Brazil's General Data Protection Law sets rules for processing the personal data of people in Brazil. It lists principles, ten legal bases, rights for individuals and duties for controllers and operators, and the National Data Protection Agency, the ANPD, enforces it. This list follows the law article by article, from the principles to the sanctions.
Free account needed to download. You come straight back to the file.
Who it is for. Any organisation that processes personal data in Brazil, offers goods or services to people in Brazil, or collects data there, wherever the organisation is based. That includes Indian service providers working for Brazilian clients.
What this list covers. Lei 13.709/2018 in the consolidated text published by the Câmara dos Deputados (Legislação Informatizada, www2.camara.leg.br, PDF dated 26 February 2026), read in Portuguese. It includes the changes by Lei 13.853/2019, Lei 14.460/2022 (ANPD made an autarchy) and Lei 15.352/2026. Check for later changes and for ANPD regulations.: 128 provisions. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it requires |
|---|---|---|
| Art. 3 | Who the law reaches | The law covers processing done in Brazil, processing aimed at offering goods or services to people in Brazil, and data collected in Brazil, wherever the organisation sits or the data is stored. Data is collected in Brazil if the person is there then. |
| Art. 4 | What the law leaves out | Check whether an exclusion applies: private non-economic use, journalism and art, academic work (Arts. 7 and 11 still apply), security, defence and criminal investigation (private firms largely barred), and some foreign data that only passes through. |
| Art. 5 | Key definitions | Learn the terms the duties hang on: personal and sensitive data, anonymised data, controller, operator, the encarregado who is the contact point for people and the ANPD, consent, and processing, which covers almost any operation on data. |
| Art. 6 | Principles and good faith | Act in good faith and test every processing activity against the ten principles in Art. 6, which the next ten entries set out one by one. |
| Art. 6(I) | Purpose | Process only for legitimate, specific and explicit purposes that you have told the person about, and do not later use the data in a way that is incompatible with them. |
| Art. 6(II) | Adequacy | Make sure what you do with the data fits the purposes you told the person about, given the context in which it was collected. |
| Art. 6(III) | Necessity | Limit processing to the minimum needed for the purpose, using only data that is relevant, proportionate and not excessive. |
| Art. 6(IV) | Free access | Let people check, easily and without charge, how and for how long their data is processed and see all the data you hold about them. |
| Art. 6(V) | Data quality | Keep data accurate, clear, relevant and up to date, as far as the purpose needs. |
| Art. 6(VI) | Transparency | Give people clear, precise and easy-to-find information about the processing and about who carries it out, while protecting trade and industrial secrets. |
| Art. 6(VII) | Security | Use technical and administrative measures able to protect data from unauthorised access and from accidental or unlawful destruction, loss, alteration, disclosure or spread. |
| Art. 6(VIII) | Prevention | Take steps in advance to prevent harm to people from the processing. |
| Art. 6(IX) | Non-discrimination | Never process data for discriminatory purposes that are unlawful or abusive. |
| Art. 6(X) | Accountability | Be able to show that your data protection measures are in place and that they work, not merely that they exist. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 7 | Legal bases | Have one of the ten legal bases in Art. 7 before you process personal data. Not needing consent does not remove your other duties, such as the principles and people's rights (Art. 7 §6). |
| Art. 7(I) | Consent | Rely on consent when the person has agreed. Art. 8 sets out how consent must be given and proved. |
| Art. 7(II) | Legal or regulatory obligation | Process data you must use or keep to meet a duty set by law or regulation. |
| Art. 7(III) | Public policy | Public bodies may process and share data needed to carry out public policies set by law, regulation, contract or agreement, subject to Chapter IV. |
| Art. 7(IV) | Research bodies | Research bodies may process data for studies, anonymising it wherever possible. |
| Art. 7(V) | Contract | Process data that is needed for a contract the person is party to, or for steps they asked for before signing one. |
| Art. 7(VI) | Legal claims | Process data needed to exercise rights in court, administrative or arbitration proceedings. |
| Art. 7(VII) | Protecting life | Process data to protect the life or physical safety of the person or of someone else. |
| Art. 7(VIII) | Health protection | Process data for health protection only when the work is done by health professionals, health services or a health authority. |
