Comply with Brazil's LGPD

What is the LGPD?

The Lei Geral de Proteção de Dados (LGPD) is Brazil's general data protection law, in force since September 18, 2020. It closely mirrors the EU's GDPR: it sets out lawful bases for processing personal data, grants individuals a set of data-subject rights, distinguishes controllers and operators, and is enforced by Brazil's national data protection authority, the ANPD.

Who it applies to and the penalties

The LGPD reaches any organization that processes the personal data of people in Brazil or carries out processing in Brazil — including many companies based elsewhere that serve Brazilian customers. The ANPD can impose fines of up to 2% of a company's revenue in Brazil, capped at R$50 million per violation, alongside warnings, processing restrictions, and public disclosure.

How it relates to GDPR

Because the LGPD is so closely aligned with the GDPR, most of a GDPR program transfers directly — records of processing, DPIAs, rights workflows, and the data protection officer role all carry over. In a significant 2026 development, Brazil and the EU adopted mutual adequacy decisions, easing personal-data transfers between the two jurisdictions.

How episki helps

episki implements the LGPD as living controls: a legal-basis mapper for each processing activity, records of processing, a data-subject request workflow, the encarregado (DPO) role, international-transfer safeguards, and an ANPD breach-notification workflow — all cross-mapped to GDPR, CCPA, and PIPEDA so one privacy program serves every market.