Brazil is Latin America’s largest digital market and its reference point for data protection. The LGPD closely resembles the GDPR, and the national authority, the ANPD, has issued detailed regulations, including mandatory standard contractual clauses for international transfers since August 2025.
Since March 2026, the ECA Digital has made Brazil one of the strictest places for products used by children, with age verification and fines of up to 10% of Brazilian revenue. An AI bill is pending in Congress.
- Core data law
- LGPD (Law 13.709/2018)
- Regulator
- ANPD
- Transfers
- ANPD standard contractual clauses mandatory since 23 Aug 2025
- Children
- ECA Digital (Law 15.211/2025), in force 17 Mar 2026
- AI
- PL 2338/2023 pending in the Chamber
- LGPD penalties
- Up to 2% of Brazilian revenue, capped at R$50 million per infraction
Who needs to comply
Startups processing data of people in Brazil or offering services there
The LGPD applies to processing in Brazil, of data collected in Brazil or to offer goods or services to people in Brazil.
Products likely to be accessed by children or teenagers
The ECA Digital requires reliable age verification, parental controls and limits on profiling and loot boxes.
Companies transferring Brazilian data abroad
Only ANPD standard clauses or approved mechanisms are valid contractual bases.
Consumer-facing apps
The Consumer Defence Code and Marco Civil da Internet apply.
The laws, in detail
01LGPD
Legal bases, rights, security, incidents, DPO and international transfers.
When it applies
Processing in Brazil, of data collected in Brazil, or to offer goods/services to people in Brazil.
What you must do
- One of ten legal bases, including legitimate interest
- DPO (encarregado), with relief for small agents
- Security incident reporting to the ANPD within 3 working days
- Records and DPIAs where required
- Data subject rights
Regulator
ANPD
Penalties
Up to 2% of Brazilian revenue, limited to R$50 million per infraction, plus publicity and suspension sanctions.
02ANPD international transfer regulation
Standard contractual clauses and other transfer mechanisms.
When it applies
Transferring personal data out of Brazil.
What you must do
- Use ANPD SCCs without modification, or approved specific clauses
- Transparency about transfers
Regulator
ANPD
Penalties
Under the LGPD.
03ECA Digital (Law 15.211/2025)
Protection of children and teenagers in digital environments.
When it applies
Digital products and services likely to be accessed by minors in Brazil, wherever provided from.
What you must do
- Reliable age verification (self-declaration not enough)
- Parental controls and safe defaults
- Limits on profiling-based ads to minors
- No loot boxes in games for minors
Regulator
ANPD
Penalties
Up to 10% of Brazilian group revenue, and suspension.
04AI Bill PL 2338/2023 (pending)
Proposed risk-based AI regulation.
When it applies
Would apply to AI developers and deployers in Brazil if enacted.
What you must do
- Proposed: risk classification, high-risk duties, rights for affected people, copyright remuneration
Regulator
To be designated
Penalties
To be determined.
05Marco Civil da Internet (Law 12.965/2014)
Internet principles, net neutrality, log retention and platform liability.
When it applies
Internet application providers offering services in Brazil.
What you must do
- Retain application access logs for 6 months
- Protect privacy and user communications
- Comply with court orders for content removal
Regulator
Courts; ANPD for data aspects
Penalties
Warnings, fines up to 10% of Brazilian revenue and suspension.
06Consumer Defence Code & E-commerce Decree
Consumer rights, online sales disclosures and the 7-day right of withdrawal.
When it applies
Selling goods or services to consumers in Brazil online.
What you must do
- Clear seller identification and pricing
- 7-day withdrawal for online purchases
- Effective customer service channels
Regulator
Procon; Senacon
Penalties
Fines and administrative sanctions.
07Virtual assets law & Central Bank VASP rules
Authorisation and conduct rules for virtual asset service providers (SPSAVs).
When it applies
Providing intermediation, custody or brokerage of virtual assets in Brazil.
What you must do
- Central Bank authorisation
- Governance, segregation and prudential requirements
- Foreign exchange rules for certain virtual asset operations
Regulator
Banco Central do Brasil
Penalties
Authorisation refusal and sanctions.
Compliance checklist
01 · Before you launch
- Portuguese privacy notice and legal bases
- Appoint a DPO (encarregado)
- ANPD SCCs for transfers
- Assess whether minors are likely to use the product
02 · At launch
- Incident response within 3 working days
- Age verification and parental controls where required
- Consumer code-compliant terms
03 · As you scale
- Track the AI bill
- Records and DPIAs
- Annual review of transfers
Key dates
- Sep 2020LGPD in force
- Aug 2021LGPD sanctions enforceable
- 23 Aug 2025ANPD standard contractual clauses mandatory
- 17 Mar 2026ECA Digital in force
Common mistakes
- Relying on EU SCCs for Brazilian transfers
- Self-declared age gates
- No Portuguese notices
FAQs
Are EU SCCs valid in Brazil?
Not by themselves. Use the ANPD’s standard clauses or clauses the ANPD approves.
Does Brazil have an AI law?
Not yet. The AI bill passed the Senate in December 2024 and is pending in the Chamber of Deputies.
In the law library
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.