| Art. 7(IX) | Legitimate interest | Rely on your own or a third party's legitimate interest only where the processing is needed and the person's fundamental rights and freedoms do not outweigh it. Art. 10 adds limits. |
| Art. 7(X) | Credit protection | Process data to protect credit, in line with the credit laws that apply. |
| Art. 7 §§3-4 and 7 | Publicly available data | Use public data in line with why it was made public. Data the person made manifestly public needs no consent, and can serve new purposes if the person's rights and the law's principles are kept. |
| Art. 7 §5 | Sharing after consent | If you collected data on consent and later need to share it with another controller, get specific consent for the sharing, unless another basis in the law removes the need. |
| Art. 8 | Form and proof of consent | Get consent in writing or another way that shows the person's will. Written consent goes in a clause apart from the other contract terms, and you carry the burden of proving it was properly obtained. |
| Art. 8 §§3-4 | Valid consent | Do not process on consent that is flawed. Consent must point to defined purposes, and blanket authorisations for processing are void. |
| Art. 8 §5 | Withdrawing consent | Let people withdraw consent at any time by a free and easy procedure. Processing done under the consent stays valid until the person asks for deletion. |
| Art. 8 §6 | Telling people about changes | If the purpose, the form or length of processing, your identity or the sharing details change, tell the person and highlight the change. Where consent is the basis, they may withdraw it if they disagree. |
| Art. 9 | Information the person is owed | Make clear, prominent information easy to reach: the specific purpose, form and duration, your identity and contact, any sharing and why, who does what, and the Art. 18 rights. |
| Art. 9 §§1-2 | Misleading information voids consent | Consent is void if the information was misleading or abusive, or was not given beforehand in a clear way. If the purpose moves beyond the original consent, inform the person first so they can withdraw. |
| Art. 9 §3 | Data as a condition | When giving data is a condition for a product, a service or the exercise of a right, say so prominently and explain how the person can use their Art. 18 rights. |
| Art. 10 | Legitimate interest: purposes | Use legitimate interest only for legitimate purposes based on concrete situations, such as supporting your activities or serving the person, within their reasonable expectations and rights. |
| Art. 10 §§1-3 | Legitimate interest: data and transparency | Process only the data strictly needed under legitimate interest, make that processing transparent, and be ready to give the ANPD an impact report on it when asked. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 11 | Sensitive personal data | Process data on health, origin, beliefs, biometrics and similar matters only on the narrower bases Art. 11 lists. The rule also reaches data that reveals such facts and could harm the person (§1). |
| Art. 11(I) | Sensitive data: consent | Where consent is the basis, get it from the person or their legal guardian in a specific and highlighted way, for specific purposes. |
| Art. 11(II) | Sensitive data without consent | Without consent, process sensitive data only where it is indispensable for a legal duty, public policy, research, exercising rights, protecting life, health care, or fraud prevention in identity checks. |
| Art. 11 §§3-5 | Sharing health data | Do not share health data between controllers for economic gain, except for health, pharmacy and care services in the person's interest, portability, and related administrative and financial transactions. Health insurers may not use it to select risks. |
| Art. 12 | Anonymised data | Anonymised data is outside the law unless the anonymisation can be reversed with your own means or reasonable effort. Data used to build a behavioural profile of an identified person may count as personal data. |
| Art. 13 | Public health research | When a research body uses personal data for public health studies, keep it inside the body in a controlled and secure setting, anonymise or pseudonymise where possible, never reveal people in results and never pass it to third parties. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 14 | Children's and adolescents' data | Process data of children and adolescents in their best interest. For a child, get specific and highlighted consent from at least one parent or the legal guardian. |
| Art. 14 §§2 and 6 | Explain it so a child can follow | Publish what you collect from children, how you use it and how to use their rights, in simple, clear and accessible terms, with audiovisual aids where useful, so that parents and the child can understand. |
| Art. 14 §3 | Collection without parental consent | You may collect a child's data without parental consent only to contact the parents or guardian (used once and not stored) or to protect the child. Never pass it on without that consent. |
