What is Brazil’s LGPD, and how does it apply to websites?

Brazil’s Lei Geral de Proteção de Dados Pessoais, or LGPD, regulates the processing of personal data. It establishes legal grounds for processing, responsibilities for organisations and rights for individuals.

Its main substantive provisions took effect on 18 September 2020. The administrative-sanctions provisions became effective on 1 August 2021.

A website may fall within its scope where, for example, processing takes place in Brazil or concerns offering goods or services to individuals located there. A foreign business is not automatically outside the law.

For website operators, relevant steps include:

• Identifying a valid legal basis for each processing purpose.

• Explaining how forms, analytics and advertising tools use personal data.

• Limiting collection and retention to what is necessary.

• Enabling applicable individual rights.

The ANPD published its official cookies and personal data guidance on 18 October 2022.

Consent is one LGPD legal basis, not the only one. However, another basis cannot simply be assumed for every tracker. LGPD cookie compliance requires a purpose-specific assessment, supported by data minimisation and effective controls where consent is used.