Diego Castro and Carol Paranhos
Lawyers in charge · direct contact with who signs the work
Brazilian LGPD lawyer for foreign companies: scope check, gap analysis against your GDPR program, privacy notice in Portuguese, DPO, DPA and data transfer clauses.
A clear answer on whether the LGPD applies to you, based on article 3 and how you actually reach Brazil.
Gap analysis that starts from your GDPR or CCPA program and lists only what Brazil adds.
Privacy notice, cookie notice and data subject request flow in Portuguese, ready to publish.
DPO (encarregado), processor agreements and international transfer clauses that follow ANPD rules.
Online meetings in English · Attorney client confidentiality · Brasília time business hours
The LGPD (Law 13,709/2018) applies to foreign companies that process personal data in Brazil, offer goods or services to people in Brazil or collect data in Brazil, even without a local office. A Brazilian LGPD lawyer confirms whether you are covered, adapts your GDPR program to Brazil's ten legal bases, deadlines and transfer rules, and prepares the Portuguese privacy notice, encarregado (DPO) appointment and contracts the ANPD expects.
SaaS or app with Brazilian users and no local entity
Risk ·Assuming the LGPD does not apply because the company is abroad.
Action ·Applicability memo under article 3 and a short Brazil gap list.
GDPR program, nothing specific for Brazil
Risk ·EU legal bases, EU SCCs and GDPR deadlines that do not match the LGPD.
Action ·Adapt legal bases, transfer clauses and request and incident deadlines.
Data stored in the US or another non adequate country
Risk ·Transfer out of Brazil without an ANPD mechanism after the August 2025 deadline.
Action ·Brazilian SCCs in intragroup and vendor agreements, used verbatim.
Product likely to be used by children or teenagers
Risk ·Breach of the LGPD best interest rule and of the Digital ECA in force since March 2026.
Action ·Age assurance, parental controls and privacy by default reviewed with the product team.
Brazilian enterprise customer asks for a DPA
Risk ·Signing the customer's paper with unlimited liability and audit rights.
Action ·Negotiate a balanced DPA that fits your global obligations.
Security incident with Brazilian users
Risk ·Missing the 3 business day notification deadline to the ANPD.
Action ·Incident assessment, ANPD and data subject notices in Portuguese.
Short answers to the questions that come up most in first calls, in the order they usually appear.
It can. The LGPD applies when you process data in Brazil, offer goods or services to people in Brazil or collect data in Brazil. Having no local entity does not exclude it.
Usually a Portuguese privacy notice, LGPD legal bases, the encarregado, Brazilian SCCs for transfers to non adequate countries such as the US, the 3 business day incident deadline and the 15 day access request deadline.
The LGPD and Resolution 18/2024 do not require the encarregado to live in Brazil, but the person must be able to communicate with data subjects and the ANPD in Portuguese.
The LGPD itself does not require one. The Digital ECA does for foreign providers of products likely to be used by minors, and a Brazilian contact point makes ANPD and Procon communications easier.
Not for the transfer from Brazil to the EU, which is covered by the 2026 adequacy decision. You still need a mechanism for any vendor or affiliate outside the EU, such as in the US.
Yes. We advise on Brazilian law and coordinate with your in house team or outside counsel in the US, the UK or the EU, so documents stay consistent across jurisdictions.
Diego Castro is admitted to the Brazilian Bar under OAB/PI 15.613. You can verify any Brazilian lawyer in the national bar registry (CNA) on the OAB website.
If your company is already dealing with any of these situations, the next step is a short call about the facts.
Online meetings in English · Attorney client confidentiality
Most foreign companies already have a privacy program. The work is to find where Brazil differs, fix those points in the right language and leave your team with a short list of routines to keep it current.
A written opinion on whether and how the LGPD applies to your company, considering where data is processed, who you offer services to and where data is collected.
We map your existing GDPR documentation against the LGPD and ANPD regulations and list only the changes Brazil requires, ranked by risk.
A Brazilian privacy notice written from your real data flows, consistent with your global policy and with the consumer law duty to inform in Portuguese.
Transfers of personal data out of Brazil must follow article 33 of the LGPD. Since January 2026 the EU is recognized as adequate; other destinations, such as the US, still need Brazil's standard contractual clauses.
Processor agreements with Brazilian customers and suppliers, written to work under the LGPD and to match the obligations you already accept in Europe or the US.
Support when something goes wrong: security incident assessment, notification to the ANPD and to data subjects, and answers to complaints and requests.
Working documents in English for your team and in Portuguese for Brazilian users and authorities. The package depends on your data flows; a B2B SaaS needs less than a consumer app with minors.
Scope and fees are set in an individual written proposal, as required by the Brazilian Bar (OAB).
Short opinion on how the LGPD applies to you, with the reasoning a board or auditor can follow.
Only what Brazil adds to your current program, with owner and suggested order.
Ready to publish in Portuguese, with an English working copy for internal review.
