Presidency of the Republic

General Secretariat

Sub‑Chief for Legal Affairs

---

LAW NO. 13,709, OF AUGUST 14, 2018

Veto message

Effective

General Data Protection Law (LGPD). (Text as amended by Law No. 13,853, 2019)

Effective

THE PRESIDENT OF THE REPUBLIC

I make known that the National Congress decrees and I sanction the following Law:

---

CHAPTER I – PRELIMINARY PROVISIONS

Art. 1 This Law provides for the processing of personal data, including in digital media, by natural persons or by legal entities of public or private law, with the aim of protecting the fundamental rights of liberty and privacy and the free development of the personality of the natural person.

Sole paragraph. The general rules contained in this Law are of national interest and must be observed by the Union, States, Federal District and Municipalities. (Amended by Law No. 13,853, 2019)

Effective

Art. 2 The discipline of personal data protection has as foundations:

I – respect for privacy;

II – informational self‑determination;

III – freedom of expression, information, communication and opinion;

IV – inviolability of intimacy, honor and image;

V – economic and technological development and innovation;

VI – free enterprise, free competition and consumer protection; and

VII – human rights, free development of personality, dignity and the exercise of citizenship by natural persons.

Art. 3 This Law applies to any processing operation carried out by a natural person or by a legal entity of public or private law, regardless of the means, the country of its headquarters or the country where the data are located, provided that:

I – the processing operation is carried out on national territory;

II – the processing activity aims at the offering or supply of goods or services or the processing of data of individuals located on national territory; or (Amended by Law No. 13,853, 2019)

Effective

III – the personal data subject to processing have been collected on national territory.

§ 1 The data are considered collected on national territory when the data subject is present in the territory at the moment of collection.

§ 2 The provision of paragraph I of this article does not apply to the processing of data provided for in item IV of the caput of art. 4 of this Law.

Art. 4 This Law does not apply to the processing of personal data:

I – carried out by a natural person for exclusively private and non‑economic purposes;

II – carried out for exclusively:

a) journalistic and artistic purposes; or

b) academic purposes, applying to this hypothesis arts. 7 and 11 of this Law;

III – carried out for exclusively:

a) public safety;

b) national defense;

c) state security; or

d) activities of investigation and repression of criminal offenses; or

IV – originating from outside the national territory and that are not the object of communication, shared use of data with Brazilian processing agents or the object of international data transfer with another country that is not the country of origin, provided that the country of origin provides a degree of personal data protection adequate to that provided in this Law.

§ 1 The processing of personal data provided for in item III shall be governed by specific legislation, which must provide proportional and strictly necessary measures to meet the public interest, observed due legal process, the general principles of protection and the rights of the data subject provided in this Law.

§ 2 It is prohibited for a private‑law person to process the data referred to in item III of the caput of this article, except in procedures under the tutelage of a public‑law entity, which shall be the object of a specific report to the national authority and shall observe the limitation imposed in § 4 of this article.

§ 3 The national authority shall issue technical opinions or recommendations concerning the exceptions provided in item III of the caput of this article and shall request impact reports on personal data protection from the responsible parties.

§ 4 In no case may the entirety of the personal data of a database referred to in item III of the caput of this article be processed by a private‑law person, except by one whose capital is wholly constituted by the public power. (Amended by Law No. 13,853, 2019)

Effective

Art. 5 For the purposes of this Law, the following definitions apply:

I – personal data: information related to an identified or identifiable natural person;

II – sensitive personal data: personal data concerning racial or ethnic origin, religious conviction, political opinion, affiliation to a union or to an organization of religious, philosophical or political character, data concerning health or sexual life, genetic or biometric data, when linked to a natural person;

III – anonymized data: data relating to a data subject that cannot be identified, considering the use of reasonable and available technical means at the time of its processing;

IV – database: structured set of personal data, established in one or several locations, in electronic or physical support;