| Art. 14 §4 | No excess data for games and apps | Do not make a child's use of games, internet applications or other activities depend on handing over more data than the activity strictly needs. |
| Art. 14 §5 | Verify the consenting adult | Make every reasonable effort, using available technology, to check that the person who gave consent really is the child's parent or guardian. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 15 | When processing ends | Stop processing when the purpose is met or the data is no longer needed, when the processing period ends, when the person asks (including by withdrawing consent), or when the ANPD orders it for a breach of the law. |
| Art. 16 | Deletion and permitted retention | Delete data once processing ends, within the technical limits of the activity. You may keep it only for a legal duty, research, transfer to a third party under the law, or your own exclusive use once it is anonymised. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 17 | Ownership and fundamental rights | Recognise that every individual owns their personal data and holds fundamental rights to liberty, intimacy and privacy. |
| Art. 18 | Data subject rights | Honour requests to confirm processing, access, correct, anonymise, block or delete data, port it, learn who it was shared with, and withdraw consent. |
| Art. 18(I)-(II) | Confirmation and access | On request, confirm whether you process the person's data and give them access to it. |
| Art. 18(III) | Correction | Correct data that is incomplete, inaccurate or out of date when the person asks. |
| Art. 18(IV) | Anonymise, block or delete | Anonymise, block or delete data that is unnecessary, excessive or processed in breach of the law, when the person asks. |
| Art. 18(V) and §7 | Portability | Move the person's data to another service or product provider on their express request, following ANPD rules and protecting trade secrets. Data you have already anonymised is not covered. |
| Art. 18(VI) | Deletion of consent-based data | Delete data you process on the person's consent when they ask, except where Art. 16 lets you keep it. |
| Art. 18(VII) | Who the data was shared with | Tell the person which public and private entities you have shared their data with. |
| Art. 18(VIII) | Right to refuse consent | Tell the person that they may refuse consent and what follows if they do. |
| Art. 18(IX) | Withdrawal of consent | Act on a request to withdraw consent, which Art. 8 §5 says must be easy and free. |
| Art. 18 §§1-2 and 8 | Complaints and objection | People can petition the ANPD about you, and also consumer defence bodies. They may object to processing done without consent if it breaks the law, so keep a way to take and answer objections. |
| Art. 18 §§3-5 | Handling requests | Take requests from the person or their representative, free of charge, within regulatory deadlines. If you cannot act at once, say you are not the processor and who is, or give the reasons in fact or law. |
| Art. 18 §6 | Pass corrections on | Promptly tell everyone you shared the data with about a correction, deletion, anonymisation or blocking so they do the same, unless that is impossible or takes disproportionate effort. |
| Art. 19 | Timing of confirmation and access | Answer at once in a simple format, or within 15 days with a clear, complete statement of the data's origin, the absence of any record, the criteria used and the purpose. Store data in a form that helps access. |
| Art. 19 §§2-3 | Form of access and electronic copy | Provide data electronically or on paper as the person chooses. Where processing rests on consent or a contract, give a full electronic copy on request, in a format that can be reused. |
| Art. 20 | Review of automated decisions | Let people ask for a review of decisions based only on automated processing that affect their interests, including profiling for personal, work, consumer and credit matters. |
| Art. 20 §§1-2 | Explain the decision logic | On request, give clear and adequate information on the criteria and procedures behind an automated decision. If you withhold it as a trade secret, the ANPD can audit the system for discrimination. |
| Art. 21 | No use against the person | Do not use data about a person exercising their rights against that person. |
| Art. 22 | Court action | Expect people to defend their data rights in court, individually or collectively, through the ordinary routes for individual and collective claims. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 23 | Public bodies: purpose and openness | Public bodies must process for a public purpose within their legal powers, publish clear and current information on legal basis, purpose and procedures, and name an encarregado. Notaries and registries are treated the same way (§4). |
