{ "jurisdiction_id": "BR", "jurisdiction": "Brazil", "url": "https://dataprotection.gi/jurisdictions/brazil/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-08-05", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 64, "sub_modules": 57, "source_register": 32 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "green", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/brazil/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "Comprehensive omnibus statute in force since 2020 with an increasingly empowered, independent regulator; core scope/authority questions are settled.", "claims": [ { "statement": "Provisional Measure No. 1.317/2025 transformed ANPD into the National Data Protection Agency, guaranteeing functional, technical, decision-making, administrative and financial autonomy.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/anpd-becomes-regulatory-agency-a-turning-point-for-brazilian-data-protection-compliance", "source_tier": null, "observed_at": null }, { "statement": "The provisional measure grants ANPD strengthened enforcement powers, including ordering establishments to cease operations, seizing goods, and requesting police assistance in cases of obstruction.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/anpd-becomes-regulatory-agency-a-turning-point-for-brazilian-data-protection-compliance", "source_tier": null, "observed_at": null }, { "statement": "The LGPD comprises 65 articles and was greatly influenced by the EU GDPR, providing legal bases authorizing personal data use across all economic sectors.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/an-overview-of-brazils-lgpd", "source_tier": null, "observed_at": null }, { "statement": "LGPD applicability is not limited by business size; exceptions apply only to journalistic, artistic, academic, public-safety and national-defense purposes.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/an-overview-of-brazils-lgpd", "source_tier": null, "observed_at": null }, { "statement": "Under Article 3, a personal data processor is subject to the LGPD when data are collected or processed in Brazil, or processed to offer goods/services to individuals in Brazil, irrespective of where the controller is headquartered.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/an-overview-of-brazils-lgpd", "source_tier": null, "observed_at": null }, { "statement": "ANPD developed a simplified ROPA (record of processing activities) template for small-scale processing agents under the small-agents regulation approved by Resolution CD/ANPD No. 02/2022.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/news/brazil-anpd-requests-public-comments-draft-ropa", "source_tier": null, "observed_at": null } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": "green", "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/brazil/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "Legal basis and sensitive-data regimes are well-settled statutory provisions with several years of ANPD/court interpretation.", "claims": [ { "statement": "The LGPD restricts processing of personal data to enumerated legal bases in Article 7, similar to GDPR Article 6, including consent and legitimate interest.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/an-overview-of-brazils-lgpd", "source_tier": null, "observed_at": null }, { "statement": "A distinctive 'protection of credit' legal basis (Art. 7 X) allows financial institutions and credit bureaus to process personal data for credit risk analysis and credit-history consultation.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/opinion/brazil-lgpd-v-gdpr", "source_tier": null, "observed_at": null }, { "statement": "Consent must be given for particular purposes and the burden of proof is on the controller to demonstrate valid consent; consent may be revoked at any time free of charge.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/processing-rights-and-dsars-under-brazils-lgpd", "source_tier": null, "observed_at": null }, { "statement": "Sensitive personal data includes racial/ethnic origin, religious belief, political opinion, union/religious/philosophical organisation membership, health or sex life, and genetic or biometric data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/an-overview-of-brazils-lgpd", "source_tier": null, "observed_at": null }, { "statement": "Processing of sensitive personal data is restricted to the situations enumerated in Article 11, including specific/distinct consent or, without consent, compliance with a legal obligation, public-policy execution, research (with anonymisation where possible), exercise of rights, life/safety protection, health protection, or fraud prevention.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://prod.iapp.org/resources/article/brazilian-data-protection-law-lgpd-english-translation/", "source_tier": null, "observed_at": null }, { "statement": "Anonymised data can be treated as personal data under the LGPD when it is used to formulate a behavioural profile of a particular natural person who is identified.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_lgpd_report.pdf", "source_tier": null, "observed_at": null } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "green", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/brazil/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "Rights catalogue is comprehensive and in force, though some response-timeline specifics are left to case-by-case ANPD regulation.", "claims": [ { "statement": "Data subjects have the right to facilitated access to information about the processing of their data, to be made available in a clear, adequate and ostensible manner.