V – data subject: natural person to whom the personal data that are the object of processing refer;

VI – controller: natural or legal person, of public or private law, who makes decisions regarding the processing of personal data;

VII – processor: natural or legal person, of public or private law, who carries out the processing of personal data on behalf of the controller;

VIII – data protection officer: person indicated by the controller and processor to act as a communication channel between the controller, the data subjects and the National Data Protection Agency (ANPD); (Amended by Law No. 15,352, 2026)

IX – processing agents: the controller and the processor;

X – processing: any operation carried out with personal data, such as those referring to collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, elimination, evaluation or control of information, modification, communication, transfer, diffusion or extraction;

XI – anonymization: use of reasonable and available technical means at the time of processing, by which a datum loses the possibility of direct or indirect association with an individual;

XII – consent: free, informed and unequivocal manifestation by which the data subject agrees to the processing of his/her personal data for a determined purpose;

XIII – blocking: temporary suspension of any processing operation, by means of safeguarding the personal data or the database;

XIV – elimination: deletion of a datum or a set of data stored in a database, regardless of the procedure employed;

XV – international data transfer: transfer of personal data to a foreign country or to an international organization of which the country is a member;

XVI – shared use of data: communication, diffusion, international transfer, interconnection of personal data or shared processing of personal databases by public bodies and entities in the fulfillment of their legal competencies, or between them and private entities, reciprocally, with specific authorization, for one or more treatment modalities permitted by those public entities, or between private entities;

XVII – personal data protection impact report: documentation of the controller that contains the description of personal data processing that may generate risks to civil liberties and fundamental rights, as well as measures, safeguards and risk mitigation mechanisms;

XVIII – research body: public or private non‑profit legal entity legally constituted under Brazilian law, with headquarters and jurisdiction in the Country, whose institutional mission or statutory purpose includes basic or applied research of historical, scientific, technological or statistical nature; (Amended by Law No. 13,853, 2019)

Effective

XIX – national authority: public administration entity responsible for safeguarding, implementing and supervising compliance with this Law throughout the national territory. (Amended by Law No. 15,352, 2026)

Art. 6 The activities of personal data processing shall observe good faith and the following principles:

I – purpose: processing carried out for legitimate, specific, explicit and informed purposes to the data subject, without the possibility of later processing incompatible with those purposes;

II – adequacy: compatibility of processing with the purposes informed to the data subject, according to the processing context;

III – necessity: limitation of processing to the minimum necessary for the achievement of its purposes, with scope of pertinent, proportional and non‑excessive data in relation to the purposes of data processing;

IV – free access: guarantee to data subjects of facilitated and free consultation about the form and duration of processing, as well as about the entirety of their personal data;

V – data quality: guarantee to data subjects of accuracy, clarity, relevance and updating of data, according to the need and for the fulfillment of the processing purpose;

VI – transparency: guarantee to data subjects of clear, precise and easily accessible information about the processing and the respective processing agents, observed commercial and industrial secrets;

VII – security: use of technical and administrative measures capable of protecting personal data from unauthorized access and from accidental or illicit situations of destruction, loss, alteration, communication or diffusion;

VIII – prevention: adoption of measures to prevent the occurrence of damage due to personal data processing;

IX – non‑discrimination: impossibility of processing for illicit or abusive discriminatory purposes;

X – accountability and liability: demonstration by the agent of the adoption of effective measures capable of proving compliance with and fulfillment of personal data protection rules and, including, the effectiveness of those measures.

