A European software company launches a Brazilian subsidiary. Within weeks, a local customer submits a data access request. The compliance team discovers there is no privacy notice in Portuguese, no appointed Encarregado (Data Protection Officer under Brazilian law), and no documented lawful basis for processing. The national supervisory authority – Autoridade Nacional de Proteção de Dados (ANPD, Brazil's data protection authority) – has published its enforcement priorities. Non-compliance carries the risk of fines, operational restrictions, and reputational damage that can undermine an entire market entry investment.
Data protection compliance in Brazil is governed by the Lei Geral de Proteção de Dados (LGPD. Brazil's General Data Protection Law). This applies to any processing of personal data of individuals located in Brazil, regardless of the processor's country of incorporation. Organisations must identify a lawful basis for each processing activity, appoint an Encarregado, publish an accessible privacy notice, and establish mechanisms for responding to data subject rights requests. The ANPD has enforcement powers including the authority to impose administrative fines, order suspension of processing activities, and publish the names of non-compliant organisations.
This guide covers the step-by-step compliance process, documentary requirements, the most common errors made by foreign businesses entering Brazil. Cost considerations. Additionally, a decision framework for choosing the right compliance approach for your organisation's specific risk profile.
Understanding Brazil's data protection legislative regime
Brazil's data protection legislation came into full effect in 2020. It draws significant inspiration from the European GDPR compliance model but contains important local distinctions that foreign businesses consistently underestimate.
The LGPD establishes ten lawful bases for processing personal data. These include consent, legitimate interest, compliance with a legal obligation, performance of a contract, and protection of life, among others. Unlike the GDPR, which treats sensitive data categories under a binary framework, the LGPD includes a distinct regime for sensitive personal data. which covers health information, biometric data, racial origin, religious beliefs, and political opinions. Processing sensitive data requires a narrower set of lawful bases and heightened safeguards.
The distinction between a data controller and a data processor under the LGPD mirrors the structure familiar from European regulation. The controller determines the purposes and means of processing. The processor acts on the controller's instructions. However, the LGPD imposes direct obligations on processors in certain scenarios – a departure from earlier civil law traditions in Brazil where contractual privity was the dominant governance mechanism. Practitioners in Brazil note that this creates a more complex accountability chain than many foreign businesses initially anticipate.
The ANPD has issued guidance on enforcement priorities and has initiated sector-specific investigations. Its approach has been graduated – focusing first on large-scale processors and public entities – but enforcement activity directed at private organisations, including foreign companies operating through Brazilian subsidiaries, has increased meaningfully. Businesses that treat LGPD compliance as a deferred task rather than a market entry prerequisite run a concrete risk of entering the ANPD's review scope before their internal controls are functional.
For organisations already familiar with GDPR compliance frameworks, the conceptual architecture of the LGPD will be recognisable. That familiarity is useful, but it can also lead to a critical error: assuming that a GDPR-compliant programme transplants directly into the Brazilian context. It does not. The lawful bases differ in wording and scope. Consent mechanism requirements have local nuances. Data transfer rules follow a distinct approval path. And the Encarregado appointment obligation is broader than its European counterpart.
For a detailed comparison of data transfer mechanisms across the Americas. Our guide on data protection compliance in the United States examines how the US regulatory environment differs from Brazil's centralised legislative model. a distinction that matters significantly for multinational compliance programmes.
Step-by-step compliance process and documentary requirements
Building a defensible compliance programme under Brazilian data protection legislation requires a structured sequence. The steps below reflect the order in which organisations should proceed, both to manage risk and to allocate internal resources efficiently.
Step 1 – Data mapping and processing inventory. The first task is identifying every processing activity in which the organisation engages. This means documenting: what personal data is collected, from which data subjects, for which purposes, on which lawful basis, for how long it is retained, and with which third parties it is shared. This inventory – often called a Records of Processing Activities or Registro de Operações de Tratamento – is not merely a compliance document. It is the foundation for every subsequent decision about consent mechanisms, data transfer arrangements, and data subject rights responses.
In practice, foreign companies frequently underestimate the volume of personal data their Brazilian operations process indirectly – through HR systems, CRM platforms, third-party analytics tools, and cloud infrastructure hosted outside Brazil. A common mistake is mapping only the data the company itself collects directly from customers, while omitting employee data, supplier contact data, and data flowing through integrated SaaS platforms.
Step 2 – Lawful basis assessment. For each processing activity identified in Step 1, the organisation must assign a lawful basis. This is a legal judgment, not a mechanical classification. Legitimate interest, for example, requires a balancing test – the controller's interest must not override the data subject's fundamental rights. Consent, where used, must be freely given, informed, and specific. It must also be revocable without detriment to the data subject. Organisations that rely on consent as a universal lawful basis – rather than selecting the most appropriate basis for each activity – create unnecessary operational fragility. If consent is withdrawn at scale, processing must stop.
Step 3 – Privacy notice drafting and publication. The LGPD requires controllers to provide data subjects with clear, accessible information about processing activities. In Brazil, this means a privacy notice drafted in Portuguese, written in plain language, and accessible at the point of data collection. A privacy notice that exists only in English, or that was translated mechanically from a European template, will not satisfy this requirement. The notice must specify the lawful basis for each processing activity, the data subject's rights, the contact details of the Encarregado, and the conditions under which data is shared or transferred internationally.
Step 4 – Data Protection Officer appointment. The Encarregado must be appointed by the controller and publicly identified. The ANPD expects the Encarregado's contact information to be readily accessible – typically on the company website. The Encarregado may be an employee or an external service provider. They serve as the primary interface between the organisation, data subjects who exercise their rights, and the ANPD. Failure to appoint and identify an Encarregado is one of the most frequently cited deficiencies in ANPD compliance reviews.
Step 5 – Data subject rights procedures. Brazilian data protection legislation grants data subjects a set of rights: access, correction, deletion, portability, information about sharing, and the right to revoke consent. The organisation must have documented internal procedures for receiving, validating, and responding to these requests within the timeframes prescribed by the legislation. A request that goes unanswered – or receives a generic automated reply – is treated as a violation. Many organisations entering Brazil for the first time lack any operational workflow for handling rights requests in Portuguese.
Step 6 – Data processing agreements. Where the organisation shares personal data with processors – cloud providers, payroll platforms, marketing agencies, logistics companies – it must execute data processing agreements. These agreements must specify the scope of processing, the processor's obligations, security measures, and the conditions for sub-processing. Simply relying on a processor's standard terms of service is not sufficient. The LGPD imposes joint liability in certain circumstances, meaning the controller can be held responsible for a processor's non-compliance if contractual safeguards were inadequate.
Step 7 – International data transfer assessment. If the organisation transfers personal data from Brazil to recipients in other countries – including transferring data to a parent company's servers located abroad – this constitutes an international data transfer under the LGPD. The legislation permits such transfers only under specific conditions: to countries or international organisations that provide an adequate level of protection recognised by the ANPD. Alternatively. Through standard contractual clauses, binding corporate rules, or specific consent. The ANPD has issued guidance on transfer mechanisms, but this area continues to evolve. Organisations that process data in the EU and Brazil simultaneously must map the interaction between GDPR and LGPD transfer obligations carefully. Our full-service support for data protection compliance in Brazil covers international transfer assessments and the drafting of compliant transfer mechanisms.
Step 8 – Security measures and incident response plan. The LGPD requires controllers and processors to adopt technical and administrative security measures proportionate to the risk of their processing activities. In the event of a security incident that may cause harm to data subjects, the organisation must notify the ANPD and, in many cases, the affected data subjects. The notification must be made within a reasonable period. A documented incident response plan – tested before an incident occurs – is essential. Organisations that discover a breach and have no internal escalation protocol consistently experience the most damaging regulatory outcomes.
To receive an expert assessment of your data protection compliance position in Brazil, contact us at info@ferrazwhitmore.com.
Common errors by foreign businesses and their consequences
Foreign companies entering Brazil with an established compliance culture frequently make a specific category of error: they assume their existing programme is adequate with minor localisation. Experience in cross-border data protection matters suggests this assumption is responsible for the majority of LGPD compliance gaps found during due diligence and regulatory reviews.
The most consequential errors fall into four patterns.
Treating the LGPD as a GDPR extension. A business that has invested in GDPR compliance will have a head start – the conceptual vocabulary is shared. However, the lawful bases differ in important ways. The LGPD's treatment of legitimate interest requires documentation of a balancing test, but the standard applied by Brazilian courts and the ANPD does not map directly onto European interpretations. Consent mechanism requirements also diverge. A business that copies its EU consent notices into Portuguese without reviewing the local legal standard risks deploying a mechanism that does not satisfy the LGPD's requirements.
Overlooking the Encarregado appointment scope. Under GDPR compliance rules, the DPA appointment obligation applies primarily to large-scale processors and processors handling sensitive data categories. Under the LGPD, the obligation is broader. A small company processing only customer contact data for service delivery purposes is still required to appoint and publicly identify an Encarregado. Many foreign businesses of modest size in Brazil assume this obligation does not apply to them. It does.
Inadequate data processing agreements with local suppliers. Brazilian operations typically involve local partners – distributors, logistics providers, marketing agencies. These relationships involve personal data flows. Local suppliers are not always familiar with their obligations as processors under the LGPD, and they may resist signing data processing agreements. However, the controller's exposure does not diminish because the processor is uncooperative. Where a supplier processes personal data on behalf of a foreign controller and has no data processing agreement in place, the controller bears the compliance risk for the entire processing chain.
Unaddressed cross-border data transfers. Multinational companies routinely route data from their Brazilian operations through global IT infrastructure. Employee data may flow to an HR platform based in the United States. Customer data may be processed on servers in Europe. Each of these flows constitutes an international data transfer under the LGPD. Without a documented lawful transfer mechanism, each flow represents a continuing violation. This issue is particularly acute for technology companies whose products collect data from Brazilian users through platforms hosted abroad. The intersection of Brazilian data protection legislation and AI-driven data processing raises additional considerations – our analysis of AI law in Brazil addresses the data governance dimensions of automated decision-making under local regulation.
The consequences of these errors are not merely theoretical. The ANPD has the power to impose fines of up to two percent of an organisation's revenue in Brazil in the prior financial year, capped at a significant aggregate amount. Beyond fines, the ANPD can order the suspension or prohibition of processing activities entirely – a sanction that can halt operations for companies whose business model depends on data processing. Reputational exposure from public naming of non-compliant organisations is an additional risk that boards and investors in Brazil increasingly factor into due diligence assessments.
Decision framework and self-assessment checklist
Not every organisation faces identical compliance requirements under the LGPD. The appropriate compliance investment – in terms of time, budget, and internal resources – depends on the nature and volume of processing activities, the types of data involved, and the organisation's existing control environment. The following framework helps organisations calibrate their approach.
Scenario A – Small foreign company, limited Brazil footprint. An organisation with fewer than ten employees in Brazil, processing only employee and direct customer data. With no sensitive data categories and no international transfers beyond its own internal systems, can typically achieve baseline compliance within four to six weeks. The minimum programme consists of: a data processing inventory, a Portuguese-language privacy notice, appointment and public identification of an Encarregado, data subject rights procedures, and data processing agreements with any third-party processors. Legal fees for this scope typically fall in the low thousands of euros or the equivalent in Brazilian reais.
