LGPD · Brazil's General Personal Data Protection Law
LGPD compliance consulting for personal data from Brazil handled the way the law expects.
Meet Brazil's Lei Geral de Proteção de Dados Pessoais with a programme your customers, your encarregado and the ANPD can follow from decision to evidence. Sterling's expert and experienced consultants map your processing, close the gaps with your teams and your legal advisers, and keep the programme running afterwards, in 60+ countries. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced data protection consultants, building privacy and management system programmes across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. No LGPD certificate exists; Sterling prepares the programme and its evidence, and the ANPD supervises compliance
8,100+ client engagements in 60+ countries.
LGPD client experience
What it is
What is the LGPD and what is it used for?
The LGPD is Brazil's general law on personal data, Law No. 13,709 of 14 August 2018. It governs the processing of information about identifiable people by companies and the public sector, and sets out when processing is lawful, what rights the titular (the data subject) holds, what the controlador (controller) and operador (processor) must do, how data may leave Brazil and how security incidents are handled.
Its reach is not limited to Brazilian companies. The law applies where processing takes place in Brazil, where it serves or targets people located there, or where the data was collected there. A shared-services centre in Manila answering Brazilian customers is inside its scope.
The Agência Nacional de Proteção de Dados (ANPD) interprets the law through regulations, inspects organisations and applies administrative sanctions. There is no LGPD certificate: compliance is something you show through decisions, controls and records.
Current text. Law No. 13,709/2018 as amended, including by Law No. 13,853/2019, which created the ANPD. Law No. 15,352 of 25 February 2026 converted the ANPD into a regulatory agency. The ANPD's regulations now cover incident communication (Resolution CD/ANPD No. 15/2024), the encarregado (No. 18/2024) and international transfers with standard contractual clauses (No. 19/2024), and Resolution No. 32/2026 recognised the European Union as providing adequate protection.
Who it is for
Who needs LGPD compliance?
Size does not take an organisation out of the law, although the ANPD has adopted a specific regulation for small processing agents. Clients usually reach Sterling from one of four directions:
- A Brazilian customer sends a privacy questionnaire. Buyers ask for your encarregado, incident procedure and transfer safeguards before signing; one evidenced programme answers them all.
- A tender or partnership names the LGPD. Know what the data protection clause commits you to before you sign it.
- You expect questions from the ANPD. A complaint, an incident or a sector inspection brings the regulator's attention; a documented programme lets you respond on time.
- A group company or acquisition operates in Brazil. Multinationals running one privacy programme for the GDPR need to adjust it for Brazilian legal bases, rights, transfer rules and the three-business-day incident deadline.
The aim is a programme that operates in daily work and can be shown to a customer or the regulator. Results depend on implementation and continued ownership.
Requirements
What are the main LGPD requirements?
Strip away the vocabulary and Brazil's LGPD asks a business to comply in six areas of personal data handling. The list below puts each one in business terms; the law and the ANPD's regulations give the full wording and exceptions, which we work through with you and your legal advisers during the programme.
- Every use of data has a lawful basis: personal data is processed only on one of the bases the law lists, and consent, where relied on, is specific, documented and can be withdrawn.
- Purpose, necessity and openness: data is used for stated purposes, limited to what those purposes need, and people can easily learn how and for how long it is handled.
- People can exercise their rights: requests to confirm processing, access, correct, anonymise, delete or port data, and to learn who it was shared with, are received and answered.
- Security measures and incident notice: technical and administrative measures protect data, and an incident that may cause relevant risk or harm is reported to the authority and the people affected.
- A named data protection officer: the controller appoints an encarregado, publishes their identity and contact details, and uses the role as the channel between people, the organisation and the authority.
- Transfers are safeguarded and provable: transfers abroad rely on adequacy, standard clauses or other listed safeguards, and the organisation keeps processing records and can demonstrate that its measures work.
What does useful LGPD evidence look like?
An inventory of processing operations tied to real systems, the legal basis chosen for each activity with its reasoning, privacy notices where data is collected, the published encarregado contact, a log of data subject requests with response dates, processor contracts carrying the ANPD clauses where data leaves Brazil, impact reports where risk calls for one, and an incident register that records decisions not to notify as well as notifications. We build these in Effivity from the first workshop, so they are current when a customer or the ANPD asks.
Compliance route
How do you achieve LGPD compliance?
There is no audit to pass and no certificate at the end. The route is a programme that you run and can demonstrate, with Sterling supporting its design and build and your legal advisers confirming legal interpretation.