---

CHAPTER II – PERSONAL DATA PROCESSING

Section I – Requirements for Personal Data Processing

Art. 7 Personal data processing may only be carried out in the following cases:

I – with the provision of consent by the data subject;

II – to comply with a legal or regulatory obligation by the controller;

III – by the public administration, for processing and shared use of data necessary for the execution of public policies provided for in laws and regulations or backed by contracts, agreements or similar instruments, observed the provisions of Chapter IV of this Law;

IV – for the conduct of studies by a research body, guaranteed, whenever possible, the anonymization of personal data;

V – when necessary for the execution of a contract or preliminary procedures related to a contract of which the data subject is a party, at the request of the data subject;

VI – for the regular exercise of rights in judicial, administrative or arbitral proceedings, the latter pursuant to Law No. 9,307, of September 23 1996 (Arbitration Law);

VII – to protect the life or physical integrity of the data subject or of a third party;

VIII – for the protection of health, exclusively in procedures carried out by health professionals, health services or sanitary authority; (Amended by Law No. 13,853, 2019)

Effective

IX – when necessary to meet the legitimate interests of the controller or of a third party, except where the fundamental rights and freedoms of the data subject that require data protection prevail; or

X – for credit protection, including as provided for in the pertinent legislation.

§ 1 (Repealed). (Amended by Law No. 13,853, 2019)

Effective

§ 2 (Repealed). (Amended by Law No. 13,853, 2019)

Effective

§ 3 Processing of personal data whose access is public must consider the purpose, good faith and public interest that justified its availability.

§ 4 The requirement of consent provided in the caput of this article is dispensed with for data that are manifestly made public by the data subject, preserving the rights of the data subject and the principles provided in this Law.

§ 5 The controller who obtained the consent referred to in item I of the caput of this article and who needs to communicate or share personal data with other controllers shall obtain specific consent from the data subject for that purpose, except for the cases of consent waiver provided for in this Law.

§ 6 The possible waiver of the consent requirement does not relieve processing agents from the other obligations provided in this Law, especially the observation of the general principles and the guarantee of the data subject’s rights.

§ 7 Subsequent processing of the personal data referred to in §§ 3 and 4 of this article may be carried out for new purposes, provided that the legitimate and specific purposes for the new processing are observed and the data subject’s rights are preserved, as well as the foundations and principles provided in this Law. (Included by Law No. 13,853, 2019)

Effective

Art. 8 Consent referred to in item I of art. 7 of this Law must be provided in writing or by another means that demonstrates the data subject’s will.

§ 1 If consent is provided in writing, it must appear in a clause highlighted from the other contractual clauses.

§ 2 The burden of proof that consent was obtained in accordance with this Law lies with the controller.

§ 3 Processing of personal data is prohibited when consent is defective.

§ 4 Consent must refer to determined purposes, and generic authorizations for personal data processing shall be null.

§ 5 Consent may be revoked at any time by an express manifestation of the data subject, through a free and facilitated procedure, ratifying the processing carried out under the previously manifested consent while no request for elimination has been made, pursuant to item VI of the caput of art. 18 of this Law.

§ 6 In case of alteration of the information referred to in items I, II, III or V of art. 9 of this Law, the controller shall inform the data subject, highlighting specifically the nature of the changes, and the data subject may, in cases where consent is required, revoke it if he/she disagrees with the alteration.

Art. 9 The data subject has the right to facilitated access to information about the processing of his/her data, which must be made available in a clear, adequate and prominent manner concerning, among other characteristics provided in regulation for the fulfillment of the principle of free access:

I – specific purpose of the processing;

II – form and duration of the processing, observed commercial and industrial secrets;

III – identification of the controller;

IV – contact information of the controller;

V – information about the shared use of data by the controller and its purpose;

VI – responsibilities of the agents who will carry out the processing; and

VII – data subject rights, with explicit reference to the rights contained in art. 18 of this Law.

§ 1 In the hypothesis where consent is required, it shall be considered null if the information provided to the data subject is misleading, abusive or has not been presented beforehand with transparency, in a clear and unequivocal manner.

§ 2 In the hypothesis where consent is required, if there are changes to the purpose for processing personal data that are not compatible with the original consent, the controller shall inform the data subject in advance about the changes of purpose, and the data subject may revoke consent if he/she disagrees with the alterations.

