Brazil
Full entry AI-checked Checked 5 November 2026
| Law | Citation | Status | In force from |
|---|---|---|---|
| General Personal Data Protection Law (LGPD) | Lei nº 13.709, de 14 de agosto de 2018, as amended (latest by Lei nº 15.352, de 25 de fevereiro de 2026) | In force | 18 September 2020 |
| Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet) | Lei nº 12.965, de 23 de abril de 2014, regulated by Decreto nº 8.771/2016 as amended by Decreto nº 12.975/2026 | In force | 23 June 2014 |
| Decree on internet application providers’ duties | Decreto nº 12.975, de 20 de maio de 2026 (amending Decreto nº 8.771/2016) | In force | 20 July 2026 |
| Decree on protecting women online | Decreto nº 12.976, de 20 de maio de 2026 | In force | 20 July 2026 |
| Digital Statute of Children and Adolescents (ECA Digital) | Lei nº 15.211, de 17 de setembro de 2025 | In force | 17 March 2026 |
| Artificial Intelligence Bill | PL 2338/2023 | Draft, not law | — |
- General Personal Data Protection Law (LGPD): Most provisions apply from 18 September 2020, when Lei 14.058/2020 converted MP 959/2020 without its planned postponement. The ANPD provisions applied from 28 December 2018 and the sanctions (Arts. 52 to 54) from 1 August 2021. MP 1.317/2025, in force on 18 September 2025 and converted into Lei 15.352/2026, made the ANPD a regulatory agency.
- Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet): Requires express consent to collect personal data and makes businesses that run internet applications keep access logs for 6 months. Since 20 July 2026, Decretos 12.975 and 12.976 (see below) add platform duties that the ANPD enforces.
- Decree on internet application providers’ duties: Internet application providers, especially platforms hosting user content, need a legal representative in Brazil, reporting channels and transparency reports, and must act against fraud and serious crimes online. The ANPD enforces it.
- Decree on protecting women online: Platforms must take down intimate content shared without consent, including AI-made content, within two hours of notice, mark it to block re-uploads, and may not create or alter such content of others with AI. The ANPD enforces it.
- Digital Statute of Children and Adolescents (ECA Digital): Covers digital products and services aimed at, or likely to be used by, children and adolescents. Lei 15.352/2026 (Art. 19) set its start date. The ANPD supervises it, and Decreto 12.880/2026 regulates it.
- Artificial Intelligence Bill: Passed by the Senate and sent to the Chamber of Deputies in March 2025. On 27 October 2026 it was still waiting for the rapporteur’s opinion in a Chamber special committee. Not law.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”The LGPD applies to processing by individuals and by public or private organisations, wherever they are based, if the processing takes place in Brazil, aims to offer goods or services to people in Brazil or process their data, or uses data collected in Brazil. It doesn’t apply to purely personal non-economic use, journalism and art, or public security and national defence. Academic use is only partly excluded.
Sources: www2.camara.leg.br/legin/fed/lei/2018/lei-13709-14-agosto-2018-787077… · gov.br/anpd/pt-br/centrais-de-conteudo/outros-documentos-e-publicacoe…
Lawful bases
Section titled “Lawful bases”Ten legal bases (Art. 7), including consent, legal obligation, contract, exercise of rights, protection of life, health protection, legitimate interest and credit protection. Legitimate interest needs a concrete legitimate purpose, only the data strictly needed, transparency and a balancing test, and the ANPD can ask for an impact report. Sensitive data has a shorter list (Art. 11) that leaves out legitimate interest.
Sources: www2.camara.leg.br/legin/fed/lei/2018/lei-13709-14-agosto-2018-787077… · gov.br/anpd/pt-br/centrais-de-conteudo/materiais-educativos-e-publica…
Consent age for online services
Section titled “Consent age for online services”Children are under 12, and adolescents are 12 to 17. Processing a child’s data on the basis of consent needs specific, prominent consent from at least one parent or guardian, and reasonable efforts to check it came from them. The ANPD accepts other legal bases for children’s and adolescents’ data when their best interest prevails (Enunciado 1/2023).
