The Lei Geral de Proteção de Dados (LGPD) is Brazil's general data protection law, in force since September 18, 2020. It closely mirrors the EU GDPR — defining lawful bases for processing, data-subject rights, controller and operator obligations, and a national authority (the ANPD) to enforce it.

The LGPD applies to any organization that processes the personal data of individuals in Brazil, or processes data in Brazil, regardless of where the organization is based — so it reaches many companies outside Brazil that serve Brazilian customers.

What are the penalties?

The ANPD can impose fines of up to 2% of a company's revenue in Brazil, capped at R$50 million per violation, along with warnings, data-processing restrictions, and public disclosure of the infraction.

How does LGPD relate to GDPR?

The LGPD is closely aligned with the GDPR, so most of a GDPR program transfers directly. In a notable 2026 development, Brazil and the EU adopted mutual adequacy decisions, easing personal-data transfers between the two jurisdictions.

Brazilian privacy, operationalized

Comply with Brazil's LGPD

Legal bases, data-subject rights, a data protection officer, and ANPD breach handling — implemented as living controls and mapped to GDPR for reuse.

Start free trial Book a demo

What is the LGPD?

The Lei Geral de Proteção de Dados (LGPD) is Brazil's general data protection law, in force since September 18, 2020. It closely mirrors the EU's GDPR: it sets out lawful bases for processing personal data, grants individuals a set of data-subject rights, distinguishes controllers and operators, and is enforced by Brazil's national data protection authority, the ANPD.

Who it applies to and the penalties

The LGPD reaches any organization that processes the personal data of people in Brazil or carries out processing in Brazil — including many companies based elsewhere that serve Brazilian customers. The ANPD can impose fines of up to 2% of a company's revenue in Brazil, capped at R$50 million per violation, alongside warnings, processing restrictions, and public disclosure.

Because the LGPD is so closely aligned with the GDPR, most of a GDPR program transfers directly — records of processing, DPIAs, rights workflows, and the data protection officer role all carry over. In a significant 2026 development, Brazil and the EU adopted mutual adequacy decisions, easing personal-data transfers between the two jurisdictions.

How episki helps

episki carries LGPD obligations as structured records — processing activities, legal bases, data subject requests, and international transfers — tied to controls that are evaluated rather than asserted, with processors and subprocessors consolidated onto vendor records carrying review cadences. Start a free trial or book a demo.

LGPD outcomes with episki

Quantify the impact security and compliance brings to your business.

10 legal bases

Lawful-basis determination for every processing activity.

ANPD

Brazil's data protection authority — breach notification workflow built in.

GDPR mapped

LGPD aligns closely with GDPR, so privacy work is reused.

Why teams choose episki for LGPD

Framework-specific automation, collaboration, and reporting in one workspace.

Lawful processing

Determine and document a legal basis for each activity.

Ten LGPD legal bases supported
Records of processing maintained
Purpose and necessity documented

Rights and roles

Data-subject rights and the DPO role LGPD expects.

Data-subject request workflow
Data Protection Officer (encarregado) duties
Controller / operator role mapping

One privacy program

LGPD overlaps almost entirely with GDPR.

Crosswalk to GDPR articles
Reuse ROPA and DPIA work
Aligns with CCPA and PIPEDA

LGPD readiness inside episki

What an organization processing Brazilian personal data needs.

Plug episki into your stack and work directly from this checklist during the free trial.

✓ Legal-basis determination per processing activity
✓ Records of processing (ROPA)
✓ Data-subject request workflow
✓ Data Protection Officer (encarregado) designated
✓ International-transfer safeguards
✓ ANPD breach notification workflow

LGPD accelerators

Stand up Brazilian privacy compliance and reuse it across regimes.

Legal-basis mapper

Assign and document a lawful basis for each processing activity.

DSAR workflow

Intake and fulfill data-subject requests within statutory timelines.

GDPR crosswalk

Reuse your GDPR records and DPIAs to satisfy the LGPD.

LGPD frequently asked questions

Build an LGPD program in episki

Implement lawful bases and data-subject rights once and reuse your GDPR work.

Start free trial Book a walkthrough