lgpd

LGPD Art. 7 provides ten legal bases including consent, legal obligation, contract performance, legitimate interest, and credit protection. Sensitive data under Art. 11 requires express consent or a strict statutory exception, and legitimate interest cannot be used for sensitive data.

Under Art. 48 and ANPD Resolution CD/ANPD No. 15/2024, controllers must submit a preliminary notification to ANPD within 3 working days of detecting an incident that may cause relevant risk or harm. A full report is due within 20 working days, and affected data subjects must be notified when there is high risk of harm.

LGPD has 10 legal bases versus GDPR's 6, requires a DPO (Encarregado) more broadly, and caps fines at 2% of Brazilian revenue or R$50 million per violation versus GDPR's 4% of global turnover. Breach notification is 3 working days preliminary under LGPD versus 72 hours under GDPR.

No. As of January 2026, Brazil and the EU established mutual adequacy recognition, so Brazil-EU personal data transfers no longer require SCCs or BCRs. Transfers to non-adequate countries like the US or China still require ANPD's standard contractual clauses from Resolution CD/ANPD No. 19/2024.

Controllers must appoint a DPO (Encarregado) under Art. 41 and publish their name and contact details. ANPD Resolution No. 2/2022 exempts micro and small enterprises with low-risk processing from mandatory appointment, though they must still provide a contact channel for data subjects.

Art. 52 sanctions include warnings, simple fines up to 2% of Brazilian revenue capped at R$50 million per violation, daily fines, publicisation of the infraction, blocking or deletion of data, and suspension or prohibition of processing activities. ANPD considers factors like gravity, recidivism, cooperation, and corrective measures.