LGPD: Brazil's Data Protection Law for Foreign Companies

Yes, the LGPD applies to foreign companies. Brazil's General Data Protection Law (Law 13,709/2018) applies to any company that processes personal data of people in Brazil, offers goods or services to them, or processes data collected in the country, regardless of where the company is based. In practice, if your website sells to Brazilians, collects emails or sets cookies for visitors from Brazil, the LGPD applies to you.

When the LGPD applies

Under Article 3 of the law, the LGPD applies when:

• data processing takes place in Brazil; or
• the activity aims to offer or supply goods or services to people in Brazil; or
• the data was collected in Brazil.

There are exceptions, such as strictly personal, journalistic, artistic or academic use, and public security.

LGPD and GDPR: similar, not identical

The LGPD was inspired by the European GDPR, so companies already compliant with the GDPR have much of the work done. But there are differences:

Topic	LGPD (Brazil)	GDPR (EU)
Legal bases	10 bases, including credit protection	6 bases
Data protection officer	The general rule is to appoint one; small processing agents get flexibility	Mandatory in specific cases
Maximum fine	2% of revenue in Brazil, capped at R$ 50 million per violation	Up to 4% of global revenue or €20 million
Authority	ANPD	National authorities in each country

The key obligations

1. Have a legal basis for each use of data

Each purpose needs a legal basis: consent, performance of a contract, compliance with a legal obligation, legitimate interest, credit protection, among others. Email marketing, for example, usually relies on consent or well-documented legitimate interest.

2. Respect data subject rights

Article 18 grants data subjects, among other things, the right to confirm whether you process their data, access it, correct it, request anonymization or deletion, portability and information about sharing. Have a clear channel, in Portuguese, for these requests.

3. Appoint a data protection officer

The officer (encarregado, the equivalent of a DPO) is the channel between the company, data subjects and the ANPD. Their identity and contact details must be published, preferably in the privacy policy.

4. A privacy policy in Portuguese

Explain, in plain Brazilian Portuguese, which data you collect, why, who you share it with, how long you keep it and how data subjects exercise their rights. An English-only policy makes transparency hard to prove. See why language matters in Brazilian Portuguese: why translation is not enough.

5. Security and incidents

Companies must adopt adequate security measures. Incidents that may cause relevant risk or harm to data subjects must be reported to the ANPD and to the data subjects, within the deadline set by ANPD regulations.

6. International data transfers

If Brazilians' data goes to servers outside Brazil (as it does for almost every foreign company), the transfer needs a basis provided in the law. The ANPD has approved standard contractual clauses for this, similar in logic to the European ones. Review your contracts with cloud, CRM and email providers.

Fines and sanctions

The ANPD can issue warnings, simple fines of up to 2% of the company's revenue in Brazil in the last fiscal year (capped at R$ 50 million per violation), daily fines, publication of the violation, blocking or deletion of data and suspension of processing activities. In addition, data subjects can sue, and consumer protection agencies (Procons) act on consumer matters.

Points of attention for online sellers

• Cookies and tracking: the ANPD has published guidance on cookies. Offer a banner with a real option to reject non-essential cookies.
• WhatsApp and contact lists: marketing messages on WhatsApp also involve personal data and need a legal basis. See WhatsApp for business in Brazil.
• CPF at checkout: the CPF is personal data. Collect it only when necessary (invoicing, payment, fraud prevention) and protect it.
• Influencers and partners: sharing customer lists with partners requires a legal basis and a contract.

Quick checklist

1. Map which data of Brazilians you collect and why.
2. Define the legal basis for each purpose.
3. Publish the privacy policy in Portuguese and the officer's contact.
4. Create a process to handle data subject requests.
5. Adjust the cookie banner.
6. Review international transfer contracts.
7. Have an incident response plan.

Summary

The LGPD reaches foreign companies that sell to or collect data from Brazil. GDPR compliance is a solid base, but you need to adjust the policy into Portuguese, the officer, Brazilian legal bases and international transfers. For a complete market entry plan, see also how to open a company in Brazil as a foreigner. If you want help organizing compliance together with your market entry, talk to BrazilDoor.