Introduction
The General Personal Data Protection Law (LGPD), Law No. 13.709/2018, is the Brazilian data protection law and a regulatory milestone for privacy and personal data security in Brazil. Inspired by the European Union’s General Data Protection Regulation (GDPR), the LGPD sets out the legal foundations for the processing of personal data by companies and public bodies. Its aim is to guarantee transparency, security and control for data subjects.
In this article, we present the key concepts of the LGPD, who must comply with it, its impact on different business sectors, the penalties for non-compliance and the good practices that can help your company comply with this legislation.
1. What is the LGPD, the Brazilian data protection law?
The LGPD regulates how companies and public bodies must collect, store, process and share personal data. Furthermore, it applies to any operation carried out in Brazilian territory or involving data of people located in Brazil.
1.1 Main objectives of the LGPD
Guarantee the right to privacy and personal data protection.
Encourage transparency in the use of data.
Promote legal certainty and foster economic development.
Establish clear rules for data processing.
1.2 Scope
The LGPD applies to any company, regardless of size, that processes personal data for commercial purposes, including start-ups, service providers and public companies.
2. Key LGPD concepts
To understand the LGPD, it is essential to know some key legal and technical concepts:
Personal data: Any information relating to an identified or identifiable natural person (for example, name, CPF, email).
Sensitive data: Data revealing racial origin, political opinion or religious belief, as well as genetic, biometric, health or sex life data.
Data subject: The natural person to whom the personal data refers.
Controller: The person (individual or legal entity) responsible for making decisions about data processing.
Processor: The party that processes data on behalf of the controller.
Data protection officer (DPO): Responsible for communication between the company, data subjects and the ANPD.
3. Data subjects’ rights
The LGPD grants data subjects a series of fundamental rights:
Confirmation that processing exists.
Access to data.
Correction of incomplete, inaccurate or outdated data.
Anonymisation, blocking or deletion of unnecessary data.
Data portability.
Withdrawal of consent.
Information about sharing with third parties.
Consequently, these rights require companies to adopt systems and processes that allow them to respond to data subjects’ requests quickly and transparently.
4. Legal bases for data processing
Personal data may only be processed if it relies on one of the legal bases set out in the LGPD. The main ones are:
Consent of the data subject.
Compliance with a legal or regulatory obligation.
Performance of a contract or preliminary procedures.
Regular exercise of rights in legal proceedings.
Legitimate interest of the controller, provided the data subject’s rights are respected.
Protection of life or physical safety.
Health protection, in procedures carried out by health professionals or services.
Choosing the right legal basis is therefore one of the critical points in LGPD compliance.
5. Penalties under the LGPD
Failure to comply with the LGPD can lead to severe penalties:
Warnings and corrective measures.
A simple fine of up to 2% of the company’s revenue, capped at R$ 50 million per infringement.
Publication of the infringement.
Blocking or deletion of the personal data involved in the infringement. Daily fines, partial suspension of the database and suspension or prohibition of processing activities, in the most serious cases.
The National Data Protection Authority (ANPD) is the body responsible for supervision, enforcing penalties and issuing complementary guidelines.
6. The LGPD in business practice
The LGPD has a profound impact on how companies handle data in areas such as:
6.1 Human resources
Collection of CVs.
Onboarding and offboarding of employees.
Storage of medical examinations and training records.
6.2 Marketing and sales
Sending promotional emails.
Use of cookies and browsing data.
Registration of customers and leads.
6.3 Customer support
Call recording.
Recording of service history.
Customer identification data.
6.4 Subcontracting and service providers
Subcontracted workers’ documents.
Training certificates.
Equipment data, technical reports (laudos) and tax information.
7. Steps towards LGPD compliance
7.1 Data diagnosis and mapping
The first step is to identify what data the company collects, how it is stored and who it is shared with.
7.2 Risk analysis
Next, it is important to assess the vulnerabilities and the legal, reputational and operational risks related to data processing.
7.3 Review of internal policies and contracts
Adapt privacy policies and contracts with employees, service providers and partners, including data protection clauses.
