LGPD (Brazil)

The LGPD applies to processing carried out in Brazil, processing aimed at offering goods or services to people in Brazil, and processing of data collected in Brazil, regardless of where the organisation is based (Art. 3). It uses its own vocabulary: the controlador (controller), the operador (processor), the titular (data subject) and the encarregado (data protection officer).

Its structure is close to the GDPR: ten principles in Art. 6, including purpose, necessity, transparency, security, prevention, non-discrimination and accountability; ten legal bases for ordinary data in Art. 7, including credit protection, which has no direct GDPR equivalent; specific bases for sensitive data in Art. 11; data subject rights in Art. 18; the right to request review of automated decisions in Art. 20; and incident reporting in Art. 48.

The ANPD, now an autonomous regulatory agency, issues regulations and enforces the law, with sanctions that range from warnings to fines and suspension of processing. Example: a foreign app with Brazilian users must appoint an encarregado and answer data subject requests under LGPD rules.