LGPD Compliance Services: Data Mapping, Legal Bases, and ANPD Readiness for Brazil
LGPD compliance readiness for companies that handle personal data of people in Brazil, wherever they are based. We map your data and test your rights, incident, and transfer processes against Brazil's General Personal Data Protection Law and the ANPD's rules. You then get a risk-ranked LGPD compliance roadmap. Most assessments take 6–12 weeks.
What Is LGPD Compliance?
LGPD compliance means meeting Brazil's Lei Geral de Proteção de Dados, Law 13.709/2018. Every use of personal data needs a legal basis and a clear purpose. People in Brazil must be able to exercise their rights, data must be kept secure, and serious incidents must be reported to the ANPD. LGPD compliance also means being able to show all of this with records.
The law reaches well beyond Brazil. A US software company with Brazilian users can be in scope. So can a retailer shipping to São Paulo or a group running payroll for Brazilian staff. The law applies whenever data is processed in Brazil, collected there, or used to offer goods and services to people there.
Accredify Global assesses where you stand against the law and the ANPD's regulations, often alongside a NIST CSF or NIS2 review for global groups. We test your processes on real requests and realistic incidents, then give you a roadmap your DPO, counsel, and engineers can act on.
LGPD in 2026: A New Agency, EU Adequacy, and Children's Data
The ANPD is now a full regulatory agency. Law 15.352/2026, signed on 25 February 2026, made it the National Data Protection Agency, with financial autonomy and a dedicated inspection career. Its 2026–2027 inspection priorities cover data subject rights in targeted advertising, children online, the public sector, and AI. A public consultation on its enforcement rules runs until 26 October 2026.
Data now flows freely between Brazil and the EU. On 27 January 2026 the European Commission and the ANPD adopted mutual adequacy decisions. Transfers in either direction no longer need standard contractual clauses. Transfers to most other countries still do, using the ANPD's own clauses without changes.
Children's data carries new duties. The Digital Statute for Children and Adolescents, Law 15.211/2025, has applied since 17 March 2026, and the ANPD supervises it. Brazil's AI bill, PL 2338/2023, is still before the Chamber of Deputies and is not yet law.
Sources: Law 15.352/2026 (Planalto) · EU adequacy decision 2026/179 (EUR-Lex) · ANPD priority themes 2026–2027 · ECA Digital start date (Teletime)
LGPD Requirements, and What We Assess
The obligations the ANPD checks first, and the evidence our assessment looks for.
| Obligation | What the law expects | Evidence we look for |
|---|---|---|
| Records of processing | Controllers and processors keep records of their operations | An inventory that matches your real systems and vendors |
| Legal bases | Each purpose rests on one of ten bases; sensitive data on stricter ones | A documented basis per purpose, plus legitimate interest assessments |
| Data subject rights | Confirmation, access, correction, deletion, portability, and review of automated decisions | Request logs, response times, and identity checks |
| Encarregado (DPO) | An appointed officer with published contact details | Appointment, independence, and a working channel |
| Security and incidents | Appropriate safeguards and notice of relevant incidents | Controls, an incident register, and a tested notice process |
| Impact reports | A RIPD where the ANPD requests one or risk is high | Impact reports for high-risk processing |
| International transfers | A valid mechanism for data leaving Brazil | Adequacy, ANPD clauses, or another lawful route per flow |
LGPD Deadlines, Fines, and Who Is in Scope
Short clocks and real penalties are why LGPD compliance teams test their processes before the ANPD does.
Clocks your team must meet
| Security incident | Notify the ANPD and affected people within 3 business days (Resolution 15/2024) |
|---|---|
| Access request | Simplified reply at once; a full statement within 15 days |
| Incident records | Keep the incident register for at least 5 years |
Small processing agents get longer deadlines under the ANPD's small-agent rules.
Penalties the ANPD can apply
- Warnings with a deadline for corrective action
- Fines up to 2% of Brazil revenue, capped at R$50 million per infraction
- Daily fines until a violation stops
- Publication of the violation
- Blocking or deletion of the personal data involved
- Partial or full suspension of processing
Fines are only part of the cost of weak LGPD compliance. Publication of a violation reaches customers and partners, and a suspension order can stop a product line. The ANPD also weighs good faith, cooperation, and the privacy governance you can prove. That is why a documented program matters before anything goes wrong.
How Our LGPD Readiness Assessment Works
Six stages, from the first call to a roadmap your leadership can sign off. If you also plan ISO certification, our certification process guide shows how the two fit together.
Not sure whether LGPD applies to you, or how much of your GDPR work carries over? A free scoping review answers that first.
Book a free scoping reviewLGPD vs GDPR: What Carries Over and What Doesn't
Companies that already run a GDPR program are usually most of the way to LGPD compliance. These are the gaps we see most.
| Topic | GDPR | LGPD |
|---|---|---|
| Legal bases | Six | Ten, including credit protection and health protection |
| Breach notice | 72 hours to the regulator | 3 business days to the ANPD and affected people |
| Maximum fine | 4% of global turnover or €20 million | 2% of Brazil revenue, capped at R$50 million per infraction |
| Data protection officer | Required in defined cases | Required for most controllers |
| Transfers | EU clauses or adequacy | ANPD clauses or adequacy; EU adequacy since 2026 |
| Regulator | National authorities and the EDPB | One national agency, the ANPD |
Standards help too. ISO 27001 covers much of the security expected under Article 46. ISO/IEC 27701 adds privacy roles, records, and processes that map well to both laws. Our GDPR compliance services and LGPD work share one data map, so you do not document the same systems twice. Payment data adds PCI DSS, and US customers often ask for a SOC 2 report alongside it.
