Data protection & privacy law in Brazil (2026)

Legal framework

Lei Geral de Proteção de Dados Pessoais (LGPD) — Lei nº 13.709/2018, in force since September 2020; supervised by the Autoridade Nacional de Proteção de Dados (ANPD), which became a fully autonomous regulatory agency in February 2026 under Lei nº 15.352/2026. Data protection is a fundamental right under Article 5, LXXIX of the Federal Constitution (EC 115/2022).

Key points: data & privacy in Brazil

1. 01Governing law

   Lei nº 13.709/2018 (LGPD), effective 18 September 2020 (administrative sanctions from 1 August 2021), consolidates rules for the processing of personal data by public and private entities across all sectors, both online and offline.

   planalto.gov.br en.wikipedia.org

2. 02Supervisory authority

   The Autoridade Nacional de Proteção de Dados (ANPD), headquartered in Brasília, is the regulator. Under Lei nº 15.352/2026 (conversion of MP 1.317/2025), it became a fully autonomous federal regulatory agency in February 2026, with six superintendencies including a dedicated Enforcement Superintendency.

   gov.br lefosse.com

3. 03Data subject rights & controller obligations

   The LGPD grants rights of access, correction, anonymisation/blocking, portability, deletion, information about sharing, and revocation of consent, generally to be answered within 15 days. Controllers must have a lawful basis (10 hypotheses under Art. 7), appoint a Data Protection Officer (encarregado) under Art. 41, keep records of processing (Art. 37), and implement technical/administrative security measures.

   iclg.com planalto.gov.br

4. 04Constitutional status

   Constitutional Amendment nº 115/2022 elevated the protection of personal data — including in digital media — to an autonomous fundamental right in Article 5, LXXIX of the Federal Constitution and assigned the Union exclusive competence to legislate on it.

   en.wikipedia.org iclg.com

5. 05Sanctions & enforcement posture

   Sanctions under Art. 52 LGPD include warnings, publicity of the violation, blocking/erasure of data, partial or total suspension of processing, and administrative fines of up to 2% of Brazilian revenue, capped at BRL 50 million per infraction. The ANPD has cumulatively imposed over BRL 98 million in fines from 2023 through 2025, with 2026 priorities focused on biometric data, health data, financial data and children's data.

   lefosse.com flexyconsent.com

6. 06International data transfers – EU adequacy

   On 26 January 2026 the European Commission adopted an adequacy decision on Brazil, and on 27 January 2026 the ANPD issued Resolução CD/ANPD nº 32/2026 recognising the EU as providing an adequate level of protection. Personal data may now flow bidirectionally between Brazil and the EU without SCCs or other supplementary transfer mechanisms; the decisions will be reviewed within four years and exclude transfers for public-security, defence or criminal-law-enforcement purposes.

   mayerbrown.com trenchrossi.com iapp.org

Timeline of decisions

1. 4 Nov 2025Decision · official
   EDPB issues favourable opinion on EU adequacy for Brazil

   The European Data Protection Board adopted Opinion 28/2025 broadly endorsing the European Commission's draft decision (published 5 Sep 2025) that Brazil offers adequate protection under the GDPR, paving the way for free EU-Brazil data flows; mutual adequacy was announced 27 Jan 2026.

   EDPB

2. 17 Sept 2025Law
   ANPD converted into an independent regulatory agency

   Brazil transformed the ANPD from a special autarchy into a full regulatory agency with functional, technical, decision-making, administrative and financial autonomy, cementing it as an independent data-protection regulator.

   IAPP

3. 23 Aug 2024Guidance
   ANPD Resolution No. 19/2024 on international data transfers

   The ANPD approved the regulation governing cross-border transfers and published Standard Contractual Clauses, operationalising the LGPD's international transfer regime (controllers had until 22 Aug 2025 to adopt the new SCCs).

   IAPP

4. 2 Jul 2024Enforcement · official
   ANPD suspends Meta's use of Brazilian data for AI training

   The data-protection authority issued a preventive measure halting Meta's updated privacy policy that fed Facebook/Instagram posts into AI training, citing inadequate legal basis and risks to minors; it was lifted on 30 August 2024 after Meta filed a compliance plan. It was a landmark application of the LGPD to generative AI.

   ANPD

5. 2 Jul 2024Enforcement
   ANPD orders Meta to halt AI training on Brazilians' data

   The ANPD issued a preventive measure suspending Meta's use of personal data to train generative AI under a BRL 50,000/day fine, citing inadequate transparency and risks to minors; the measure was lifted on 30 Aug 2024 after Meta submitted a compliance plan.