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/lgpd_translation.pdf", "source_tier": null, "observed_at": null }, { "statement": "Article 18 rights include correcting incomplete, inaccurate or out-of-date data, and anonymising, blocking or deleting unnecessary or excessive data or data processed in noncompliance with the law.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/processing-rights-and-dsars-under-brazils-lgpd", "source_tier": null, "observed_at": null }, { "statement": "The data subject has the right to petition regarding her/his data against the controller before the national authority, and may oppose processing carried out under a consent-waiver ground if there is noncompliance with the LGPD.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://prod.iapp.org/resources/article/brazilian-data-protection-law-lgpd-english-translation/", "source_tier": null, "observed_at": null }, { "statement": "The Central Bank and Monetary Council's open banking regulation implemented consent-based data portability among financial institutions ahead of general ANPD portability guidance.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/opinion/brazil-new-open-banking-rules", "source_tier": null, "observed_at": null }, { "statement": "Upon a data subject's request for the full text of contractual instruments used in an international transfer, controllers have 15 days to provide it, excluding trade secrets.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/brazils-new-regulation-on-international-data-transfers", "source_tier": null, "observed_at": null } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "amber", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/brazil/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "Core duties are legislated and increasingly detailed by ANPD resolutions (DPO, breach, dosimetry), but explicit statutory retention/disposal timelines remain unresolved and enforcement of Art. 48/49 duties shows continuing public-sector immaturity.", "claims": [ { "statement": "The LGPD expressly contemplates DPIAs where processing is based on legitimate interest or involves sensitive data, and ANPD may at any time request a DPIA from the controller in those instances.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/brazils-new-regulation-on-international-data-transfers", "source_tier": null, "observed_at": null }, { "statement": "Under ANPD Resolution CD/ANPD No. 18/2024, all organisations acting as a controller must designate a DPO through a formal written, dated and signed act; exemptions are granted only for small-scale controllers, which must instead maintain a channel for data-subject requests.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/anpd-publishes-new-regulation-on-dpo-role", "source_tier": null, "observed_at": null }, { "statement": "The DPO must be able to communicate with ANPD and data subjects in Portuguese and is not personally liable for the controller's processing of personal information.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/anpd-publishes-new-regulation-on-dpo-role", "source_tier": null, "observed_at": null }, { "statement": "ANPD developed a draft simplified ROPA (record of processing activities) template specifically for small processing agents under Resolution CD/ANPD No. 02/2022.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/news/brazil-anpd-requests-public-comments-draft-ropa", "source_tier": null, "observed_at": null }, { "statement": "Controllers and processors can be jointly and severally liable for information-security incidents and improper/unauthorized data use, though a processor's liability may be limited to its contractual and security obligations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/the-new-brazilian-general-data-protection-law-a-detailed-analysis", "source_tier": null, "observed_at": null }, { "statement": "Three of ANPD's published sanctioning decisions to date have dealt with Article 49 violations relating to ensuring security in systems operationalising personal data processing.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/lessons-from-brazilian-dpa-sanctions-to-date", "source_tier": null, "observed_at": null }, { "statement": "Article 48 of the LGPD requires mandatory data-breach notification to ANPD within a reasonable timeframe, which may, depending on severity, require notifying affected data subjects and public disclosure of the incident.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/the-new-brazilian-general-data-protection-law-a-detailed-analysis", "source_tier": null, "observed_at": null }, { "statement": "ANPD Resolution CD/ANPD No. 15 of 24 April 2024 defines security incidents and clarifies the criteria, timeline and methods for breach notification.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/anpd-s-regulation-on-security-incidents", "source_tier": null, "observed_at": null } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "green", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/brazil/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "A full transfer-mechanism toolkit is now operative and the landmark 2026 mutual adequacy determination substantially de-risks EU-Brazil data flows, though SCC/BCR implementation details remain partly unresolved.", "claims": [ { "statement": "Article 33 of the LGPD provides an exhaustive list of grounds authorising international data transfers, including adequacy, contractual instruments, ANPD-authorised specific clauses, international cooperation agreements, and data-subject consent.