§ 3 When processing of personal data is a condition for the provision of a product or service or for the exercise of a right, the data subject shall be informed prominently of this fact and of the means by which he/she may exercise the rights listed in art. 18 of this Law.

Art. 10 The legitimate interest of the controller may only justify processing of personal data for legitimate purposes, considered from concrete situations, which include, but are not limited to:

I – support and promotion of the controller’s activities; and

II – protection, with respect to the data subject, of the regular exercise of his/her rights or the provision of services that benefit him/her, respecting his/her legitimate expectations and the fundamental rights and freedoms, pursuant to this Law.

§ 1 When processing is based on the controller’s legitimate interest, only the personal data strictly necessary for the intended purpose may be processed.

§ 2 The controller shall adopt measures to guarantee transparency of processing based on its legitimate interest.

§ 3 The national authority may request from the controller a personal data protection impact report when processing is based on its legitimate interest, observed commercial and industrial secrets.

Section II – Processing of Sensitive Personal Data

Art. 11 Processing of sensitive personal data may only occur in the following cases:

I – when the data subject or his/her legal guardian consents, in a specific and highlighted manner, for specific purposes;

II – without the provision of consent by the data subject, in the hypotheses where it is indispensable for:

a) compliance with a legal or regulatory obligation by the controller;

b) shared processing of data necessary for the execution, by the public administration, of public policies provided for in laws or regulations;

c) conduct of studies by a research body, guaranteed, whenever possible, the anonymization of sensitive personal data;

d) regular exercise of rights, including in contract and in judicial, administrative and arbitral proceedings, the latter pursuant to Law No. 9,307, of September 23 1996 (Arbitration Law);

e) protection of life or physical integrity of the data subject or of a third party;

f) protection of health, exclusively in procedures carried out by health professionals, health services or sanitary authority; (Amended by Law No. 13,853, 2019)

Effective

g) guarantee of fraud prevention and the security of the data subject, in identification and authentication processes of registration in electronic systems, preserving the rights mentioned in art. 9 of this Law and except where the fundamental rights and freedoms of the data subject that require data protection prevail.

§ 1 The provisions of this article apply to any processing of data that reveals sensitive personal data and that may cause harm to the data subject, without prejudice to specific legislation.

§ 2 In the cases of application of the provisions in sub‑items “a” and “b” of item II of the caput of this article by public bodies and entities, publicity shall be given to the referred consent waiver, pursuant to item I of the caput of art. 23 of this Law.

§ 3 Communication or shared use of sensitive personal data between controllers with the aim of obtaining economic advantage may be prohibited or regulated by the national authority, heard the sectorial bodies of the Public Power, within their competencies.

§ 4 Communication or shared use between controllers of sensitive personal data concerning health with the aim of obtaining economic advantage is prohibited, except in the hypotheses relating to the provision of health services, pharmaceutical assistance and health assistance, provided that § 5 of this article is observed, including auxiliary diagnostic and therapeutic services, for the benefit of the data subjects, and to allow:

Effective

I – data portability when requested by the data subject; or (Included by Law No. 13,853, 2019)

Effective

II – financial and administrative transactions resulting from the use and provision of the services referred to in this paragraph. (Included by Law No. 13,853, 2019)

Effective

§ 5 It is prohibited for private health‑plan operators to process health data for risk selection in the contracting of any modality, as well as in the contracting and exclusion of beneficiaries. (Included by Law No. 13,853, 2019)

Effective

Art. 12 Anonymized data shall not be considered personal data for the purposes of this Law, except when the anonymization process to which they were subjected is reversed, using exclusively own means, or when, with reasonable efforts, it can be reversed.

§ 1 The determination of what is reasonable shall consider objective factors such as cost and time required to reverse the anonymization process, according to the technologies available, and the exclusive use of own means.

§ 2 The same may equally be considered personal data, for the purposes of this Law, those used for the formation of a behavioral profile of a natural person, if identified.

