Brazil · LGPD · Lei Geral de Proteção de Dados
Data subject rights intake, legal basis records, anonymisation workflows, and audit proof — everything needed to meet Brazil LGPD obligations.
No credit card required. Privacy Center live in 15 minutes.
LGPD PENALTIES
ANPD can impose fines of up to R$50 million per infraction, suspend processing, or publicly disclose the violation. Enforcement has been ramping since 2023.
| Sanction type | Amount | Scope |
|---|---|---|
| Administrative infraction | up to 2% | Of Brazilian revenue in the prior fiscal year, capped at R$50 million per infraction |
| Warning | N/A | With deadline to adopt corrective measures |
| Daily fine | up to R$50M | Subject to the per-infraction cap |
| Public disclosure of violation | Reputational | ANPD may publish the infraction after proceedings |
| Data processing suspension | Operational | ANPD can suspend or prohibit related processing activities |
YOUR OBLIGATIONS
Art. 6, 9
Processing must have a specific, legitimate purpose disclosed to the data subject. Vague or blanket consent is insufficient.
Art. 18, 19
Data subjects can confirm processing exists and receive full access within 15 days under a simplified procedure.
Art. 18(III)
Data subjects can request correction of incomplete, inaccurate, or outdated personal data.
Art. 18(IV)
Data subjects can request anonymisation, blocking, or elimination of unnecessary or unlawful data — an alternative to outright deletion.
Art. 18(VI)
Data subjects can request deletion of consent-based personal data. Other legal bases may justify retention.
Art. 18(V)
Data subjects can request portability of their data to another provider. Mechanics are subject to ongoing ANPD regulation.
Art. 18(IX), 21
Data subjects can withdraw consent at any time or object to processing based on illegitimate grounds.
Art. 37, 46
Controllers and processors must appoint a data protection officer (encarregado) where required, and adopt technical and administrative security measures.
HOW CONDUIT COVERS EACH OBLIGATION
| LGPD Obligation | How Privacy Conduit covers it |
|---|---|
| Transparency & purpose limitation | Privacy Center with LGPD-specific disclosures — purpose, duration, controller identity, and sharing — per data category. |
| Right to access & confirmation | DSR inbox with 15-day SLA clock, response templates, and case evidence trail. |
| Right to correct | Correction request handling with playbook and deadline tracking. |
| Anonymisation & blocking | Separate anonymisation and blocking intent with evidence steps and vendor notification. |
| Right to delete | Deletion fulfilment playbooks with legal-basis check, retention justification logging, and vendor cascade. |
| Right to portability | Portability request workflow with structured data export and chain-of-custody record. |
| Consent withdrawal & objection | Consent records with withdrawal timestamp; unlawful-processing objection intent with response playbook. |
| Encarregado (DPO) & security | Org settings for encarregado contact details, security measure documentation linked to cases. |
GET STARTED
Privacy Center live in 15 minutes. Full LGPD compliance toolkit included.
FREQUENTLY ASKED