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/brazils-new-regulation-on-international-data-transfers", "source_tier": null, "observed_at": null }, { "statement": "For the purpose of Article 45 of Regulation (EU) 2016/679, Brazil ensures an adequate level of protection for personal data transferred from the European Union to controllers and processors in Brazil subject to the LGPD.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "EUR-Lex", "source_url": "https://eur-lex.europa.eu/eli/dec_impl/2026/179/oj/eng", "source_tier": null, "observed_at": null }, { "statement": "In Resolution No. 32/2026, ANPD recognized the EU as an international organization providing an adequate level of protection for purposes of international data transfers under the LGPD.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/brazil-eu-mutual-adequacy-what-changes-for-data-transfers-and-what-doesn-t", "source_tier": null, "observed_at": null }, { "statement": "ANPD's SCCs can form a stand-alone contract or be attached to a broader agreement, are divided into general information, mandatory clauses, security measures, and additional clauses/annexes, and unlike EU clauses do not feature modules but customizable fields.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/brazils-new-regulation-on-international-data-transfers", "source_tier": null, "observed_at": null }, { "statement": "Use of BCRs for intragroup international transfers requires prior ANPD assessment, with data controllers demonstrating compliance including implementation of a data privacy governance program.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/brazils-new-regulation-on-international-data-transfers", "source_tier": null, "observed_at": null }, { "statement": "There will inevitably be discussions about the adequacy of SCCs and whether additional measures are necessary, mirroring concerns raised in the EU under Schrems II.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/brazils-new-regulation-on-international-data-transfers", "source_tier": null, "observed_at": null }, { "statement": "Publication of the ANPD international-transfer regulation coincided with discussions of creating a 'sovereign cloud' under Brazil's Artificial Intelligence Plan, aiming to keep government data stored within national borders.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/brazils-new-regulation-on-international-data-transfers", "source_tier": null, "observed_at": null } ] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "amber", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/brazil/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Financial and health overlays are documented and active; telecoms/ePrivacy, education and insurance sub-areas lack dedicated sectoral DP instruments in the sources reviewed.", "claims": [ { "statement": "The Central Bank and Monetary Council's open banking regulation establishes consent as the unique legal ground for data transfers within the scope of open banking, excluding sensitive data, credit scores/ratings and login/access credentials from the transferable dataset.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/opinion/brazil-new-open-banking-rules", "source_tier": null, "observed_at": null }, { "statement": "FEBRABAN's CARB Standard 21/2022 reiterates and adds to LGPD requirements, prompting financial institutions toward international standards and better data-protection governance.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/opinion/brazil-new-data-protection-regulations-banks", "source_tier": null, "observed_at": null }, { "statement": "ANPD determined that the government health system IAMSPE violated the LGPD by failing to safeguard public employees' personal health data and by not producing a data-breach notification within a reasonable period.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/brazils-andp-finds-health-care-system-failed-to-protect-employees-data/", "source_tier": null, "observed_at": null }, { "statement": "No distinct telecoms/ePrivacy statute analogous to the EU ePrivacy Directive was located for Brazil; ANPD has issued a Guide on Cookies and Data Protection as soft-law guidance rather than binding sector legislation.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "EUR-Lex", "source_url": "https://eur-lex.europa.eu/eli/dec_impl/2026/179/oj/eng", "source_tier": null, "observed_at": null }, { "statement": "Brazilian courts have restricted the processing of data such as voter registration number, mother's name, lifestyle, social class, schooling, marginal propensity to consume and georeferencing for credit-protection purposes as not necessary.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "EUR-Lex", "source_url": "https://eur-lex.europa.eu/eli/dec_impl/2026/179/oj/eng", "source_tier": null, "observed_at": null } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "amber", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/brazil/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "One concrete enforcement precedent (Meta AI-training suspension) exists, but most adtech sub-areas lack dedicated Brazilian instruments identified in this pass.", "claims": [ { "statement": "ANPD has issued a Guide on Cookies and Data Protection, referenced as an official ANPD guidance document in the European Commission's Brazil adequacy assessment.