§ 3 The national authority may provide standards and techniques used in anonymization processes and carry out checks on their security, heard the National Council of Personal Data Protection.

Art. 13 In health public studies, research bodies may have access to personal databases, which shall be treated exclusively within the body and strictly for the purpose of conducting studies and research and kept in a controlled and secure environment, in accordance with security practices provided in specific regulation and that include, whenever possible, anonymization or pseudonymization of the data, as well as consider the due ethical standards related to studies and research.

§ 1 The disclosure of results or any excerpt of the study or research referred to in the caput of this article shall under no circumstances reveal personal data.

§ 2 The research body shall be responsible for the information security provided in the caput of this article, and transfer of the data to third parties shall not be permitted under any circumstance.

§ 3 Access to the data referred to in this article shall be subject to regulation by the national authority and health and sanitary authorities, within their competencies.

§ 4 For the purposes of this article, pseudonymization is the processing by which a datum loses the possibility of direct or indirect association with an individual, except by the use of additional information kept separately by the controller in a controlled and secure environment.

Section III – Processing of Personal Data of Children and Adolescents

Art. 14 The processing of personal data of children and adolescents shall be carried out in their best interest, pursuant to this article and the applicable legislation.

§ 1 The processing of personal data of children shall be carried out with specific and highlighted consent given by at least one parent or legal guardian.

§ 2. In the processing of data referred to in § 1 of this article, controllers must keep public the information about the types of data collected, the manner of its use, and the procedures for exercising the rights referred to in art. 18 of this Law.

§ 3. Personal data of children may be collected without the consent referred to in § 1 of this article when the collection is necessary to contact the parents or legal guardian, used only once and without storage, or for the child's protection, and in no case may it be transferred to a third party without the consent referred to in § 1 of this article.

§ 4. Controllers must not condition the participation of the data subjects referred to in § 1 of this article in games, internet applications or other activities on the provision of personal information beyond that strictly necessary for the activity.

§ 5. The controller must make all reasonable efforts to verify that the consent referred to in § 1 of this article was given by the child's responsible party, considering the technologies available.

§ 6. Information about the processing of data referred to in this article must be provided in a simple, clear and accessible manner, taking into account the user's physical‑motor, perceptual, sensory, intellectual and mental characteristics, using audiovisual resources when appropriate, so as to provide the necessary information to parents or the legal guardian and suitable for the child's understanding.

---

Section IV – Termination of Data Processing

Art. 15. The termination of personal data processing shall occur in the following cases:

I – verification that the purpose has been achieved or that the data are no longer necessary or pertinent to the specific purpose sought;

II – end of the processing period;

III – communication by the data subject, including the exercise of the right to revoke consent as provided in § 5 of art. 8 of this Law, subject to public interest; or

IV – determination by the national authority when there is a violation of the provisions of this Law.

Art. 16. Personal data shall be eliminated after the termination of its processing, within the technical limits of the activities, with preservation allowed for the following purposes:

I – compliance with a legal or regulatory obligation by the controller;

II – study by a research body, guaranteeing, whenever possible, the anonymization of personal data;

III – transfer to a third party, provided that the data‑treatment requirements set out in this Law are respected; or

IV – exclusive use by the controller, prohibiting third‑party access, provided that the data are anonymized.

---

CHAPTER III – RIGHTS OF THE DATA SUBJECT

Art. 17. Every natural person is guaranteed ownership of their personal data and the fundamental rights of freedom, intimacy and privacy, as provided for in this Law.