| Art. 24 | State-owned companies | State-owned companies that compete in the market are treated like private bodies. When they carry out public policy, they are treated like public bodies. |
| Art. 25 | Interoperable formats | Public bodies keep data in a structured, interoperable format for shared use, to support public policy, services and public access to information. |
| Art. 26 | Shared use by public bodies | Shared use of personal data by public bodies must serve specific public policy purposes and legal duties, and respect the Art. 6 principles. |
| Art. 26 §§1-2 | Public bodies passing data to private entities | A public body may pass data to private entities only in the cases listed: delegated public activity, public data, a legal basis or agreement, or fraud prevention. Tell the ANPD of the contracts and agreements. |
| Art. 27 | Public-to-private sharing | Telling the ANPD and getting the person's consent are needed for a public body to share data with a private party, unless consent is not required, the sharing is publicised under Art. 23, or an Art. 26 §1 case applies. |
| Art. 29 | ANPD information requests to public bodies | Expect the ANPD to ask a public body at any time for details of the scope and nature of the data and how it is processed, and to issue supplementary technical opinions. |
| Art. 30 | Supplementary rules on sharing | The ANPD may set further rules for communicating and sharing personal data, so check its regulations. |
| Arts. 31-32 | ANPD measures against public bodies | For a breach by a public body, the ANPD can send a report of measures to stop it. It can also ask public bodies to publish impact reports and suggest good-practice standards. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 33 | International transfers | Transfer data abroad only to countries or recipients that meet the law's conditions, such as adequate protection or approved contract clauses. |
| Art. 33(I) | Transfer to an adequate country | Transfer to a country or international body whose level of protection is adequate under the law, as the ANPD assesses it. |
| Art. 33(II) | Transfer with safeguards | Offer and be able to prove safeguards: clauses for that transfer, standard contract clauses, global corporate rules, or seals, certificates and codes of conduct. |
| Art. 33(VIII) | Transfer on consent | For transfer by consent, get specific and highlighted consent after telling the person beforehand that the operation is international, kept clear of other purposes. |
| Art. 33(III)-(VII) and (IX) | Other transfer grounds | Other grounds: legal cooperation between public authorities, protecting life, ANPD authorisation, a cooperation agreement, publicised public policy, or a need under Art. 7(II), (V) or (VI). |
| Art. 34 | How adequacy is judged | The ANPD weighs the destination's laws, the nature of the data, the principles and rights of this law, security measures, judicial and institutional guarantees and other circumstances, so rely on its assessment. |
| Art. 35 | Approval of clauses and mechanisms | The ANPD sets standard contract clauses and checks specific clauses, global corporate rules and certificates. It can ask for more information, inspect, and name certification bodies. The operator's own measures count too. |
| Art. 36 | Changes to safeguards | Tell the ANPD when the safeguards you presented as sufficient for a transfer change. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 37 | Records of processing | Keep a record of the processing you carry out, whether as controller or operator, especially where it relies on legitimate interest. |
| Art. 38 | Data protection impact report | Prepare an impact report, covering sensitive data too, when the ANPD orders it. At a minimum, describe the data types, the collection and security methods, and your analysis of safeguards and risk mitigation. |
| Art. 39 | Operator follows instructions | Operators process only on the controller's instructions. The controller checks that the instructions and the rules on the subject are followed. |
| Art. 40 | Interoperability and record-keeping standards | The ANPD may set standards for interoperability for portability, access and security, and for how long records are kept, with necessity and transparency in mind. |
| Art. 41 | Data protection officer (encarregado) | Appoint an encarregado for personal data and publish their identity and contact details clearly, preferably on your website. |
| Art. 41 §2 | What the encarregado does | The encarregado takes complaints and communications from people, takes ANPD communications and acts on them, guides staff and contractors on data protection, and carries out other duties you or ANPD rules set. |
| Art. 41 §3 | ANPD rules on the role | The ANPD may set further rules on the encarregado, including exemptions by the entity's size or volume of processing. Check its current rules before concluding you need none. |
