LGPD, Brazil’s General Data Protection Law (Law No. 13,709/2018), applies to any company that processes personal data collected in Brazil, wherever its headquarters are. Before day one, your IT needs a map of the personal data the Brazilian operation will handle, access control and logging, a way to detect incidents and report them quickly, a legal mechanism for sending data to headquarters, and contracts that bind local vendors. This article covers the IT side; the legal side should be handled with a Brazilian lawyer.
Does LGPD apply to my company?
In most cases, yes. LGPD applies when personal data is processed in Brazil, when the goal is to offer goods or services to people in Brazil, or when the data was collected in Brazil. A foreign company opening an office, plant or branch in Brazil will at least process data about its Brazilian employees, and usually about customers and suppliers too.
The regulator is the ANPD (National Data Protection Authority), which publishes regulations on topics such as incident reporting, the data protection officer and international transfers.
What IT needs before day one
1. A map of personal data
List the personal data the Brazilian operation will collect (employees, candidates, customers, suppliers, visitors), why, where it will be stored and who can access it. LGPD requires records of processing activities, and this map is the starting point.
2. Access control
- Individual accounts, no shared logins.
- Multi-factor authentication for email, remote access and administrative accounts.
- Access granted by role and removed on the day someone leaves.
3. Logging and monitoring
Without logs, you cannot tell what happened in an incident, nor report it properly. Centralize logs of access to systems that hold personal data and keep them for a defined period.
4. Network protection
Firewall, segmentation between users, servers and guests, and a secure VPN to headquarters. These are basic technical measures that LGPD expects from any company handling personal data.
5. Incident response
ANPD regulations require that security incidents that may cause relevant risk or damage to data subjects be reported to the ANPD and to the affected people within a short deadline, counted in business days. Define in advance who detects, who decides, who notifies and who talks to headquarters, so the clock does not run out while people look for a procedure.
6. Transfers to headquarters
Sending HR or customer data from Brazil to systems abroad is an international transfer. LGPD lists the mechanisms that allow it, and the ANPD has published standard contractual clauses for this purpose. Your legal team should choose the mechanism. IT needs to know which data flows exist so none is left out.
7. Vendor contracts
Local vendors that process personal data on your behalf (payroll, IT support, cloud, security) must have contracts with data protection clauses. Include security requirements and incident notification duties.
8. Data protection officer
LGPD provides for a data protection officer (in Portuguese, *encarregado*) as the contact point with data subjects and the ANPD. Check with your lawyer whether the Brazilian operation must appoint one or can rely on the group’s officer.
9. Retention and deletion
Define how long each type of data is kept and how it is deleted, including in backups.
What happens if we get it wrong
LGPD provides for warnings, fines of up to 2% of the company’s revenue in Brazil (capped at BRL 50 million per infraction), publication of the infraction, and blocking or deletion of the data involved. For a new operation, the reputational damage of an incident can weigh as much as the fine.
Frequently asked questions
Does LGPD apply to a foreign company with a small office in Brazil?
Yes. LGPD looks at where the data is collected and processed, not at where the company is headquartered. Even a small office processes data about its Brazilian employees.
Can we send employee data from Brazil to headquarters?
Yes, but it is an international transfer and must rely on one of the mechanisms provided for by LGPD, such as the standard contractual clauses published by the ANPD. Your legal team should define it before data starts flowing.
Is LGPD compliance an IT project or a legal project?
Both. Legal defines the bases, contracts and policies. IT implements the controls that make them real: access, logging, segmentation, backup and incident response.
How I can help
I set up the IT infrastructure for new operations in Brazil with the technical controls LGPD expects, working alongside your legal team. See IT setup in Brazil and Perimeter security & LGPD, or read the IT setup checklist for foreign companies.
*This article is general information about IT and LGPD, not legal advice.*