Art. 18. The data subject has the right to obtain from the controller, with respect to the data of the subject treated by it, at any time and upon request:

I – confirmation of the existence of processing;

II – access to the data;

III – correction of incomplete, inaccurate or outdated data;

IV – anonymization, blocking or deletion of unnecessary, excessive or improperly processed data;

V – portability of the data to another service or product provider, upon express request, in accordance with the regulation of the national authority, observing commercial and industrial secrets; (Amended by Law No. 13,853, 2019)

VI – deletion of personal data processed with the consent of the data subject, except in the cases provided for in art. 16 of this Law;

VII – information about the public and private entities with which the controller shared the data;

VIII – information about the possibility of not providing consent and the consequences of refusal;

IX – revocation of consent, pursuant to § 5 of art. 8 of this Law.

§ 1. The data subject has the right to petition regarding their data against the controller before the national authority.

§ 2. The data subject may oppose processing based on one of the consent‑exemption hypotheses, in case of non‑compliance with this Law.

§ 3. The rights provided in this article shall be exercised upon an express request by the data subject or a legally constituted representative, to the data‑treatment agent.

§ 4. In case of impossibility of immediate adoption of the measure referred to in § 3 of this article, the controller shall send the data subject a response that may:

I – state that it is not the data‑treatment agent and, whenever possible, indicate the actual agent; or

II – indicate the factual or legal reasons that prevent immediate adoption of the measure.

§ 5. The request referred to in § 3 of this article shall be fulfilled without cost to the data subject, within the deadlines and terms provided in regulation.

§ 6.

The responsible party shall immediately inform the data‑treatment agents with which it has shared data of the correction, deletion, anonymization or blocking of the data, so that they repeat the identical procedure, except where such communication is demonstrably impossible or would entail disproportionate effort.

(Redacted by Law No. 13,853, 2019)

§ 7. Data portability referred to in item V of the article’s main clause does not include data that have already been anonymized by the controller.

§ 8. The right referred to in § 1 of this article may also be exercised before consumer protection agencies.

Art. 19. Confirmation of existence or access to personal data shall be provided, upon request of the data subject:

I – in a simplified format, immediately; or

II – by means of a clear and complete statement indicating the data’s origin, the absence of a record, the criteria used and the purpose of processing, observing commercial and industrial secrets, provided within up to 15 (fifteen) days from the date of the data subject’s request.

§ 1. Personal data shall be stored in a format that facilitates the exercise of the right of access.

§ 2. Information and data may be provided, at the data subject’s discretion:

I – by electronic means, secure and suitable for that purpose; or

II – in printed form.

§ 3. When processing is based on the data subject’s consent or a contract, the data subject may request a full electronic copy of their personal data, observing commercial and industrial secrets, in a format that allows subsequent use, including in other processing operations, as regulated by the national authority.

§ 4. The national authority may issue differentiated provisions regarding the deadlines set out in items I and II of the article’s main clause for specific sectors.

Art. 20. The data subject has the right to request the review of decisions made solely on the basis of automated processing of personal data that affect their interests, including decisions that define their personal, professional, consumption or credit profile or aspects of their personality. (Amended by Law No. 13,853, 2019)

§ 1. The controller shall provide, whenever requested, clear and adequate information about the criteria and procedures used for the automated decision, observing commercial and industrial secrets.

§ 2. In case of failure to provide the information referred to in § 1 of this article based on commercial or industrial secrecy, the national authority may conduct an audit to verify discriminatory aspects in automated personal data processing.

§ 3. (VETOED). (Inserted by Law No. 13,853, 2019)

Art. 21. Personal data relating to the regular exercise of rights by the data subject may not be used to the subject’s detriment.

Art. 22. The defense of the interests and rights of data subjects may be exercised in court, individually or collectively, in accordance with the applicable legislation concerning individual and collective protection instruments.