7.4 Appointment of a data protection officer (DPO)
Appoint a person who will act as the point of contact between the company, data subjects and the ANPD.
7.5 Adoption of technical and administrative measures
Finally, implement access controls, encryption, audit logs, team training and process reviews.
8. Good practices for compliance
Clear and informed consent for the use of data.
Data minimisation, collecting only what is necessary.
Anonymisation whenever possible.
Regular training on security and privacy.
Internal audits and governance policies.
Support channel for data subjects that is available and accessible.
9. The LGPD and digital transformation
With the digitalisation of processes, the use of management software, cloud platforms and mobile apps has grown significantly. Consequently, companies face greater responsibility in the automated processing of data.
9.1 Digital document management
For this reason, companies that use platforms to manage documents of employees, third parties, suppliers and service providers must ensure:
Secure storage.
Access control with authentication.
Backups and data recovery.
Records of consent.
Secure deletion once the purpose has ended.
10. The LGPD and service provider management platforms
Engineering, construction, industrial maintenance and other companies that rely on service providers need to manage a large volume of documents, such as:
ASO and medical examinations.
Training certificates (NR-10, NR-35, etc.).
Service contracts.
Tax documentation.
Equipment data.
In these cases, it is essential to ensure that data is processed in accordance with the LGPD, with:
Clear legal bases (usually compliance with a legal or regulatory obligation and performance of a contract; for sensitive data, such as medical examinations, only the cases in Art. 11 of the LGPD apply).
Transparency towards service providers and employees.
Platforms with compliance features (audit logs, controlled access, encryption).
11. Security incidents: What to do
A data leak, unauthorised access or the loss of a device containing workers’ documents may constitute a security incident. In such cases, the LGPD requires the controller to notify the ANPD and data subjects of incidents that may cause significant risk or harm.
The ANPD regulation on incident reporting, approved in 2024, sets a deadline of three working days from the moment the incident becomes known. Therefore, the company should have a response plan ready, with assigned owners, communication templates and a record of all actions taken.
12. LGPD and GDPR: Key differences
Companies operating in Brazil and the European Union must comply with both laws. Although they are similar, there are important differences:
| Topic | LGPD (Brazil) | GDPR (European Union) |
|---|---|---|
| Incident reporting | Three working days, in cases of significant risk or harm | Up to 72 hours after becoming aware |
| Fines | Up to 2% of revenue in Brazil, capped at R$ 50 million per infringement | Up to 20 million euros or 4% of worldwide turnover |
| Authority | ANPD | The authority of each Member State, such as the CNPD in Portugal |
As a result, a common compliance programme can serve as a basis, provided it respects each country’s specific rules.
13. Practical example: Subcontracted workers’ data
Imagine an energy company that receives documents every month from hundreds of subcontracted workers, including ASO and NR-10 certificates. Before compliance work began, these documents circulated by email and were stored in folders without access control.
To comply with the LGPD, the company centralises the documents on a platform with profile-based access. In addition, it sets retention periods and deletes documents of workers who no longer provide services, where there is no obligation to keep them. This way, it reduces the risk of data leaks and can respond quickly to data subjects’ requests.
Frequently asked questions
Does the LGPD apply to subcontracted workers’ data?
Yes. Data on service providers’ workers is personal data and, in some cases, sensitive data, such as medical examinations. Therefore, the contracting company must process it on an appropriate legal basis and with security measures.
Do all companies need to appoint a data protection officer?
As a rule, yes. However, the ANPD provides simplified rules for small processing agents, which may be exempt in certain situations.
Final thoughts
The LGPD is not just a legal requirement, but a path towards more transparent, secure and ethical relationships between companies, partners and customers. Moreover, compliance with the law brings competitive advantages, reduces risk and enhances corporate reputation.
For this reason, companies involved in document management, especially those working with service providers, should invest in:
Secure digital tools.
Revised internal processes.
Employee training and awareness.
Data governance and accountability.
In short, the LGPD is here to stay, and adapting to this law is an essential step towards digital maturity and business sustainability.
Read also: The right to personal data protection and The role of the data protection officer.
For official guidance on the LGPD, visit the ANPD.