| Art. 42 | Duty to repair damage | A controller or operator who breaks data protection law and so causes material, moral, individual or collective damage must put it right. |
| Art. 42 §1 | Joint liability | An operator is jointly liable if it breaks its duties or ignores the controller's lawful instructions, and is then treated as a controller. Controllers directly involved in the processing are jointly liable. |
| Art. 42 §§2-4 | Burden of proof, class claims, recourse | A civil court may shift the burden of proof to you in a plausible claim. Collective claims are possible. Whoever pays can recover from the others in proportion to their part. |
| Art. 43 | When you are not liable | You escape liability only by proving that you did not do the processing, that there was no breach of the law, or that the damage came wholly from the person or a third party. |
| Art. 44 | Irregular processing | Processing is irregular if it breaks the law or lacks the security a person can expect, judged by how it was done, expected results and risks, and techniques then available. Skipping Art. 46 measures makes you liable for a breach. |
| Art. 45 | Consumer relationships | Where a breach of data rights happens in a consumer relationship, consumer law's liability rules still apply. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 46 | Security measures | Adopt technical and administrative measures that protect personal data from unauthorised access and from accidental or unlawful loss, alteration or disclosure. |
| Art. 46 §§1-2 | Security by design | Apply security measures from the design of a product or service through to operation. The ANPD may set minimum technical standards, especially for sensitive data. |
| Art. 47 | Duty continues after processing | Everyone involved in any phase of processing stays bound to keep the data secure, even after processing ends. |
| Art. 48 | Incident communication | Tell the ANPD and the affected people about a security incident that may cause them risk or relevant harm, within a reasonable period the ANPD defines. |
| Art. 48 §1 | Contents of the incident notice | State the nature of the data affected, the people involved, the protection measures in place, the risks, why any delay occurred, and the steps taken or planned to reverse or reduce the harm. |
| Art. 48 §§2-3 | ANPD response to an incident | The ANPD can order wide public notice and mitigation. In judging gravity it considers whether suitable technical measures made the data unintelligible to unauthorised people. |
| Art. 49 | Systems built to comply | Structure systems that process personal data to meet security requirements, good-practice and governance standards, the law's principles and other regulations. |
| Art. 50 | Good practice and governance rules | Controllers and operators may set codes of good practice covering organisation, procedures, complaints, security, technical standards, training, internal oversight and risk reduction. Publish and update them. |
| Art. 50 §2(I) | Privacy governance programme | A privacy governance programme should show commitment, cover all data you control, fit your scale, rest on systematic risk assessment, involve people, be overseen, include incident plans and be kept current. |
| Art. 50 §2(II) | Prove the programme works | Be ready to show the programme works, in particular when the ANPD or a code-of-conduct body asks. |
| Art. 51 | Standards that help people control data | The ANPD encourages technical standards that make it easier for people to control their own data, so expect guidance on them. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 52(I), (IV)-(VI) | Warnings and corrective sanctions | The ANPD can warn with a deadline for fixes, publicise a confirmed infringement, block the data concerned until it is put right, and order its deletion. |
| Art. 52(II)-(III) | Fines | A simple fine can reach 2% of the company's, group's or conglomerate's revenue in Brazil in its last year, excluding taxes, capped at R$ 50 million per infraction. A daily fine counts within that cap. |
| Art. 52(X)-(XII), §6 | Suspension and bans | The ANPD can suspend part of a database or the processing activity for up to six months, renewable, or ban data processing activities. These come only after at least one fine, publicity, blocking or deletion in the same case. |
| Art. 52 §1 | How sanctions are chosen | Sanctions follow a process with a full defence and weigh gravity, good faith, benefit gained, means, repeat offences, harm, cooperation, internal mitigation, good-practice policy, prompt fixes and proportion. |
| Art. 52 §§2, 4 and 7 | Other liability and fine base | Other consumer-law and civil or criminal sanctions still apply. The ANPD may use total revenue if branch revenue is unavailable. Individual leaks may be settled directly with the person before penalties apply. |
| Art. 52 §3 | Public bodies | Warnings, publicity, blocking, deletion, and suspension or ban of processing can also be applied to public bodies, without displacing other laws. |