LGPD Compliance Cost and Timeline
We do not publish a price list for LGPD compliance. The cost depends on how much personal data you process and where it goes. A free scoping review gives you a tailored proposal.
What shapes the scope
- Processing activities — how many purposes and data sets
- Systems and vendors — apps, clouds, and processors handling the data
- Sensitive data — health, biometrics, or children's data
- Entities and countries — group companies and transfer routes
- Reuse — GDPR records or ISO 27701 evidence already in place
How long it takes
| Assessment and roadmap | 6–12 weeks, depending on scope |
|---|---|
| Closing gaps | Set by your roadmap and team capacity |
| Ongoing review | Yearly, or when ANPD rules change |
How to Choose LGPD Compliance Services
Questions worth asking any LGPD compliance provider, and how Accredify Global answers them.
| Question to ask | Accredify Global's answer |
|---|---|
| Can you certify us for LGPD? | No one can. There is no LGPD certificate; we assess readiness and report. |
| Do you test processes or only read policies? | We test them, using real requests and a realistic incident drill. |
| Can you reuse our GDPR work? | Yes. We start from your GDPR records and assess only the differences. |
| Do you act as our DPO? | No. We assess the role; your appointed encarregado runs it. |
| Do you give legal advice? | No. Legal interpretation stays with your counsel. |
| How is it priced? | A tailored proposal after a free scoping review. |
What You Receive From an LGPD Assessment
Personal data flows across systems, vendors, and countries.
Each purpose and its basis, with gaps flagged.
How rights requests and the incident drill performed.
The mechanism for every flow leaving Brazil.
Actions in priority order, with owners.
A plain summary for your board and customers.
Frequently Asked Questions About LGPD Compliance
Straight answers on scope, fines, incidents, transfers, cost, and timeline.
What is LGPD?
LGPD is Brazil's General Personal Data Protection Law, Law 13.709/2018. It has been in force since 18 September 2020, and administrative sanctions have applied since 1 August 2021. It governs how personal data of people in Brazil is collected, used, shared and stored.
Does LGPD apply to companies outside Brazil?
Yes. It applies when processing takes place in Brazil or the data was collected there. It also applies when you offer goods or services to people in Brazil. A US company with Brazilian customers or users is usually in scope.
Is there an LGPD certification?
No. There is no official LGPD certificate. Compliance is shown through records, policies, contracts and working processes. If customers want a certificate for privacy management, ISO/IEC 27701 is the internationally recognized option.
Who enforces LGPD?
The ANPD. Law 15.352/2026, signed on 25 February 2026, turned it into the National Data Protection Agency. It is now a regulatory agency with its own budget and a dedicated inspection career.
What are the fines under LGPD?
Fines can reach 2% of the group's revenue in Brazil for the last financial year, capped at 50 million reais per infraction. The ANPD can also order daily fines, publicize the violation, block or delete data, or suspend processing.
How fast must a data breach be reported under LGPD?
ANPD Resolution 15/2024 requires notice to the ANPD and affected people within three business days. The clock starts when you learn an incident may cause relevant risk or damage. Small processing agents get longer deadlines.
Do we need a DPO under LGPD?
Most controllers must appoint an encarregado, the LGPD's data protection officer, and publish their contact details. ANPD Resolution 18/2024 sets the rules. Small processing agents can be exempt but must still offer a communication channel.
Do we still need standard contractual clauses for transfers from Brazil?
For transfers to the EU and the European Economic Area, not since the mutual adequacy decisions of 27 January 2026. For most other countries, the ANPD clauses under Resolution 19/2024 remain the usual mechanism, and they must be used without changes.
How is LGPD different from GDPR?
They share most principles, but LGPD has ten legal bases, including credit protection. Breach notice runs on business days, fines are capped per infraction, and the regulator issues its own rules. A GDPR program covers much of LGPD but not all of it.
Does LGPD cover children's data?
Yes. Article 14 sets rules for children and adolescents. The Digital Statute for Children and Adolescents, Law 15.211/2025, added duties for digital services from 17 March 2026, and the ANPD supervises it.
Is Brazil's AI bill in force?
No. PL 2338/2023 was approved by the Senate on 10 December 2024 but is still in the Chamber of Deputies. Today, AI that processes personal data is governed by LGPD, including the right to review automated decisions.
Can ISO 27001 or ISO 27701 help with LGPD?
Yes. ISO 27001 supports the security duties in Article 46, and ISO 27701 adds privacy roles, records and processes. Neither replaces LGPD itself, but both give independent evidence that customers recognize.
How long does an LGPD compliance assessment take?
Most assessments take 6 to 12 weeks, depending on how many systems, business units and processors are in scope. Closing the gaps afterwards depends on your roadmap and team capacity.
How much do LGPD compliance services cost?
There is no list price. The cost follows the number of processing activities, systems, processors and countries in scope. A free scoping review gives you a tailored proposal.
Do you give legal advice on LGPD?
No. We assess and report on your privacy controls. Legal interpretation stays with your counsel or DPO, and we work alongside them.
Know Where You Stand on LGPD Before the ANPD or a Customer Asks
Tell us about your Brazilian data, systems, and vendors. We'll confirm how LGPD applies, show what your GDPR work already covers, and send a tailored proposal.
Book your free scoping review →Last reviewed by the Accredify Global compliance team.