Overview
Effective since September 18, 2020, the LGPD is Brazil's cornerstone law for personal data protection. It applies to organizations processing data in Brazil or targeting Brazilian residents, regardless of where the organization is headquartered. Key provisions include the appointment of a Data Protection Officer (DPO), rules for data transfers, and penalties for noncompliance. The National Data Protection Authority (ANPD) oversees enforcement, offering autonomy in governance since 2022. Amendments in 2022 to Brazil's Federal Constitution have enshrined the protection of personal data as a fundamental right. While the LGPD is largely modeled after the GDPR, specific provisions related to small businesses, startups, and innovative companies reflect local considerations. Further regulations are expected from the ANPD for full implementation.