- 01Establish scope and roles.Confirm which entities, systems and activities touch Brazilian personal data, where you act as controller or processor, and who will act as encarregado.
- 02Gap analysis: compare current practice with the law.Map processing and data flows, test notices, contracts, rights handling and security against the LGPD and the ANPD's regulations, and agree actions, owners and dates.
- 03Build the programme and start its records.Record legal bases, publish notices, open the rights channel, sign processor and transfer clauses, set the incident procedure against the three-business-day deadline and train staff.
- 04Test it: internal audit and management review.An internal audit against the law and a review with the encarregado and management show what works; findings are raised by us first and closed with evidence.
- 05Answer customers and the regulator, and keep it current.Respond to questionnaires and ANPD requests from existing evidence, and follow new ANPD regulations, systems and suppliers as they arrive.
Check the offer before you sign. No body can issue an official LGPD certificate, so treat any "LGPD certified" seal with care and ask what the provider leaves behind: the processing inventory, the decisions, the contracts and trained people. Confirm current regulations on the ANPD's own website at gov.br/anpd. The certification buyer's checklist
Cost
How much does LGPD compliance cost?
The price depends less on headcount than on how much personal data moves, where and through whom: a software firm with three processors is a different programme from a multi-country contact centre. The Sterling proposal shows each part and states everything that is included.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Processing activities, systems, suppliers and transfers to cover, controller and processor roles, and how much work your team carries (Design™ or Drive™) |
| External reviews | No certification fee exists; customer audits, questionnaires and ANPD requests cost your people's time, and any optional ISO/IEC 27701 certification is quoted by the certification body separately |
| Internal resources and legal | Time from process owners and the encarregado, IT changes for access, retention and security, contract renegotiation and your legal advisers' review |
| Software and learning | Included in a Sterling engagement: Effivity for the programme and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Internal audits, incident rehearsals, monitoring of new ANPD regulations and refresher learning under Sustain™ |
What moves the price
- Volume and sensitivity of the Brazilian personal data you handle
- Number of systems, processors and group entities involved
- Transfers out of Brazil and the contracts that must change
- Whether a GDPR or ISO/IEC 27001 programme already exists
- Deadlines from customers, contracts or the regulator
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Any third-party fees identified separately
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables
- One all-inclusive proposal. No surprises, ever
Timeline
How long does LGPD compliance take?
A first programme usually takes four to nine months, as an estimate: shorter where a GDPR programme can be adapted, longer where data mapping starts from nothing and many suppliers must sign new clauses. Contract negotiation and IT changes set the pace more often than document writing does.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to system owners, contracts and existing records |
| Build and implementation | Legal basis decisions, supplier clauses, IT changes and training |
| Evidence and review | Controls running long enough to leave records, then internal audit and management review |
| Customer or regulator response | The timing of customer audits, questionnaires and any ANPD request |
If a customer has set a date, tell us at the start and we will say what can be ready by then and what cannot.
Your engagement
What your LGPD engagement includes
One team and one all-inclusive proposal cover the full programme. Sterling OS™ sets the phases: choose Design™, where we guide and your team builds, or Drive™, where we manage the work and your team decides; they are alternative support levels, not stages. Sustain™ keeps the programme current once it runs, and Automate™ is Effivity. Sterling does not certify, attest or validate LGPD compliance, because no such certificate exists.
Scope, gap analysis and plan
Roles, owners and dates agreed before work starts.
Records, notices and contracts
Processing inventory, legal basis register, privacy notices and transfer clauses, built with your teams.
Effivity ISO & GRC software
The programme runs in Effivity from the start, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
Conducted or facilitated as agreed, with findings closed with evidence.
Customer and regulator readiness
Evidence packs for questionnaires, customer audits and ANPD requests, and incident rehearsal.
Supervision and enforcement of the LGPD remain with the ANPD.
Often combined with
Standards organisations pair with LGPD (Brazil)
- ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
- APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
- APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
- Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
- CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
- Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.
Effivity · privacy programme software, included in every engagement
How Effivity helps you run and evidence an LGPD programme.
Every Sterling LGPD engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant sets up the workspace within the agreed scope so the processing inventory, legal basis decisions, rights requests, incidents, supplier contracts, risks, audits and training records sit together and are updated as work happens. When a Brazilian customer or the ANPD asks for evidence, you open a screen instead of building a file. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Entities, roles and scope
Which entities and activities fall under the LGPD, where you are controller or processor, and the encarregado's contact, kept in one reviewed register.
