CevroBrazil: Brazil LGPD and what it requires
General Data Protection Law (LGPD): an established law with an active enforcement record. Overseen by Autoridade Nacional de Proteção de Dados (ANPD).
Key requirements at a glance
| Registration with the regulator | Not required |
|---|---|
| Data protection officer | Depends on thresholds or circumstances |
| Breach notification | No fixed hourly deadline in our reference |
| Cross-border transfer restrictions | Required |
| Data localization | Not required |
Penalties and enforcement
Fines up to 2% of Brazilian revenue per violation, capped at R$50 million per incident.
What to know in practice
The region's leading GDPR-inspired law, with growing enforcement from the ANPD.
The security duty
Under Art. 46: Security measures: technical and administrative measures to protect personal data from unauthorised access and accidental or unlawful destruction, loss, alteration or disclosure. Source: published text, checked 2026-10.
How Cevro helps
- Maps Brazil LGPD to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Counts your automated technical checks as evidence toward the security duty in Art. 46.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in Brazil?
Autoridade Nacional de Proteção de Dados (ANPD) oversees General Data Protection Law (LGPD).
Is breach notification mandatory under Brazil LGPD?
Our reference does not record a fixed hourly deadline for Brazil LGPD. Check the statute and Autoridade Nacional de Proteção de Dados (ANPD) guidance for the notification timing that applies to you.
Does Brazil restrict cross-border data transfers?
Yes. Moving personal data out of Brazil is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under Brazil LGPD?
Only in some cases, usually depending on the scale or sensitivity of your processing. Confirm whether you cross the threshold.
What are the penalties for non-compliance in Brazil?
Fines up to 2% of Brazilian revenue per violation, capped at R$50 million per incident.