What Is LGPD? – Definition and How It Works
Learn what Brazil's LGPD requires, how it compares with GDPR, and what it means for collected personal data.
The Lei Geral de Proteção de Dados is Brazil's general data protection law. It closely follows the GDPR model, with its own regulator and some distinct features. This page is a general explanation, not legal advice.
1. Scope
LGPD applies where processing occurs in Brazil, where the data subjects are in Brazil, or where the purpose is offering goods or services to people in Brazil.
Like GDPR, it is extraterritorial: a company outside Brazil processing Brazilian residents' personal data can be covered. Location of the processor is not the test.
2. Legal Bases
LGPD lists ten legal bases, more than GDPR's six:
| Basis | Note |
|---|---|
| Consent | Specific and informed |
| Legal obligation | Compliance with law |
| Public administration | By public bodies |
| Research | By research bodies, anonymised where possible |
| Contract performance | Including preliminary steps |
| Judicial proceedings | Legal claims |
| Protection of life | Vital interests |
| Health protection | By health professionals or authorities |
| Legitimate interest | Balanced against the subject's rights |
| Credit protection | Distinctive to LGPD |
Credit protection as a standalone basis has no direct GDPR equivalent, and reflects Brazilian credit-reporting practice.
3. Data Subject Rights
Confirmation of processing, access, correction, anonymisation or deletion, portability, information about sharing, information about the consequences of refusing consent, and revocation of consent.
The right to information about with whom data is shared is expressed prominently — which matters if collected data is onward-transferred, because the chain must be describable.
4. Compared With GDPR
| LGPD | GDPR | |
|---|---|---|
| Legal bases | 10 | 6 |
| Regulator | ANPD | Per-member-state authorities |
| DPO required | Yes, broadly | Conditional |
| Fine ceiling | 2% of Brazilian revenue, capped per violation | 4% of global turnover |
| Extraterritorial | Yes | Yes |
| Breach notification | Required, no fixed deadline in the statute | 72 hours |
| Public-data treatment | Addressed, purpose-bound | No general exemption |
A programme built to GDPR standards will satisfy most LGPD requirements, but not automatically — the regulator, the DPO expectation, and the additional bases differ.
5. Publicly Available Data
LGPD addresses publicly accessible data explicitly, and the treatment is instructive: processing it is permitted, but must respect the purpose for which it was made public and the good faith of the subject.
That is narrower than "public means free to use". Data published for one purpose does not become available for any purpose — and building a profile from public sources is a new purpose the original publication did not contemplate.
6. What This Means for Collection
- Determine whether personal data is involved. Prices, specifications, and aggregate ratings generally are not.
- Identify a legal basis before processing, not afterwards.
- Respect the original purpose of publication when relying on the public-data provision.
- Record provenance per record, since access and sharing-information rights require it.
- Make deletion and anonymisation possible across raw storage, derived tables, and backups.
- Expect a DPO expectation if you process at any scale.
- Note that inferences are personal data too, exactly as under GDPR.
7. The Multi-Jurisdiction Reality
Web collection rarely respects borders. A crawl of a global site gathers data about people in many jurisdictions simultaneously, which means several regimes can apply to one dataset.
The practical consequence: build to the strictest applicable standard rather than per-jurisdiction. Provenance, purpose limitation, retention limits, and a working deletion path satisfy most regimes at once, and retrofitting them per law is far more expensive than designing them in.
8. Summary
LGPD is Brazil's GDPR-aligned data protection law, extraterritorial in scope, with ten legal bases including a distinctive credit-protection basis, an ANPD regulator, and a broad DPO expectation.
Its treatment of publicly available data is purpose-bound rather than permissive — public for one purpose is not public for all — so record provenance per record, identify a basis before processing, keep deletion genuinely possible, and build to the strictest applicable standard since one crawl typically touches several jurisdictions.