   Future of Privacy Forum

6. 24 Apr 2024Guidance
   ANPD approves Data Breach Notification Regulation (Resolution No. 15)

   The data protection authority operationalized LGPD Article 48, requiring controllers to notify ANPD and affected individuals within three business days when a breach poses relevant risk or harm, and to keep breach records for five years. It clarified long-uncertain incident-reporting duties.

   DataGuidance / ANPD

7. 6 Jul 2023Enforcement
   ANPD applies its first administrative sanction under the LGPD

   The ANPD imposed its first fine on a microenterprise for telemarketing-related LGPD violations, marking the start of active enforcement of the law's penalty regime.

   IAPP

8. 25 Oct 2022Law
   Law 14.460/2022 makes the ANPD a special autarchy

   The ANPD was converted from a body linked to the Presidency into an independent special autarchy with technical, decision-making and budgetary autonomy, strengthening its impartiality as the national regulator.

   Lexology

9. 10 Feb 2022Law · official
   Constitutional Amendment 115 makes data protection a fundamental right

   Congress added the protection of personal data, including in digital media, to the fundamental rights in Article 5 of the Constitution (and federal exclusive competence to legislate), entrenching the principles underpinning the LGPD.

   Government of Brazil

10. 1 Aug 2021Law
    LGPD administrative sanctions take effect

    The LGPD's penalty provisions (fines up to 2% of Brazilian revenue, capped at BRL 50 million per infraction) became enforceable, giving the ANPD power to sanction non-compliance.

    ICLG

11. 14 Aug 2020Law · official
    LGPD takes effect

    Brazil's General Data Protection Law (Law No. 13.709/2018) came into force, establishing GDPR-style rules for processing personal data including online, with administrative sanctions phased in from August 2021. It underpins privacy enforcement against online platforms.

    Presidência da República (Planalto)

12. 7 May 2020Decision · official
    STF strikes down telecom-IBGE data-sharing decree (ADI 6387)

    By 10-1 the Supreme Federal Court suspended MP 954/2020, which forced telecoms to hand subscriber data to statistics agency IBGE; its reasoning recognised data protection as an autonomous fundamental right derived from the Constitution.

    Supremo Tribunal Federal

13. 8 Jul 2019Law · official
    National Data Protection Authority (ANPD) created

    Law No. 13.853/2019 established the ANPD as the body to interpret, supervise and enforce the LGPD and impose sanctions. The authority became the central regulator for online data-privacy matters.

    Presidência da República (Planalto)

14. 14 Aug 2018Law · official
    General Data Protection Law (LGPD) enacted (Law 13.709/2018)

    Brazil's omnibus data-protection law imposed security, breach-notification and accountability duties on public and private data processors and created the basis for the ANPD. It anchors most data-security obligations applicable in Brazil today.

    Presidência da República (Planalto)

15. 14 Aug 2018Law · official
    LGPD enacted (Law No. 13.709/2018)

    President Michel Temer signed Brazil's first comprehensive, GDPR-inspired data protection statute into law, creating the framework that governs personal data processing nationwide.

    ANPD

16. 14 Aug 2018Law · official
    Brazil enacts data protection law (LGPD)

    Law No. 13,709 created Brazil's comprehensive data-protection regime and the basis for the ANPD, in force from September 2020. Until a dedicated AI statute passes, the LGPD is the principal legal tool governing AI systems that process personal data.

    Library of Congress

17. 23 Apr 2014Law · official
    Marco Civil da Internet enacted (Law 12.965/2014)

    The 'Internet Bill of Rights' set principles for internet use including privacy, data protection, net neutrality and data-retention/security duties for connection and application providers. It established core obligations for handling and safeguarding user data online.

    Presidência da República (Planalto)

18. 23 Apr 2014Law · official
    Marco Civil da Internet enacted (Law No. 12.965/2014)

    Brazil's 'Internet Bill of Rights' established net neutrality, intermediary liability rules, and the first binding privacy and personal-data protection principles for online activity, laying the groundwork for the LGPD.

    Câmara dos Deputados

Sources

1. 1.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm
2. 2.gov.br/anpd/pt-br
3. 3.iclg.com/practice-areas/data-protection-laws-and-regulations/brazil/
4. 4.lefosse.com/en/news/alerts/international-data-protection-day-how-the-anpds-enforc
5. 5.mayerbrown.com/en/insights/publications/2026/02/a-new-era-for-personal-data-transfer
6. 6.trenchrossi.com/en/legal-alerts/brazil-and-the-european-union-mutually-recognize-adeq
7. 7.flexyconsent.com/blog/brazil-lgpd-anpd-cookie-consent-guide/
8. 8.en.wikipedia.org/wiki/General_Personal_Data_Protection_Law
9. 9.iapp.org/news/a/brazil-eu-mutual-adequacy-what-changes-for-data-transfers-and-