Data Protection Monitor
Global Privacy & Data Protection Intelligence

Brazil (BR) · Module Detail

Brazil: Sectoral Watch

← Full Brazil overview Build report with Brazil Request deeper dive

#

Financial and health overlays are documented and active; telecoms/ePrivacy, education and insurance sub-areas lack dedicated sectoral DP instruments in the sources reviewed.

Primary frameworkLGPD (general) plus BACEN/CMN Open Finance regulation and FEBRABAN self-regulation (financial sector)
Supervisory authorityANPD (general); Banco Central do Brasil (BACEN) for financial-sector conduct
Traffic-light rationale — AmberFinancial and health overlays are documented and active; telecoms/ePrivacy, education and insurance sub-areas lack dedicated sectoral DP instruments in the sources reviewed.

Sub-modules (7)

Financial Sector OverlayGreen

BACEN and the Monetary Council's Open Finance regulation establishes consent as the sole legal ground for data transfers within open banking; FEBRABAN's CARB Standard 21/2022 reiterates and supplements LGPD requirements for banks.

Claims (2):

  • The Central Bank and Monetary Council's open banking regulation establishes consent as the unique legal ground for data transfers within the scope of open banking, excluding sensitive data, credit scores/ratings and login/access credentials from the transferable dataset.
  • FEBRABAN's CARB Standard 21/2022 reiterates and adds to LGPD requirements, prompting financial institutions toward international standards and better data-protection governance.

Health Sector OverlayAmber

ANPD sanctioned the Instituto de Assistência Médica ao Servidor Público Estadual (IAMSPE) for failing to safeguard public employees' health data and for an untimely Article 48 breach notification.

Claims (1):

  • ANPD determined that the government health system IAMSPE violated the LGPD by failing to safeguard public employees' personal health data and by not producing a data-breach notification within a reasonable period.

Telecoms And EprivacyRed

No dedicated telecoms/ePrivacy-specific data-protection overlay (comparable to the EU ePrivacy Directive) was identified for Brazil in this research pass; cookie-specific guidance exists as ANPD soft-law rather than a distinct statute.

Claims (1):

  • No distinct telecoms/ePrivacy statute analogous to the EU ePrivacy Directive was located for Brazil; ANPD has issued a Guide on Cookies and Data Protection as soft-law guidance rather than binding sector legislation.

Employment DataAmber

Employment-related sensitive health data has been subject to ANPD enforcement in the public sector (IAMSPE case involving public employees' health data), but no dedicated private-sector employment-data statute was identified.

Claims (1):

  • ANPD determined that the government health system IAMSPE violated the LGPD by failing to safeguard public employees' personal health data and by not producing a data-breach notification within a reasonable period.

Credit And ScoringAmber

The 'protection of credit' legal basis (Art. 7 X) underpins credit-bureau and scoring activity; Brazilian courts have restricted processing of data such as voter registration number, mother's name, lifestyle, social class, schooling, marginal propensity to consume and georeferencing for credit-protection purposes as not necessary.

Claims (1):

  • Brazilian courts have restricted the processing of data such as voter registration number, mother's name, lifestyle, social class, schooling, marginal propensity to consume and georeferencing for credit-protection purposes as not necessary.

EducationRed

No education-sector-specific data-protection instrument was identified in this research pass beyond general LGPD applicability and DPIA guidance touching on children's data in digital products.

InsuranceRed

No insurance-sector-specific data-protection instrument was identified in this research pass beyond general LGPD applicability.

Category narrative92 words

Financial-sector data flows are shaped by BACEN/Monetary Council open-banking (Open Finance) rules layered atop the LGPD, plus bank self-regulation (FEBRABAN's CARB Standard 21/2022). Health-sector enforcement so far centres on ANPD sanctions against a public health-insurance entity for failing to safeguard employees' health data and for a late Article 48 breach notification. Credit/scoring processing is governed by a bespoke 'protection of credit' legal basis, with courts restricting non-necessary data (e.g., voter registration, marginal propensity to consume) in credit-protection scoring. No comprehensive telecoms/ePrivacy-specific overlay, education-sector, or insurance-sector regime was identified in this research pass.

Sources and claims (5)
  1. ConfirmedOneTrust DataGuidance — The Central Bank and Monetary Council's open banking regulation establishes consent as the unique legal ground for data transfers within the scope of open banking, excluding sensitive data, credit scores/ratings and login/access credentials from the transferable dataset.observed
  2. ProbableOneTrust DataGuidance — FEBRABAN's CARB Standard 21/2022 reiterates and adds to LGPD requirements, prompting financial institutions toward international standards and better data-protection governance.observed
  3. ConfirmedIAPP — ANPD determined that the government health system IAMSPE violated the LGPD by failing to safeguard public employees' personal health data and by not producing a data-breach notification within a reasonable period.observed
  4. UncertainEUR-Lex — No distinct telecoms/ePrivacy statute analogous to the EU ePrivacy Directive was located for Brazil; ANPD has issued a Guide on Cookies and Data Protection as soft-law guidance rather than binding sector legislation.observed
  5. ProbableEUR-Lex — Brazilian courts have restricted the processing of data such as voter registration number, mother's name, lifestyle, social class, schooling, marginal propensity to consume and georeferencing for credit-protection purposes as not necessary.observed