Brazilian SCCs inserted in the relevant agreements and a processor agreement template.
Data inventory focused on Brazilian data subjects, in a format your team can maintain.
Who does what, in which deadline, with message templates in Portuguese.
The LGPD was inspired by the GDPR, so most of your work carries over. The problems show up in the details the ANPD and Brazilian consumers actually check.
Privacy notice only in English, with EU legal bases that do not match the LGPD list.
EU standard contractual clauses used for transfers out of Brazil.
No named contact for Brazilian data subjects or for the ANPD.
Incident procedure built around the GDPR 72 hour clock.
Access requests answered on the GDPR one month timeline.
Portuguese notice with LGPD legal bases and the DPO contact in a visible place.
EU transfers under the 2026 adequacy decision; Brazilian SCCs, used verbatim, for the US and other countries.
Encarregado (DPO) appointed and published, or an exemption documented.
Incident procedure with the 3 business day ANPD deadline.
Full access requests answered within 15 days, as article 19 requires.
Use this list to see where your program stands. Each item without a clear answer is a point to raise in the first call.
The LGPD has extraterritorial reach. A company with no office, entity or server in Brazil can still be fully subject to it. These are the points foreign companies ask about most often.
Under article 3, the LGPD applies when personal data is processed in Brazil, when the processing aims to offer or supply goods or services to individuals located in Brazil, or when the data was collected in Brazil. The second trigger is the one that usually catches foreign SaaS, ecommerce and apps: pricing in reais, a Portuguese interface, Brazilian payment methods or marketing aimed at Brazil are all signs that you target the Brazilian market.
The structure is familiar: principles, legal bases, data subject rights, controller and processor roles, security and accountability. The differences are concrete. The LGPD lists ten legal bases, including credit protection and the regular exercise of rights in proceedings. Full access requests have a 15 day deadline. Brazil has its own standard contractual clauses. Sanctions reach 2% of the group's revenue in Brazil, capped at R$ 50 million per infraction, plus publicity of the violation and suspension of processing.
Article 41 requires controllers to appoint an encarregado, the person who receives complaints from data subjects and communications from the ANPD. Resolution CD/ANPD 18/2024 details the role, allows an individual or a company to perform it and requires the identity and contact to be published, ideally on your website. Small processing agents can be exempt under Resolution CD/ANPD 2/2022, but they still need a channel for data subjects.
If data collected in Brazil goes to servers or vendors abroad, the transfer needs a legal mechanism under article 33. In January 2026 Brazil and the European Union adopted mutual adequacy decisions (on the Brazilian side, Resolution CD/ANPD 32/2026), so transfers from Brazil to the EU no longer need extra safeguards. Transfers to the US and most other countries still rely on the Brazilian standard contractual clauses of Resolution CD/ANPD 19/2024, which must be used without changes and had to replace older clauses by August 2025. EU SCCs are not a substitute: the ANPD had not recognized any foreign clauses as equivalent at the time of writing.
When you sell to consumers in Brazil, the Consumer Defense Code also applies. It requires clear information in Portuguese and is enforced by consumer protection agencies (Procons) in addition to the ANPD. A privacy notice only in English is a weak point in both regimes, and complaints about data often reach Procon before they reach the ANPD.
If you hire developers, support agents or sales people in Brazil, they access personal data on your behalf. Their contracts should state confidentiality, security duties and processing instructions. This is one of the most common gaps in companies that grow a remote team in Brazil before formalizing the legal structure.
Many foreign companies rely on legitimate interest for analytics, fraud prevention and B2B marketing. The LGPD allows it (article 10), but only for a concrete purpose, with the minimum data necessary and with transparency to the data subject, and never for sensitive data. The ANPD's guide on legitimate interest recommends a documented balancing test. A short assessment per purpose, kept on file, is usually enough and answers the first question the ANPD tends to ask.
Article 14 of the LGPD requires that the processing of children's and teenagers' data follow their best interest, with specific consent from a parent for children's data in most cases. Since March 17, 2026, the Digital Statute of Children and Adolescents (Law 15,211/2025, known as the Digital ECA) adds duties for digital products likely to be accessed by minors, such as age assurance, parental supervision tools and privacy protective defaults, and requires foreign providers to keep a legal representative in Brazil. Games, education, social and consumer apps should check this first.
You are launching a Portuguese version of your product or accepting payments in reais.
A Brazilian enterprise customer sent a security and privacy questionnaire or a DPA to sign.
Your global privacy program never mentioned Brazil and you already have Brazilian users.
You received a data subject request, a Procon complaint or a letter from the ANPD.
You had a security incident that may affect people in Brazil.
You are preparing for due diligence, an audit or a funding round that covers Brazil.
A video call to understand your product, your Brazilian users, your data flows and the documents you already have.
We list the documents and analyses needed, with deadlines and fees, before any work starts.
We review your current program, prepare the Brazilian documents and validate them with your privacy, legal or product team.
