What is LGPD?
The Lei Geral de Proteção de Dados (LGPD: Brazil Law 13.709/2018) is Brazil’s comprehensive data protection statute, effective 18 September 2020 (administrative sanctions effective 1 August 2021). LGPD is largely modelled on GDPR with similar legal-basis structure, data subject rights, and extraterritorial scope, but adapted to Brazil’s constitutional and regulatory tradition. The ANPD is the supervisory authority: made an autonomous special-nature agency in 2022 (Law 14.460/2022) and turned into a regulatory agency, the Agência Nacional de Proteção de Dados, by Law 15.352 of 25 February 2026.
Key LGPD elements
- Lawful bases (10 vs. GDPR’s 6): consent, contractual necessity, legal obligation, public administration, studies, vital interests, contractual performance preliminaries, legitimate interest, credit protection, and others.
- Data subject rights: access, correction, deletion, portability, anonymisation, automated decision review: closely tracks GDPR.
- Cross-border transfer: adequacy decisions, specific safeguards (SCCs, binding corporate rules), consent, performance of contract, judicial cooperation.
- DPO obligation: mandatory for most data controllers; ANPD has discretion to exempt SMEs.
- Extraterritorial reach: applies to processing offered to or affecting individuals in Brazil, regardless of processor location.
Sanctions (effective 2021)
- Up to BRL 50M per infringement or 2% of group Brazilian revenue (whichever lower).
- Warning, daily penalty, public disclosure of infringement, blocking/deletion of data, suspension of database, partial/full suspension of operations.
- ANPD increasingly active 2023+ with first significant fines.
LGPD for Turkish companies
LGPD matters to Turkish businesses serving Brazilian users or processing for Brazilian clients: extraterritorial scope follows the offering of goods and services, much like GDPR. The framework will feel familiar: lawful bases (ten, including legitimate interest), data-subject rights, DPO expectations, ANPD enforcement with revenue-based fines, but the differences bite operationally: consent standards, children’s data rules, and international-transfer mechanics finalised through ANPD regulations (SCC-style clauses with local requirements). For a KVKK/GDPR-compliant company, LGPD alignment is an extension project, not a rebuild: map Brazilian flows, slot them into the existing records of processing, add LGPD bases to the matrix, and localise notices in Portuguese: the gap analysis is days, not months, if the core program is real.
Sources. Regulation (EU) 2016/679 (GDPR).