# Standards and Regulatory References — Brazil LGPD

## Primary Legislation

### Lei 13.709/2018 (LGPD)
- **Enacted**: 14 August 2018
- **Effective date**: 18 September 2020 (substantive provisions)
- **Sanctions effective**: 1 August 2021
- **Amended by**: Lei 13.853/2019 (created ANPD), Lei 14.460/2022 (consumer credit scoring)
- **Scope**: Art. 3 — applies to processing in Brazil, processing of data collected in Brazil, or processing aimed at offering goods/services to individuals in Brazil
- **Extraterritorial reach**: Similar to GDPR Art. 3, applies regardless of the controller's country of establishment if the processing targets individuals in Brazil

### Lei 13.853/2019
- **Enacted**: 8 July 2019
- **Key provision**: Converted the ANPD from a provisional measure into permanent law; established the ANPD as a federal entity under the Presidency (later transitioned to special autarchy status)

### Decreto 10.474/2020
- **Published**: 26 August 2020
- **Subject**: Approved the structure and positions of the ANPD, establishing its organisational framework including the Board of Directors, National Council for Data Protection, Ombudsman, and internal departments

## ANPD Resolutions and Guidance

### Resolution CD/ANPD No. 2/2022 — Small-Scale Processing Agents
- **Adopted**: 27 January 2022
- **Subject**: Simplified compliance obligations for startups, small businesses, and microenterprises
- **Key provisions**: Simplified RIPD format; simplified consent records; exemption from DPO appointment (replaced by contact channel); extended response timelines for data subject requests

### Resolution CD/ANPD No. 4/2023 — Dosimetry Regulation
- **Adopted**: 27 February 2023
- **Subject**: Methodology for calculating administrative sanctions
- **Key provisions**: Establishes aggravating factors (intent, recidivism, scope of affected data subjects) and mitigating factors (good faith, adoption of privacy programme, timely corrective measures)
- **Fine calculation**: Base amount determined by severity classification (light, medium, severe, very severe) adjusted by aggravating/mitigating factors, capped at 2% of revenue / R$50 million

### Resolution CD/ANPD No. 15/2024 — Security Incident Communication
- **Adopted**: April 2024
- **Subject**: Establishes mandatory breach notification requirements
- **Key provisions**: Controllers must communicate to the ANPD and data subjects within 3 business days when an incident may create relevant risk or damage; defines criteria for risk assessment; specifies notification content requirements

### Resolution CD/ANPD No. 18/2024 — DPO Regulation
- **Adopted**: 2024
- **Subject**: Further details on DPO appointment, qualifications, and responsibilities
- **Key provisions**: Reinforces public disclosure requirement; permits outsourcing of the DPO function; establishes conflict of interest guidelines

### Resolution CD/ANPD No. 19/2024 — Standard Contractual Clauses
- **Adopted**: August 2024, effective August 2025
- **Subject**: ANPD-approved standard contractual clauses for international data transfers under Art. 33, II(b)
- **Structure**: Clauses for controller-to-controller and controller-to-processor transfer relationships
- **Key provisions**: Mandatory transfer impact assessment; sub-processor management; data subject rights preservation; ANPD audit rights

### ANPD Guide on Legitimate Interest (2022)
- **Subject**: Interpretation of Art. 7, IX and Art. 10 requirements
- **Key guidance**: Four-step test — (1) identify the legitimate interest, (2) assess necessity, (3) balance against data subject rights, (4) implement safeguards; documentation required; RIPD recommended

### ANPD Guide on Security Agents' Obligations (2021)
- **Subject**: Technical and organisational security measures under Art. 46
- **Key guidance**: Risk-based approach; encryption, access controls, logging; incident response procedures; security by design

## Related Brazilian Legislation

### Marco Civil da Internet (Lei 12.965/2014)
- Internet Bill of Rights predating the LGPD
- Art. 7: User rights including data privacy and clear terms of service
- Art. 10: Prohibition on sharing connection records and personal data except by court order or legal obligation
- Art. 13-15: Mandatory retention of connection logs (1 year) and application access logs (6 months)

### Lei 12.414/2011 — Positive Credit Registry (Cadastro Positivo)
- Permits creation of credit databases containing positive payment history
- As amended by Lei 13.873/2019, all consumers are automatically included (opt-out model)
- Intersection with LGPD Art. 7, X: Credit protection as a lawful basis

### Código de Defesa do Consumidor (Lei 8.078/1990)
- Art. 43: Consumer right to access information in databases; right to correction of inaccurate data
- Art. 43, §2: Consumer databases must notify the consumer of registration within 5 days
- Complementary to LGPD data subject rights for consumer relationships

### Consolidação das Leis do Trabalho (CLT)
- Art. 11: Five-year statute of limitations for employment claims (two years from termination to file)
- Establishes retention requirements for employment records that interact with LGPD deletion rights

## International Frameworks for Comparison

### LGPD vs GDPR Key Differences

| Feature | LGPD | GDPR |
|---------|------|------|
| Number of lawful bases | 10 (Art. 7) | 6 (Art. 6) |
| Credit protection as lawful basis | Yes (Art. 7, X) | No equivalent |
| DPO appointment | Required for all controllers (Art. 41); simplified for small agents | Required for specific controllers/processors (Art. 37) |
| Breach notification timeline | 3 business days (ANPD Resolution 15/2024) | 72 hours (Art. 33) |
| Maximum fine | 2% of revenue in Brazil, capped at R$50M per violation | 4% of global annual turnover or €20M |
| Adequacy decisions issued | None as of March 2026 | Multiple (Art. 45) |
| Children's consent age | Best interest standard (Art. 14); at least one parent's consent | 16 (Art. 8), Member States may lower to 13 |
| Data portability | Art. 18, V — per ANPD regulation | Art. 20 — structured, machine-readable format |

## Enforcement Precedents

### ANPD v. Telekall Infoservice (2023)
- First administrative fine: R$14,400
- Violation: Processing WhatsApp contacts for political campaign messaging without lawful basis
- Also warned for failure to appoint DPO

### ANPD v. National Social Security Institute (INSS) (2023)
- Investigation of unlawful data sharing with financial institutions for consigned loan marketing
- Demonstrated ANPD enforcement against public sector entities
- Resulted in suspension recommendation pending implementation of safeguards

### ANPD v. SERPRO/RFB (2024)
- Investigation of data sharing practices by the Federal Data Processing Service and Federal Revenue Service
- Examined scope of Art. 7, II (legal obligation) and Art. 7, III (public policy) bases for government data sharing