volume of data processing operations.
Currently, with the exception mentioned below, every company, public or private, should appoint a DPO. This general obligation extends to all types of activities and volumes of data processing subject to the LGPD (as set out in the “Guidance on Processing Agents and DPO” published by ANPD in May 2021). In any case, all companies should monitor this space for future guidance. On December 23, 2022, the ANPD published updated breach guidelines, which require companies to provide the DPO’s nomination declaration as a necessary document to report any breaches. Therefore, although is not expressly required by the LGPD, it must practically be considered as essential and necessary documentation.
On August 30, 2021, the ANPD issued a Public Consultation related to a Resolution with special rules on the application of the LGPD to small businesses, startups, and innovative companies, as defined by the law, except for those performing data processing activities which incur in high risks for data subjects. 1 As a result, on January 28, 2022, the ANPD published Regulation CD/ANPD 02/2022, which establishes simpler obligations for small businesses, including an exception to nominate a DPO.
There is no prohibition against companies using an external DPO or against DPOs performing the same function for more than one company simultaneously. Likewise, the LGPD does not distinguish whether the DPO must be an individual or a legal entity.
Due to the absence of legal or regulatory requirements, there is no need to communicate or record the identity and contact information of the DPO with the ANPD.
The following entities are considered Small-Sized Processing Agents:
Small-Sized Processing Agents must not earn gross revenue higher than BRL 4.800.000,00, or, in the case of start-ups BRL 16.000.000,00, nor belong to an economic group whose global revenue exceeds the limits, as defined by the corresponding laws or perform high-risk processing. According to the Regulation, a high-risk data processing activity meets at least one general and one specific criteria among those listed in the Regulation. General criteria are: (i) processing of personal data in large scale; and (ii) processing of personal data which may significantly affect the data subjects’ interests and fundamental rights, while specific criteria is (i) use of emerging or innovative technologies; (ii) vigilance or control of public accessible areas; (iii) decisions made exclusively with basis on automated data processing; and (iv) use of sensitive data or personal data belonging to children, adolescents and elderly people.
Last modified 28 Jan 2024Under the LGPD, collecting and processing are referred to as "data treatment", and defined as all operations carried out with personal data, such as:
The processing of personal data may only be carried out based on one of the following legal bases:
Notwithstanding the above, personal data processing must be carried out in good faith and based on the following principles:
As for the processing of sensitive personal data, the processing can only occur when the data subject or their legal representative consents specifically and in highlight, for specific purposes; or, without consent, under the following situations:
The controller and operator must keep records of the data processing operations they carry out, mainly when the processing is based on a legitimate interest.
In this sense, the ANPD may determine that the controller must prepare an Impact Report on Protection of Personal Data, including sensitive data, referring to its data processing operations, pursuant to regulations, subject to commercial and industrial secrecy. The report must contain at least a description of the types of data collected, the methodology used for collection and for ensuring the security of the information, and the analysis of the controller regarding the adopted measures, safeguards and mechanisms of risk mitigation.
On January 28, 2022, the ANPD published Regulation CD/ANPD 02/2022, which provides special rules on the application of the LGPD to small businesses, startups, and innovative companies, as defined by the law, except to those performing data processing activities which incur in high risks for data subjects. 1 This Regulation includes certain exemptions and flexibilities, reducing obligations under the law. For example a simplified template of records of data processing activities, which will be made available by the ANPD.
The following entities are considered Small-Sized Processing Agents:
Small-Sized Processing Agents must not earn gross revenue higher than BRL 4.800.000,00, or, in the case of start-ups BRL 16.000.000,00, nor belong to an economic group whose global revenue exceeds the limits, as defined by the corresponding laws or perform high-risk processing. According to the Regulation, a high-risk data processing activity meets at least one general and one specific criteria among those listed in the Regulation. A general criteria is (i) processing of personal data in large scale; and (ii) processing of personal data which may significantly affect the data subjects’ interests and fundamental rights, while specific criteria is (i) use of emerging or innovative technologies; (ii) vigilance or control of public accessible areas; (iii) decisions made exclusively with basis on automated data processing; and (iv) use of sensitive data or personal data belonging to children, adolescents and elderly people.
Last modified 28 Jan 2024The transfer of personal data to other jurisdictions is allowed only subject to compliance with the requirements of the LGPD. Prior specific and informed consent is needed for such transfer, unless:
On May 05, 2022, ANPD opened a public consultation regarding international transfers regulation. However, such regulation is pending but expected to be published sometime in 2023.
Last modified 28 Jan 2024Controllers and processors must adopt technical and administrative security measures designed to protect personal data from:
The LGPD grants the ANPD authority to establish minimum technical standards for companies to implement.
On 4 October 2021, the ANPD launched information security guidelines aimed at small data processing agents (such as microenterprises, small businesses, and startups) to assist them with good practices in implementing technical and administrative information security measures for the protection of personal data. The guidelines also contain a checklist to facilitate the visualization of suggestions, such as awareness and training programs, agreements management, access controls, data storage guidelines, and vulnerability management.
On November 04, 2022, the ANPD published its Regulatory Agenda for 2023/2024 and made the regulation of technical and administrative security measures a priority for the period, determining the start of the regulation procedures until the beginning of 2024.
The Brazilian Internet Act further establishes that service providers, networks and applications providers should keep access records (such as IP addresses and logins) confidential and in a secured and controlled environment. Guidelines issued under the Internet Act established guidelines on appropriate security controls, including:
According to the LGPD, any unauthorized accesses and from accidental or unlawful situations of destruction, loss, alteration, communication or diffusion is considered a breach. The controller is responsible for reporting to ANPD and the data subject within a reasonable timeframe if the breach is likely to result in risk or harm to data subjects. The LGPD itself does not set a specific deadline for notifying the ANPD in the event of security incidents. However, according to guidance published by the National Authority on February 22, 2021, the communication must be made within two (2) working days, counted from the date of receiving knowledge of the incident.