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "EUR-Lex", "source_url": "https://eur-lex.europa.eu/eli/dec_impl/2026/179/oj/eng", "source_tier": null, "observed_at": null }, { "statement": "The ANPD ordered Meta to suspend the processing of personal data for AI training, under penalty of a daily fine of BRL 50,000.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/lessons-from-brazilian-dpa-sanctions-to-date", "source_tier": null, "observed_at": null }, { "statement": "The Meta suspension order was lifted conditional on compliance with a plan monitored by ANPD, including facilitating the exercise of the right to object.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/lessons-from-brazilian-dpa-sanctions-to-date", "source_tier": null, "observed_at": null } ] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "amber", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/brazil/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "ADM transparency right is in force but implementation guidance is nascent; the horizontal AI statute remains unconfirmed as fully enacted; state-surveillance carve-outs are statutorily defined but ANPD's practical oversight role there is limited.", "claims": [ { "statement": "The SGD DPIA guideline suggests a DPIA where processing involves tracking data subjects' location, formation of a behavioral profile, or automated decision-making with legal effects on personal, professional, consumer or credit profiles, or involving children and teenagers.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/brazils-new-regulation-on-international-data-transfers", "source_tier": null, "observed_at": null }, { "statement": "Article 20 of the LGPD guarantees individuals the right to request a review of decisions made solely through automated processing of personal data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/insights-from-the-anpd-s-new-technical-note-on-automated-decisions", "source_tier": null, "observed_at": null }, { "statement": "The Brazilian Artificial Intelligence Bill (PL 2338/2023) had its wording approved by the Senate in December 2024 and draws parallels with the EU AI Act's risk-based approach.", "regulatory_stage": "proposed", "is_binding": true, "confidence": "Uncertain", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/opinion/brazil-similarities-and-key-differences-between", "source_tier": null, "observed_at": null }, { "statement": "Bill No. 750/2026, before the Chamber of Deputies, would establish a National Program for Monitoring Aggressors Using Artificial Intelligence, combining electronic monitoring, behavioral analytics and real-time alerts.", "regulatory_stage": "proposed", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/brazil-weighs-ai-monitoring-of-domestic-violence-offenders-raising-privacy-and-governance-concerns", "source_tier": null, "observed_at": null }, { "statement": "Age-verification approaches evolving under Brazil's Digital ECA framework increasingly draw on soft biometrics such as typing patterns and device position to assess probable user age.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/the-minimization-principle-and-the-best-interests-of-children-in-the-digital-world-a-brazilian-perspective", "source_tier": null, "observed_at": null }, { "statement": "Genetic and biometric data are expressly included within the LGPD's definition of sensitive personal data under Article 5 II.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/an-overview-of-brazils-lgpd", "source_tier": null, "observed_at": null }, { "statement": "For public security, national defense, state security, or investigation/prosecution of criminal offenses, the LGPD is not applicable, but ANPD retains the attribution of issuing technical opinions, recommendations and requesting a DPIA from controllers (Art. 4 §3).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/brazils-new-regulation-on-international-data-transfers", "source_tier": null, "observed_at": null } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "amber", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/brazil/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "Statutory protection is strong and rapidly maturing (Digital ECA now in force), but implementing age-verification technical standards remain under active public consultation as of mid-2026.", "claims": [ { "statement": "Law No. 15.211/2025, the Digital Child and Adolescent Statute ('Digital ECA'), establishes a substantive framework for protecting children and adolescents in digital environments, with Decree No. 12.881/2026 operationalising preventive measures, risk management and accountability requirements.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/brazil-reshapes-children-s-data-protection-under-the-digital-eca-framework", "source_tier": null, "observed_at": null }, { "statement": "The Digital ECA applies to any product, service, or platform directed to, or likely to be accessed by, children (under 12) and adolescents (12-18) in Brazil.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/inside-brazil-s-child-online-safety-bill", "source_tier": null, "observed_at": null }, { "statement": "ANPD's Radar Tecnológico #5 and a May 2026 call for contributions are developing an Age Verification Mechanisms Guide to implement the Digital ECA, updating preliminary guidelines first published in March 2026.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/challenges-in-digital-age-verification-mechanisms-the-brazilian-context", "source_tier": null, "observed_at": null }, { "statement": "Children's personal data may only be processed with specific and highlighted consent from a parent or legal representative, except where collection is necessary to contact the parents/representative, is used a single time without storage, or is for the child's protection.