Regulation of New Technologies
LGPD for foreign companies: when Brazil’s data protection law applies to you
Guilherme Chambarelli
Published on
3 min read
In this article
Brazil’s General Data Protection Law (LGPD, Law 13,709/2018) applies to a foreign company even without a Brazilian office if it processes data in Brazil, offers goods or services to people in Brazil, or processes data collected in Brazil. In practice, any business selling online to Brazilian customers, running a Brazilian subsidiary or handling data of Brazilian employees should treat the LGPD as applicable.
Key points
- The LGPD has extraterritorial reach similar to the GDPR.
- International transfers require a legal mechanism, such as the ANPD’s standard contractual clauses.
- Companies must appoint a data protection officer (encarregado), with limited exceptions.
- Fines can reach 2% of revenue in Brazil, capped at BRL 50 million per infraction.
- GDPR compliance helps, but it does not automatically satisfy the LGPD.
When does the LGPD apply to a company abroad?
Article 3 of the LGPD sets three triggers. The law applies to any processing, regardless of where the company is based or where the data is stored, if:
- the processing takes place in Brazil;
- the purpose is to offer or supply goods or services to individuals located in Brazil, or to process their data; or
- the personal data was collected in Brazil.
A website in Portuguese, prices in reais, local payment methods or shipping to Brazil are strong signs that a company targets the Brazilian market.
International data transfers
Sending personal data from Brazil to another country requires one of the mechanisms in Article 33 of the LGPD. In 2024, the ANPD issued its regulation on international transfers (Resolution CD/ANPD No. 19/2024), including standard contractual clauses that must be adopted without material changes. Groups that relied on generic intercompany agreements should check whether their contracts now include the ANPD clauses.
Do you need a DPO in Brazil?
The LGPD requires controllers to appoint an encarregado (data protection officer) and publish their contact details. The ANPD regulated the role in 2024. Small-scale processing agents may be exempt, as long as they provide a communication channel. The DPO does not need to be Brazilian, but must be able to communicate with data subjects and the ANPD in Portuguese.
LGPD vs. GDPR: what changes
| Topic | LGPD | GDPR |
|---|---|---|
| Legal bases | Ten bases, including credit protection | Six bases |
| Local representative | No specific requirement equivalent to GDPR Art. 27 | Required for non-EU controllers in many cases |
| Maximum fine | 2% of revenue in Brazil, up to BRL 50 million per infraction | Up to 4% of global turnover or EUR 20 million |
| Transfer clauses | ANPD standard contractual clauses | EU SCCs |
Practical checklist
- map which Brazilian personal data you collect and where it flows;
- publish a privacy notice in Portuguese;
- appoint a DPO and set up a channel for data subject requests;
- adopt the ANPD standard contractual clauses for transfers;
- prepare an incident response plan that includes notification to the ANPD;
- review contracts with Brazilian vendors and partners.
Frequently asked questions
Can I use the EU SCCs for transfers from Brazil?
Not as a substitute. The ANPD adopted its own standard clauses, and the EU clauses do not automatically meet the Brazilian requirements.
Does the LGPD apply to B2B data?
Yes, whenever it involves identifiable individuals, such as employees or contacts of corporate customers.
Who enforces the LGPD?
The National Data Protection Agency (ANPD), which became a regulatory agency under Law 15,352/2026. Consumer protection bodies, prosecutors and courts also apply the law in disputes.
Is consent always required?
No. Consent is one of ten legal bases. Contract performance, legal obligations and legitimate interest are often more appropriate.
How Chambarelli Advogados can help
Our Regulation of New Technologies team and our Foreign Desk help foreign companies assess LGPD exposure, adopt transfer clauses and run compliance programs in Brazil. Book a meeting with one of our partners.
Informational content, updated October 2026. It does not replace advice on your specific case.
