LGPD

Who it applies to

Processing carried out in Brazil, processing aimed at offering goods or services to individuals in Brazil, and processing of personal data collected in Brazil.

Key requirements

• One of ten legal bases for processing, including consent and legitimate interest.
• Data subject rights including confirmation, access, correction, anonymisation, portability and deletion.
• Appoint a data protection officer (encarregado), with exceptions set by the ANPD for small processors.
• Security, technical and administrative measures to protect personal data.
• Rules for international transfers, including standard contractual clauses approved by the ANPD.

Breach and incident notification

Security incidents that may create relevant risk or damage are communicated to the ANPD and to data subjects within the deadline set by ANPD regulation.

Penalties

Fines of up to 2% of the company's revenue in Brazil for the previous financial year, limited to BRL 50 million per infraction, plus other sanctions such as publicising the violation.

Go deeper