Final documents in Portuguese and English, an implementation call and, if you want, ongoing support for requests and incidents.
Applicability memo, controller or processor roles and a map of Brazilian data flows, including transfers by country.
Portuguese privacy and cookie notices, encarregado appointment and the channel for data subject requests.
DPA template, Brazilian SCCs where needed and LGPD terms in vendor and customer agreements.
Incident playbook with the 3 business day deadline, request handling and a short training for the teams involved.
Indicative timeline. The real schedule depends on the number of products, the documents you already have and how fast your team can share information.
Not every company needs a full LGPD project on day one. These criteria help you decide.
Direct answers to the questions foreign companies ask about Brazil's General Data Protection Law.
The LGPD (Lei Geral de Proteção de Dados, Law 13,709/2018) is Brazil's General Data Protection Law. It regulates the processing of personal data of individuals in Brazil, in force since September 2020, with sanctions enforceable since August 2021. It is supervised by the ANPD, the National Data Protection Authority.
Yes, when any of the three triggers in article 3 is met: the processing happens in Brazil, the processing aims to offer or supply goods or services to individuals in Brazil, or the personal data was collected in Brazil. A foreign company that sells to Brazilian users online is usually covered, even without a Brazilian entity.
The LGPD has ten legal bases instead of six, a 15 day deadline for full access requests, its own standard contractual clauses for international transfers, a 3 business day deadline to notify the ANPD of relevant security incidents and fines of up to 2% of the group's revenue in Brazil, capped at R$ 50 million per infraction. The core concepts are similar, so a GDPR program is a good base for adaptation.
Controllers must appoint an encarregado, Brazil's equivalent of a DPO, and publish their identity and contact details. Resolution CD/ANPD 18/2024 allows the role to be performed by an employee, an external individual or a company. Small processing agents may be exempt under Resolution CD/ANPD 2/2022, but they still need a channel for data subjects.
Not as a substitute for the Brazilian clauses. Resolution CD/ANPD 19/2024 created Brazilian standard contractual clauses, which must be adopted without changes, and set August 2025 as the deadline to update existing contracts. The ANPD may recognize foreign clauses as equivalent, but had not done so at the time of writing, so check the ANPD website before relying on EU SCCs.
Yes. In January 2026 Brazil and the EU adopted mutual adequacy decisions, formalized on the Brazilian side by Resolution CD/ANPD 32/2026. Transfers from Brazil to the EU therefore do not need standard contractual clauses. Onward transfers from the EU to a third country, such as the US, still need their own mechanism.
Not for every cookie. Strictly necessary cookies can rely on other legal bases. The ANPD cookie guide indicates that advertising and other non essential cookies generally depend on consent, collected through a banner that lets users reject them as easily as they accept them and that matches the cookie notice.
Yes, for many business purposes, but not for sensitive data. Article 10 requires a concrete purpose, only the data strictly necessary and transparency to the data subject. The ANPD guide on legitimate interest recommends a documented balancing test, which the authority can request at any time.
Article 52 provides for warnings, fines of up to 2% of the revenue of the company or group in Brazil in the last fiscal year, limited to R$ 50 million per infraction, daily fines, publicity of the infraction, blocking or deletion of the data and suspension or prohibition of processing. Consumers can also sue for damages and Procons can fine under consumer law.
If you target users in Brazil, yes in practice. The LGPD requires clear and accessible information, and the Consumer Defense Code requires information about products and services in Portuguese. A Portuguese notice that mirrors your global policy is the safer route.
It depends on your data flows, the number of products and whether you need documents drafted or only reviewed. Brazilian Bar rules require fees to be set individually, so we send a written proposal with scope and fees after the initial call.
Other pages for foreign companies that sell to, hire in or contract with Brazil.
// about the firm
Diego Castro Advogado is a Brazilian law firm focused on data protection (LGPD), contracts and technology law for digital businesses. The lawyer in charge is Diego Castro, admitted to the Brazilian Bar under OAB/PI 15.613, with a postgraduate degree in Digital Law and author of the book "Termos de Uso sem mistério" on terms of use. The firm has an office at Av. Brigadeiro Faria Lima, 1181, São Paulo, and a base in Teresina, Piauí, and works with foreign companies by video call in English. It advises on Brazilian law only and coordinates with the client's home counsel when the matter also involves foreign law.
By Diego Castro, OAB/PI 15.613 · Published · Updated · 19 min read
// legal sources
Reviewed against Law 13,709/2018 (LGPD) and current ANPD regulations, including Resolutions 2/2022, 15/2024, 18/2024 and 19/2024. Information only. Whether and how the LGPD applies depends on your data flows and business model; get advice from a Brazilian lawyer before relying on this page.
Tell us what you sell, who your users in Brazil are and which document or decision is on the table. We reply in English with the next step and, when it makes sense, a written proposal before any work starts.
Online meetings in English · Video calls across time zones
Message us on WhatsApp
