Brazil's Lei Geral de Protecao de Dados (LGPD) is the country's comprehensive data protection law, modelled on the GDPR. It applies to any organisation processing personal data of Brazilian residents, regardless of where the organisation is based.
What is LGPD?
The Lei Geral de Protecao de Dados (LGPD), Law No. 13,709/2018, is Brazil's comprehensive data protection legislation. Effective since September 2020, it establishes rules for the collection, use, processing, and storage of personal data of Brazilian residents, with enforcement by the Autoridade Nacional de Protecao de Dados (ANPD).
LGPD applies extraterritorially, any organisation worldwide that processes personal data of individuals located in Brazil must comply. It shares significant structural similarities with the GDPR, including 10 legal bases for processing, data subject rights, and DPO requirements.
Penalties for non-compliance can reach 2% of an organisation's revenue in Brazil, up to BRL 50 million per violation, making LGPD compliance a significant business risk for organisations operating in or serving the Brazilian market.
Compliance requirements
LGPD establishes comprehensive requirements for the processing of personal data of Brazilian residents, covering legal bases, data subject rights, and organisational accountability.
Identify and document a valid legal basis for each processing activity involving personal data of Brazilian residents, including consent, legitimate interest, or contractual necessity.
Implement processes to handle access, correction, deletion, portability, and objection requests from Brazilian data subjects within required timeframes.
Provide clear, accessible privacy notices to data subjects explaining how their personal data is collected, used, shared, and retained.
Appoint a Data Protection Officer (Encarregado) responsible for overseeing LGPD compliance and serving as the point of contact for the ANPD.
Maintain records of all personal data processing activities, including purposes, categories of data, recipients, and retention periods.
Implement appropriate safeguards for transfers of personal data outside Brazil, including adequacy decisions or standard contractual clauses.
Audit process
Netru manages the complete LGPD compliance journey, from mapping your personal data flows through to ongoing monitoring and ANPD liaison support.
We map all personal data flows involving Brazilian residents, identifying processing activities, data categories, and legal bases.
We assess your current privacy practices against LGPD requirements, producing a prioritised remediation roadmap.
We design your LGPD compliance programme, including policies, procedures, and governance structures.
We implement required controls, draft privacy notices, establish data subject rights workflows, and build your evidence library.
We provide DPO-as-a-Service or support your appointed DPO with ongoing compliance guidance and ANPD liaison.
We provide ongoing monitoring, annual reviews, and support for data subject requests and regulatory enquiries.
How Netru delivers it
Our team combines GDPR expertise with deep knowledge of LGPD's specific requirements. We map your data flows, implement controls, draft required documentation, and provide ongoing DPO support, helping you demonstrate compliance to Brazilian regulators and customers.
Talk to our teamBefore you talk to anyone