Scenario B – Mid-size company with digital product or platform. An organisation operating a digital product accessible to Brazilian users, processing behavioural data, geolocation data, or financial data, must invest more substantially. Lawful basis analysis becomes more complex. Consent mechanisms must be designed and technically implemented. Data transfer mechanisms must be documented. An incident response plan is essential. This scope typically requires two to four months and involves both legal counsel and technical implementation. Organisations in this category should budget meaningfully for the initial compliance build and for ongoing legal support as the ANPD's guidance continues to develop.
Scenario C – Large enterprise or financial services entity. Organisations in regulated sectors – financial services, health, telecommunications – face additional sector-specific data protection obligations layered on top of the LGPD. The compliance programme must address both the general legislative regime and the sector regulator's requirements. This typically involves a full data protection impact assessment for high-risk processing activities, binding corporate rules or standard contractual clauses for international transfers, and a dedicated internal compliance function or outsourced DPA service. This scope runs three to six months for initial implementation and requires sustained legal and operational investment.
Before initiating any compliance programme, verify the following:
- Has the organisation mapped all personal data it processes in Brazil – including employee, customer, supplier, and third-party platform data?
- Has a lawful basis been identified and documented for each processing activity?
- Has an Encarregado been appointed and publicly identified on the company website?
- Are privacy notices available in Portuguese and accessible at the point of data collection?
- Are data processing agreements in place with all third-party processors?
- Have international data transfers been identified and covered by a lawful transfer mechanism?
- Is there a documented and tested incident response procedure?
A programme that satisfies all seven items above meets the baseline standard the ANPD uses as the reference point for assessing good-faith compliance. Organisations that cannot confirm all seven items are exposed – the degree of exposure depends on the volume and sensitivity of data being processed.
For a tailored compliance strategy for your operations in Brazil, reach out to info@ferrazwhitmore.com.
Frequently asked questions
Q: Does Brazil's data protection law apply to foreign companies without a physical presence in Brazil?
A: Yes. Brazilian data protection legislation applies to any organisation that processes personal data of individuals located in Brazil, regardless of where the organisation is incorporated or based. A foreign company operating an e-commerce platform, a SaaS product, or any digital service accessible to Brazilian users is subject to the same obligations as a locally incorporated entity. Engaging a lawyer in Brazil with cross-border experience is strongly recommended before launching operations.
Q: How long does it typically take to build a compliant data protection programme in Brazil?
A: A baseline compliance programme – covering data mapping, updated privacy notices, consent mechanisms, and a data processing register – can be structured in four to eight weeks for a small to mid-size organisation. Larger enterprises with complex processing activities, multiple processors, and cross-border data transfers typically require three to six months for a full compliance rollout. The timeline depends heavily on the volume of personal data processed and the maturity of existing internal controls.
Q: Is appointing a Data Protection Officer mandatory under Brazilian data protection law?
A: Brazilian data protection legislation requires controllers to appoint a Data Protection Officer, known locally as the Encarregado. Unlike some other jurisdictions, this obligation applies broadly rather than only in high-risk processing scenarios. The Encarregado must be publicly identified, typically on the company website, and serves as the primary contact for data subjects and the national supervisory authority. Failure to appoint and identify an Encarregado is one of the most common compliance gaps found during regulatory reviews.
About Ferraz & Whitmore
Ferraz & Whitmore is an international law firm based in Lisbon, advising business clients across 46 jurisdictions. As a law firm in Brazil with a cross-border practice rooted in both civil law and common law traditions. We advise international companies on data protection compliance in Brazil. from initial data mapping and privacy notice drafting through to ANPD engagement and incident response. Our data protection team has advised on LGPD compliance programmes across technology, financial services, and consumer-facing industries, and supports clients navigating the intersection of Brazilian data protection legislation and multinational regulatory obligations. The firm is a member of leading international legal associations and participates in cross-border practice groups focused on data protection and technology regulation. Our Lisbon base provides direct access to EU regulatory frameworks, while our Americas practice supports clients managing the interaction between LGPD, GDPR compliance requirements, and sector-specific rules across the region. To discuss your data protection compliance position in Brazil, contact us at info@ferrazwhitmore.com.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.