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/lgpd_translation.pdf", "source_tier": null, "observed_at": null }, { "statement": "ANPD's Statement No. 1/2023 clarified that processing of children's data may rely on any legal basis under the LGPD, provided the best interests of the child prevail in the specific case, moving away from consent as the sole compliance anchor.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/brazil-reshapes-children-s-data-protection-under-the-digital-eca-framework", "source_tier": null, "observed_at": null }, { "statement": "The SGD's DPIA guideline recommends a data protection impact assessment whenever processing involves children and teenagers.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/brazils-new-regulation-on-international-data-transfers", "source_tier": null, "observed_at": null } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "amber", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/brazil/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "Statutory penalty and powers framework is robust and has just been substantially strengthened, but actual enforcement volume remains modest and concentrated in the public sector, and ANPD's historic capacity constraints are only now being addressed.", "claims": [ { "statement": "ANPD has sole responsibility for applying LGPD sanctions (Art. 55-K), including fines of up to 2% of a company's Brazil-derived revenue for the prior fiscal year, excluding taxes, capped at BRL 50 million per infraction, plus daily fines subject to the same cap.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/top-5-operational-impacts-of-brazils-lgpd-part-5-enforcement-mechanisms-and-sanctions", "source_tier": null, "observed_at": null }, { "statement": "Provisional Measure 1.317/2025 makes clear that ANPD can now order establishments to cease operations, seize goods, and request police assistance in cases of obstruction of its functions.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/anpd-becomes-regulatory-agency-a-turning-point-for-brazilian-data-protection-compliance", "source_tier": null, "observed_at": null }, { "statement": "Of ANPD's seven sanctioning decisions published to date, most target the public sector, with five dealing with Article 48 breach-communication violations.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/lessons-from-brazilian-dpa-sanctions-to-date", "source_tier": null, "observed_at": null }, { "statement": "Among ANPD's first eight sanctioning procedures, seven were issued against public entities.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/data-privacy-and-the-brazilian-public-sector", "source_tier": null, "observed_at": null }, { "statement": "ANPD's actions in relation to public entities have historically been predominantly pedagogical and limited in scope, aggravated by the authority's small technical and administrative staff.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/data-privacy-and-the-brazilian-public-sector", "source_tier": null, "observed_at": null }, { "statement": "ANPD's transformation into a regulatory agency is expected to bring greater structural and budgetary robustness, with increased staff and technical resources and enhanced operational independence.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/data-privacy-and-the-brazilian-public-sector", "source_tier": null, "observed_at": null }, { "statement": "The sum of fines collected by ANPD is allocated to the Diffuse Rights Defense Funds referred to in Law No. 7.347/1985 and Law No. 9.008/1995.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://prod.iapp.org/resources/article/brazilian-data-protection-law-lgpd-english-translation/", "source_tier": null, "observed_at": null }, { "statement": "Brazil's Constitution gives all citizens a private right of action and a public right of action to the Brazil Public Prosecutors' Office, enabling individual and class suits regardless of ANPD's administrative sanction status.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/top-5-operational-impacts-of-brazils-lgpd-part-5-enforcement-mechanisms-and-sanctions", "source_tier": null, "observed_at": null }, { "statement": "In January 2026, the European Commission recognized that Brazil ensures an adequate level of protection for personal data transferred from the EU under the GDPR.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/brazil-eu-mutual-adequacy-what-changes-for-data-transfers-and-what-doesn-t", "source_tier": null, "observed_at": null }, { "statement": "Brazil's Digital ECA (Law 15.211/2025) took effect 17 March 2026, alongside Decree 12.881/2026 operationalizing its preventive-measures and accountability requirements, with ANPD empowered as enforcer.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://prod.iapp.org/news/a/draft-text-of-brazils-eca-digitals-decree-imposes-new-requirements-on-digital-platforms/", "source_tier": null, "observed_at": null }, { "statement": "On 22 May 2026, ANPD opened a call for contributions on its Age Verification Mechanisms Guide, updating preliminary guidelines published in March 2026 to implement the Digital ECA.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/challenges-in-digital-age-verification-mechanisms-the-brazilian-context", "source_tier": null, "observed_at": null } ] } ] }