LGPD & DIGITAL LAW
LGPD in practice: what every company needs to have in order
Brazil's General Data Protection Law (LGPD) applies to any company that processes personal data, including employee data. Here are the essential obligations, in plain language, and the evidence that shows your company is compliant.
IN 30 SECONDS
- The LGPD applies to companies of every size, including for employee data.
- Every processing activity needs a legal basis and a clear purpose.
- Incidents with a relevant risk must be reported to the ANPD within 3 business days.
- Compliance is proven with documents: data inventory, policies, contracts and records.
Does the LGPD apply to my company?
If your company collects names, CPF numbers (Brazilian taxpayer IDs), phone numbers, emails, addresses, health data or any information that identifies a person, the answer is yes. Law No. 13,709/2018 applies to companies of every size and industry, and that includes the data of employees, job applicants, customers, individual suppliers and visitors.
Enforcement is carried out by the ANPD, Brazil’s National Data Protection Authority, which has already issued regulations on penalties, incident reporting and simplified rules for small processing agents.
The 10 essential obligations
- Data inventory
Know which personal data the company processes, where it comes from, where it is stored, who can access it and who it is shared with. Everything else builds on this (record of processing activities, art. 37). - A legal basis for each purpose
Every use of data must fit one of the legal bases in the law, such as performance of a contract, legal obligation, legitimate interest or consent. Consent is not the only option, and not always the best one. - Privacy notice
Clear text, on the website and wherever data is collected, explaining which data is used, for what, for how long and how people can exercise their rights. - Data Protection Officer (DPO)
A person or company responsible for handling requests from data subjects and from the ANPD. Small processing agents may be exempt from appointing one, but must keep a communication channel (ANPD Resolution No. 2/2022). - Handling data subject requests
A procedure to answer requests for access, correction, deletion and information about data sharing (art. 18). - Security measures
Access control, strong passwords, backup, encryption where appropriate and a record of who accessed what (art. 46). - Contracts with processors
Vendors that process data on the company’s behalf (accounting, payroll, cloud, marketing) need data protection clauses. - Incident response plan
Know what to do in a data breach: contain it, assess the risk, notify and keep a record. - Data Protection Impact Assessment (DPIA)
A document that assesses the risks of more sensitive processing, such as health data or large-scale monitoring. - Team training
Most incidents start with a human error. Anyone who handles data needs to know the rules.
What if there is a data breach?
ANPD Resolution No. 15/2024 set the rules for incident reporting. When an incident may cause relevant risk or harm to the people affected, the company must notify the ANPD and those individuals within 3 business days of becoming aware of it. For small processing agents, the deadline is doubled.
Keep a record even when you don’t report
Every incident must be recorded internally, including the risk assessment carried out, and that record must be kept for at least 5 years. During an inspection, it is what shows the company acted correctly.
What the penalties are
Article 52 of the LGPD provides for warnings, a simple fine of up to 2% of the company’s revenue in Brazil, capped at R$50 million per violation, daily fines, public disclosure of the violation, blocking or deletion of the data and even suspension of processing activities. How penalties are calculated is set out in the ANPD’s Dosimetry Regulation (ANPD Resolution No. 4/2023).
Beyond administrative penalties, there is the risk of lawsuits from data subjects and, often the biggest loss, damage to the company’s reputation with customers and partners.
How to prove your company is compliant
| Obligation | Expected evidence |
|---|---|
| Data inventory | Up-to-date record of processing activities |
| Transparency | Published, versioned privacy notice |
| DPO | Name and contact channel made public |
| Security | Security policy and access logs |
| Vendors | Contracts with data protection clauses |
| Incidents | Response plan and incident log |
| People | Attendance lists or training certificates |
Three common myths
- “A cookie banner is enough.”
The banner is only one piece. Without a data inventory, legal bases and security, the company is still exposed. - “We need consent for everything.”
No. Many activities rely on other legal bases, such as a contract or a legal obligation. - “Small companies don’t get inspected.”
The rules are simplified, not waived. The law applies to companies of every size.
Quick checklist for your company
- Up-to-date inventory of personal data
- Legal basis defined for each purpose
- Privacy notice published
- DPO or contact channel defined
- Process to handle data subject requests
- Vendor contracts reviewed
- Incident response plan
- Teams trained in the past year
HOW GESTÃO DE TI CAN HELP
Information Security & Governance
LGPD compliance with data mapping, policies and audit-ready evidence.
For information only. This does not replace a professional review of your specific case. Legal references reflect the rules in force on the publication date (Brazilian law).