Processing inventory and legal bases
Each activity with its purpose, data categories, systems, retention and the legal basis chosen, with the reasoning attached.
Requests and responses
Every request logged with identity checks, owner, response and date, so late answers are visible before a complaint is.
Transfers and safeguards
Each flow out of Brazil with its ground, whether adequacy or standard contractual clauses, and the contract that carries it.
Processors and contracts
Suppliers handling personal data, their contracts, reviews and sub-processor changes tracked to renewal.
Risks, controls and incidents
Risk assessments, security controls and an incident register with the timeline, the risk decision and any communication made.
Internal audit and management review
Audit programmes, findings and actions, and a review that records decisions and follow-up.
Your own forms and reports
Forms, workflows and reports adapted to how you work, without code, with new ANPD regulations tracked to the processes they affect.
What this means when someone asks
A customer's privacy team asks for the processing inventory, the transfer clauses and the last incident review; the ANPD may ask for an impact report. In Effivity each of these is current, dated and owned. After the build, Sustain™ runs in the same workspace, so the programme keeps pace with new systems and suppliers.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your documents, records and registers migrated, not retyped
- Admin and user training for your team
- Modules for EMS, OHSMS, ISMS, FSMS and more when you integrate other standards
Sterling Academy · data protection e-learning
Train everyone who handles Brazilian personal data.
Sterling Academy offers e-learning for the whole workforce and for the people who run the programme, with video lessons, practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Awareness for every employee who touches personal data, with training records to show
- Deeper learning for the encarregado, process owners and IT
- Internal auditor training for the people who will audit the programme, as applicable to your standard, as part of the engagement
- Progress reports by department for customer questionnaires
- New joiners trained as they start
- A Sterling consultant reachable when a learner needs one
Where we work
Where Sterling delivers LGPD (Brazil)
Keep exploring
Explore more about LGPD (Brazil)
LGPD resources
Services for LGPD (Brazil)
Why Sterling
Why choose Sterling for LGPD compliance?
Many of our clients handle Brazilian personal data from outside Brazil, often alongside the GDPR and other privacy laws. We build one programme that meets the LGPD's own rules without running a separate system for each law.
Privacy programmes in 60+ countries since 2003
Management system and data protection work across every region we serve, with one engagement team accountable wherever your entities sit.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with any third-party fees shown separately.
Built on what you have
Existing GDPR or ISO/IEC 27001 work is reused and extended for Brazil, not rewritten.
Expert and experienced consultants
Consultants who have built privacy and security programmes across sectors and countries, working alongside your legal advisers rather than replacing them.
The Sterling Promise
What our LGPD compliance success guarantee means
We stay with you until the agreed LGPD programme outcome is reached, supporting the build, the evidence and the response to customer or regulator findings. Included software and employee learning leave you with lasting capability.
The engagement identifies the law, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed controls into use. The ANPD supervises compliance with the LGPD, and your legal advisers remain responsible for legal interpretation. Our commitment concerns the agreed compliance support, not a promise of every future contract award or an incident-free future.
FAQs
Frequently asked questions about the LGPD
Does the LGPD apply to companies outside Brazil?
Yes, if you process personal data in Brazil, offer goods or services to people there, or handle data collected there. Where your company is registered does not decide the question; what you do with Brazilian data does.
Is a GDPR programme enough for the LGPD?
No, although it is a strong base. The LGPD has its own list of ten legal bases, its own rights, the ANPD's standard contractual clauses for transfers and a three-business-day window for communicating qualifying incidents, so a GDPR programme needs Brazilian adjustments.
Who can be our encarregado?
The controller appoints the encarregado and publishes their identity and contact details. The role receives complaints from data subjects, deals with the ANPD and guides staff; the ANPD's Resolution No. 18/2024 regulates how it works, and we help you decide whether the role sits inside the company or with an outside provider.
When must a data breach be reported to the ANPD?
Within three business days, when a confirmed incident involving personal data may cause relevant risk or damage to data subjects, under Resolution CD/ANPD No. 15/2024. The affected people must be told in the same period, and the controller can complete the information later.
Can we send personal data from Brazil to the EU or other countries?
Yes, on a ground the law allows. The European Union has an adequacy decision under Resolution No. 32/2026; for most other destinations organisations use the ANPD's standard contractual clauses, adopted without changes.
Keep exploring
More on LGPD (Brazil) and related standards
Talk to a consultant
Plan your LGPD compliance programme with a Sterling consultant.
Tell us your entities, the Brazilian data you handle and any customer deadline. We will help you set the scope, the plan and the next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice