Lei Geral de Proteção de Dados Pessoais (LGPD)
Lei nº 13.709, de 14 de agosto de 2018 (LGPD)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 18 September 2020.
A comprehensive regime rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Establish a lawful basis under article 7 before processing personal data, including data the person has made public.
- Obtain specific, highlighted consent, or another article 11 legal basis, before processing sensitive personal data such as health, genetic, or biometric data.
- Let a data subject confirm that processing exists, access their data, correct it, or have it anonymized, blocked, deleted, or ported to another provider, on request.
- Give a data subject a way to request review of any decision made solely on automated processing of their personal data, including a decision that defines their personal, professional, consumer, or credit profile.
- Transfer personal data outside Brazil only to a country or organization with an adequate level of protection, or under contractual clauses, corporate rules, or another article 33 safeguard.
- Notify the ANPD and the affected data subjects of a security incident that may create relevant risk or harm to data subjects.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 52, II states the fine as a simple fine of up to 2% of the private legal entity's, group's, or conglomerate's revenue in Brazil in its last fiscal year, excluding taxes, but limits the total to this fixed cap per infraction; article 52, III also allows a daily fine observing the same total limit.
- Rule
- Fixed only
- As of
- 5 September 2026
- Currency
- BRL
- Fixed cap
- 50,000,000
Who enforces it
Enforcement body
Autoridade Nacional de Proteção de Dados (ANPD)
What it reaches
Obligation class
Consent, Data subject rights, Transfer, Breach notice, Security
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The LGPD requires a lawful basis under article 7 for any processing of personal data, and article 11 confines processing of sensitive personal data, defined in article 5, II to include racial or ethnic origin, religious conviction, political opinion, health, sex life, and genetic or biometric data, to specific consent or a narrow list of alternative bases.
Article 18 gives every data subject the right to confirm processing exists, access, correct, anonymize, block, or delete their data, and to port it to another provider. Article 20 gives the data subject the right to request review of a decision taken solely on automated processing of personal data that affects their interests, including decisions defining a personal, professional, consumer, or credit profile.
Article 33 permits international transfer only to a country or organization offering an adequate level of protection, or where the controller demonstrates compliance through contractual clauses, corporate rules, seals, or another article 33 safeguard. Article 48 requires the controller to notify the ANPD and the affected data subjects of a security incident that may create relevant risk or harm.
Articles 52 to 54 authorize the ANPD to impose administrative sanctions, including a simple fine of up to 2% of the private legal entity's, group's, or conglomerate's revenue in Brazil in its last fiscal year, excluding taxes, capped in total at R$50,000,000.00 per infraction, and article 42 makes a controller or operator that causes patrimonial, moral, individual, or collective damage through personal-data processing in violation of the data-protection legislation liable to repair it.
When LexLint raises it
crawls_webtrains_modelsautomated_outreachhigh_risk_decisionsprocesses_biometricsdeploys_chatbot
Read the law
Official compiled text of Lei nº 13.709/2018, Presidência da República