In addition, according to these guidelines, the company or person responsible for the data must internally assess the incident and ascertain the nature, category, and number of data subjects affected.
On December 23, 2022, the ANPD published updated breach guidelines, which include additional recommendations (as further specified below) as well as an updated breach reporting form, which must be used for regulator notification if notification is required under the law. In the event of significant risk or damage to data subjects, individuals may need to be notified as well. Notification may be submitted by the Controller’s DPO or the legal representative, with the corresponding nomination documentation or power of attorney.
The notice must contain, at least, the following key information:
Additionally, the ANPD must verify the seriousness of the incident and may, if necessary to safeguard the data subject's rights, order the controller to adopt measures, such as the broad disclosure of the event in communications media, as well as measures to reverse or mitigate the effects of the incident.
The updated guidelines indicate that an unjustified delay in reporting a security incident that could cause significant risk or damage to data subjects may subject agents to the administrative sanctions provided under the LGPD. In case the Controller is unable to provide a complete breach notification within the two (2) working days period, the Controller must submit a preliminary notice with the corresponding justification. The preliminary notice must be supplemented as soon as possible and, at the latest, within 30 calendar days.
Although it is not necessary to provide the list of affected data subjects to the ANPD, the ANPD may request the Controller, at any time, to present a copy of the notice to the data subjects regarding the breach. Such notice to the data subject must be made individually, whenever possible, and can be carried out by any means, such as e-mail, letter or electronic message.
An additional recommendation, which is not legally required, is to implement contractual clauses establishing the obligations regarding notification of breaches between controllers and processors, seeking to expedite the assessment and minimize the risks to the data subjects.
On January 28, 2022, the ANPD published Regulation CD/ANPD 02/2022 which grants to small businesses, startups, and innovative companies, as defined by the law, except to those performing data processing activities which incur in high risks for data subjects the double deadline extension in the communication of security incidents, as well responding to data subjects’ requests, for communicating severe security incidents to the ANPD and affected data subjects, and for responding to ANPD’s requests.
Last modified 28 Jan 2024The LGPD provides for penalties in case of violations its provisions. Data processing agents that commit infractions can be subject to administrative sanctions, in a gradual, single or cumulative manner, including a fine, simple or daily, of up to 2% of the revenues of a private legal entity, group or conglomerate in Brazil, up to a total maximum of R$50 million per infraction.
Other sanctions can include:
Although the LGPD became effective September 18, 2020, the penalties provided by the law were only enforceable from August 1, 2021. In addition, the ANPD is now in operation and, on October 29, 2021, published the Regulation of the Inspection Process and the Sanctioning Administrative Process, which establishes the procedures applicable to ANPD’s inspection process and the rules to be observed during the administrative sanctioning process. However, it is still pending further instructions relating to the parameters of calculation of such penalties, which are expected to be regulated until the end of 2023. Because the ANPD has not imposed sanctions regarding violations to the LGPD yet, the level of enforcement activity is still uncertain.
Public authorities (such as consumer protection bodies and public prosecutors) are already monitoring data protection matters and applying penalties based on the LGPD obligations and other applicable laws. Additionally, data subjects may file lawsuits if any of the rights provided by the LGPD are violated. Under the law, a controller or processor that causes material, moral, individual, or collective damage to others is liable to individuals for such damages, including through a class action.
Exceptions to the obligation to remedy a violation exist only if:
Brazil has no specific law regulating electronic marketing communications. However, it is important to point out that, according to the LGPD, all processing of consumers’ personal data (which includes the collection, storage, and sending of marketing communications) can only occur upon the appropriate legal basis for such purpose. Under this scenario, two available legal bases could be used, depending on the analysis of the concrete case: (1) the data subject’s consent, or (2) the controller’s legitimate interest.
Despite the lack of a specific statute, general provisions on privacy and intimacy rights, as well as consumer protection rights, also apply to electronic marketing. Therefore, the sender should immediately cease sending any electronic marketing if the consumer requests (i.e., offering an opt-out option to electronic marketing).
Last modified 28 Jan 2024The Brazilian Internet Act has several provisions concerning the storage, use, disclosure, and other processing of data collected on the Internet. The established rights of privacy, intimacy, and consumer rights apply equally to electronic media, such as mobile devices and the Internet. Violations of these rights may also be subject to civil enforcement.
Furthermore, as explained in prior sections, identifiable data are also encompassed under the scope of protection of the LGPD. Thus, if cookies and location data are associated with a natural person, their collection should also observe the same obligations provided by the Brazilian data protection law. However, the obligation does not apply to anonymized data, which is not considered personal data under the LGPD unless the process of anonymization has been reversed or can be reversed using reasonable efforts.
That said, a proper legal basis is needed when using cookies and similar technologies that involve the processing of a user’s personal data from (e.g., the information is linked or linkable to a particular user, IP address, a device, or other particular identifier). Under this scenario, two available legal bases could be used, depending on the analysis of the concrete case: the data subject’s consent or the controller’s legitimate interest (in the case of essential cookies, for example).
On October, 2022, the ANPD published Cookie Guidelines establishing recommendations for cookie policy disclosures, such as to inform the categories of relevant cookies, their purposes, retention periods and whether the data collected through cookies is shared. Such disclosures must be provided to the data subject in a simplified and understandable format and manner. Further, the guidelines require collection of affirmative opt-in consent, for example through cookie banners, and provide the data subject with the possibility to reject the cookies at that time and revoke consent at any time later on.