Sources: legis.senado.leg.br/norma/549945/publicacao/34619929 · www2.camara.leg.br/legin/fed/lei/2018/lei-13709-14-agosto-2018-787077… · gov.br/anpd/pt-br/centrais-de-conteudo/materiais-educativos-e-publica…
Children
Section titled “Children”Since 17 March 2026 the ECA Digital applies to digital services aimed at, or likely to be used by, under-18s. It requires the most protective settings by default, reliable age checks (not self-declaration) for age-restricted content, and parental supervision tools. Social networks must link the accounts of users up to 16 to a guardian’s account. Profiling to target ads at children and adolescents is banned, as are loot boxes in their games. The ANPD began monitoring in 2025, app stores and operating systems first; its plan widens this from August 2026, with enforcement from January 2027.
Sources: legis.senado.leg.br/norma/41465823/publicacao/41471709 · gov.br/anpd/pt-br/assuntos/eca-digital
Cookies and similar technologies
Section titled “Cookies and similar technologies”There is no cookie-specific law; the LGPD applies when cookies collect personal data. ANPD guidance says legitimate interest can suit strictly necessary cookies and, in some cases, aggregated audience measurement, while advertising cookies, especially third-party ones, generally call for consent. Banners should offer a reject-all button on the first layer, keep consent-based cookies off by default and avoid pre-ticked boxes. The Marco Civil also requires express consent, set apart from other terms, to collect personal data.
Sources: gov.br/anpd/pt-br/centrais-de-conteudo/materiais-educativos-e-publica… · www2.camara.leg.br/legin/fed/lei/2014/lei-12965-23-abril-2014-778630-…
Electronic marketing
Section titled “Electronic marketing”There is no separate e-marketing or anti-spam law. Marketing messages need an LGPD legal basis, usually consent, or legitimate interest after a balancing test. ANPD guidance gives the example of offers sent to people with an existing relationship, with an unsubscribe option in every message. Consent can be withdrawn at any time. For calls, people can join the free Não Me Perturbe list, which blocks telemarketing by telecom operators and banks offering payroll loans; Anatel made its 0303 telemarketing prefix optional in August 2025.
Sources: www2.camara.leg.br/legin/fed/lei/2018/lei-13709-14-agosto-2018-787077… · gov.br/anpd/pt-br/centrais-de-conteudo/materiais-educativos-e-publica… · gov.br/anatel/pt-br/consumidor/telemarketing · gov.br/anatel/pt-br/regulado/numeracao/telemarketing-ativo-prefixo-0303
Breach notification
Section titled “Breach notification”Tell the ANPD and the people affected within 3 business days of learning that a security incident involved personal data and may cause them relevant risk or damage, unless a specific law sets another deadline (Regulation CD/ANPD 15/2024). A preliminary report can be completed within 20 business days. Small processing agents get double the time unless their processing is high-risk. Processors must tell the controller without undue delay.
Sources: in.gov.br/en/web/dou/-/resolucao-cd/anpd-n-15-de-24-de-abril-de-2024-… · gov.br/anpd/pt-br/assuntos/comunicacao-de-incidentes-de-seguranca-cis · gov.br/anpd/pt-br/acesso-a-informacao/institucional/atos-normativos/r… · www2.camara.leg.br/legin/fed/lei/2018/lei-13709-14-agosto-2018-787077…
Registration and fees
Section titled “Registration and fees”None. There is no registration with, or fee payable to, the ANPD, and the appointment of a data protection officer doesn’t have to be reported to it. Controllers and processors must keep records of their processing, especially processing based on legitimate interest. Small processing agents may keep simplified records.
Sources: www2.camara.leg.br/legin/fed/lei/2018/lei-13709-14-agosto-2018-787077… · gov.br/anpd/pt-br/centrais-de-conteudo/materiais-educativos-e-publica… · gov.br/anpd/pt-br/acesso-a-informacao/institucional/atos-normativos/r…
Data protection officer
Section titled “Data protection officer”Controllers must appoint a data protection officer (encarregado) by a formal written act and publish the officer’s identity and contact details, preferably on their website. The officer can be an employee or an outside person or company, and must be able to communicate in Portuguese. Processors may appoint one as good practice. Small processing agents that don’t carry out high-risk processing are exempt, but must offer people a contact channel.