| Art. 53 | Fine methodology | The ANPD sets, by regulation after public consultation, a published method for calculating base fines and when simple or daily fines apply. |
| Art. 54 | Daily fines | A daily fine reflects the gravity of the fault and the extent of the damage, with reasons. The notice must set out the obligation, a reasonable deadline and the daily amount. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 55-A | The data protection authority | The ANPD is a special-nature autarchy tied to the Ministry of Justice and Public Security, with functional, technical, decision-making, administrative and financial autonomy. Law 14.460/2022 gave it this status. |
| Art. 55-J(IV), (V), (XVI) | Supervision, complaints and audits | The ANPD can supervise and sanction after due process, hear a person's petition once they have complained to you without result, and carry out or order audits of processing, including by public bodies. |
| Art. 55-J(XIII), (XX) | Regulations and interpretation | The ANPD issues regulations, including on impact reports for high-risk processing, and rules finally on how the law is read in the administrative sphere, so follow its guidance. |
| Art. 55-J(XVII) | Settlement commitments | The ANPD can agree with a processing agent, at any point, a commitment to end an irregularity, uncertainty or dispute in an administrative case. |
| Art. 55-J(XVIII) | Simplified rules for small firms | The ANPD issues simplified and differentiated rules, including deadlines, for micro and small businesses and self-declared startups, so check whether they apply to you. |
| Art. 55-J §§1-2 | Minimal intervention and consultation | In imposing conditions on private processing the ANPD must intervene as little as it can. Its regulations are preceded by public consultation and hearings and by regulatory impact analysis. |
| Art. 55-K | ANPD alone sanctions | Only the ANPD can apply this law's sanctions, and on data protection its powers prevail over other bodies. It is the central interpreter of the law and works with other regulators. |
| Art. 58-A | National Data Protection Council | A council of 23 representatives of government, Congress, courts, civil society, science, labour and business advises on policy and ANPD action. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 61 | Foreign companies served in Brazil | A foreign company is served with all procedural acts under this law through its agent, representative or the person in charge of its branch or office in Brazil, with no power of attorney needed. |
| Art. 63 | Gradual adjustment of older databases | The ANPD sets rules for the gradual adjustment of databases created before the law took effect, considering the complexity of the processing and the nature of the data. |
| Art. 65 | When provisions took effect | The articles on the ANPD took effect on 28 December 2018, Arts. 52 to 54 on 1 August 2021, and the remaining articles 24 months after publication. |
Alongside the list above, SecureXcel keeps a unified set of practical controls. For each control the workbook gives the risk it addresses, the objective, a description, whether it is preventive or detective, how often to run it, the design and operating test procedures, and the evidence to collect, with the references it covers in this framework. There is one workbook per framework, supplied as it is, with a Version History sheet for document control. Free account needed; you come straight back to the file.
Yes. It applies to processing carried out in Brazil, to processing aimed at offering goods or services to people in Brazil, and to data collected there, whatever the organisation's location (Art. 3).
Ten for ordinary personal data (Art. 7). Consent is one, not the only one: the law also allows processing for legal obligations, contracts, legitimate interest, health protection, credit protection and more. Sensitive data has a narrower list in Art. 11.
The main fine can reach 2% of the revenue in Brazil of the company, group or conglomerate in its last year, excluding taxes, capped at R$ 50 million per infraction (Art. 52). The ANPD can also warn, publicise the breach, block or delete data, and in later steps suspend or ban processing.
Art. 41 says the controller must appoint one and publish their contact details. The ANPD can set exemptions by size or volume of processing, so check its current rules.
The ANPD. Lei 14.460/2022 made it an autarchy of special nature, and it is the only body that applies the law's sanctions (Art. 55-K). It also issues regulations, for example on breach reporting.
They are similar in structure, with comparable principles, rights and a data protection officer. Details differ, for example the list of legal bases and the way breaches are reported.
No. It is a plain-English summary in our own words of the main duties, rights and enforcement provisions. The law itself and the ANPD's regulations are the authority, so read them before you rely on a requirement.