Sources: www2.camara.leg.br/legin/fed/lei/2018/lei-13709-14-agosto-2018-787077… · in.gov.br/en/web/dou/-/resolucao-cd/anpd-n-18-de-16-de-julho-de-2024-… · gov.br/anpd/pt-br/centrais-de-conteudo/materiais-educativos-e-publica… · gov.br/anpd/pt-br/acesso-a-informacao/institucional/atos-normativos/r…
International transfers
Section titled “International transfers”Transfers abroad need a mechanism under LGPD Art. 33, such as an ANPD adequacy decision, the ANPD’s standard contractual clauses used word for word (existing contracts had to include them by August 2025), ANPD-approved specific clauses or global corporate rules, or the person’s specific consent. Controllers must share the clauses used on request. The ANPD recognised the EU as adequate (Resolution CD/ANPD 32, in force 27 January 2026) and the EU did the same for Brazil, so data can flow between them without further safeguards.
Sources: www2.camara.leg.br/legin/fed/lei/2018/lei-13709-14-agosto-2018-787077… · gov.br/anpd/pt-br/acesso-a-informacao/institucional/atos-normativos/r… · in.gov.br/web/dou/-/resolucao-n-32-de-26-de-janeiro-de-2026-683334547 · gov.br/anpd/pt-br/acesso-a-informacao/institucional/atos-normativos/r… · commission.europa.eu/news-and-media/news/joint-press-statement-michae…
Impact assessments
Section titled “Impact assessments”The ANPD can require a data protection impact report (RIPD), in particular for processing based on legitimate interest or involving sensitive data. ANPD guidance recommends one before processing likely to be high risk, judged by the criteria in Regulation CD/ANPD 2/2022, such as large-scale processing combined with sensitive or children’s data or automated decisions. It is sent to the ANPD only on request. No specific RIPD regulation exists yet.
Sources: www2.camara.leg.br/legin/fed/lei/2018/lei-13709-14-agosto-2018-787077… · gov.br/anpd/pt-br/canais_atendimento/agente-de-tratamento/relatorio-d… · gov.br/anpd/pt-br/acesso-a-informacao/institucional/atos-normativos/r…
Automated decisions and AI
Section titled “Automated decisions and AI”People can ask for a review of decisions made solely by automated processing that affect their interests, including profiling, and get clear information on the criteria and procedures used, subject to trade secrets. The law doesn’t say the review must be done by a person. If information is withheld, the ANPD can audit for discrimination. Since 20 July 2026 platforms may not use AI to create or alter intimate content of others, and AI services must block such requests (Decreto 12.976). Brazil has no AI law yet; the AI bill (PL 2338/2023) is still before the Chamber of Deputies.
Sources: www2.camara.leg.br/legin/fed/lei/2018/lei-13709-14-agosto-2018-787077… · in.gov.br/web/dou/-/decreto-n-12.976-de-20-de-maio-de-2026-706921216 · gov.br/anpd/pt-br/assuntos/marco-civil-da-internet · camara.leg.br/proposicoesWeb/fichadetramitacao
Penalties
Section titled “Penalties”The ANPD can issue warnings, fines of up to 2% of the company’s or group’s revenue in Brazil in its last financial year, net of taxes, capped at R$50 million per infraction, daily fines, publication of the infraction, blocking or deletion of the data, and suspension or a ban on processing. Under the ECA Digital, fines reach 10% of the group’s Brazilian revenue, capped at R$50 million per infraction. People can also sue for damages. The ANPD is updating its sanctions rules in 2026.
Sources: www2.camara.leg.br/legin/fed/lei/2018/lei-13709-14-agosto-2018-787077… · legis.senado.leg.br/norma/41465823/publicacao/41471709 · gov.br/anpd/pt-br/assuntos/eca-digital
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/br.yaml.