---

CHAPTER IV – PERSONAL DATA PROCESSING BY THE PUBLIC POWER

Section I – Rules

Art. 23. The processing of personal data by the legal entities of public law referred to in the sole paragraph of art. 1 of Law No. 12,527, of November 18, 2011 (Access to Information Law), shall be carried out to fulfill its public purpose, in pursuit of the public interest, with the objective of executing legal competencies or complying with the legal duties of the public service, provided that:

I – the situations in which, in the exercise of their competencies, they process personal data are disclosed, providing clear and up‑to‑date information about the legal basis, purpose, procedures and practices used for these activities, on easily accessible channels, preferably on their websites;

II – (VETOED); and

III – a data‑protection officer is indicated when they carry out personal data processing operations, pursuant to art. 39 of this Law; (Amended by Law No. 13,853, 2019)

IV – (VETOED). (Inserted by Law No. 13,853, 2019)

§ 1. The national authority may determine the forms of publicity of processing operations.

§ 2. The provisions of this Law do not exempt the entities mentioned in the article’s main clause from establishing the authorities referred to in Law No. 12,527, of November 18, 2011 (Access to Information Law).

§ 3. The deadlines and procedures for exercising the data subject’s rights before the Public Power shall observe the provisions of specific legislation, especially the provisions of Law No. 9,507, of November 12, 1997 (Habeas Data Law), Law No. 9,784, of January 29, 1999 (General Administrative Procedure Law), and Law No. 12,527, of November 18, 2011 (Access to Information Law).

§ 4. Notarial and registration services exercised privately, by delegation of the Public Power, shall receive the same treatment as the legal entities referred to in the article’s main clause, pursuant to this Law.

§ 5. Notarial and registration bodies must provide electronic access to data for the public administration, considering the purposes set out in the article’s main clause.

Art. 24. Public companies and mixed‑economy societies that operate in a competitive regime, subject to art. 173 of the Federal Constitution, shall receive the same treatment as private legal entities, pursuant to this Law.

Sole paragraph. Public companies and mixed‑economy societies, when implementing public policies and within their execution, shall receive the same treatment as public bodies and entities, pursuant to this Chapter.

Art. 25. Data shall be maintained in an interoperable and structured format for shared use, with a view to the execution of public policies, the provision of public services, the decentralization of public activity and the dissemination and public access to information.

Art. 26. The shared use of personal data by the Public Power must meet specific purposes of public policy execution and legal assignment by public bodies and entities, respecting the data‑protection principles listed in art. 6 of this Law.

§ 1. It is prohibited for the Public Power to transfer personal data contained in databases it accesses to private entities, except:

I – in cases of decentralized execution of a public activity that requires the transfer, exclusively for that specific and determined purpose, observing the provisions of Law No. 12,527, of November 18, 2011 (Access to Information Law);

II – (VETOED);

III – when the data are publicly accessible, observing the provisions of this Law;

IV – when there is a legal provision or the transfer is supported by contracts, agreements or similar instruments; (Inserted by Law No. 13,853, 2019)

V – when the transfer of data aims exclusively at fraud and irregularity prevention, or to protect and safeguard the security and integrity of the data subject, provided that the processing for other purposes is prohibited. (Inserted by Law No. 13,853, 2019)

§ 2. The contracts and agreements referred to in § 1 of this article must be communicated to the national authority.

Art. 27. The communication or shared use of personal data of a public‑law legal entity with a private‑law entity shall be reported to the national authority and shall depend on the data subject’s consent, except:

I – in the consent‑exemption cases provided for in this Law;

II – in cases of shared data use, which shall be made public pursuant to item I of the main clause of art. 23 of this Law; or

III – in the exceptions listed in § 1 of art. 26 of this Law.

Sole paragraph. The information to the national authority referred to in the article’s main clause shall be subject to regulation. (Inserted by Law No. 13,853, 2019)

Art. 28. (VETOED).

Art. 29. The national authority may, at any time, request from public bodies and entities the performance of personal data processing operations, specific information about the scope and nature of the data and other details of the processing carried out, and may issue a complementary technical opinion to ensure compliance with this Law. (Amended by Law No. 13,853, 2019)

Art. 30. The national authority may establish complementary norms for communication and shared use activities of personal data.

Section II – Responsibility

Art. 31. When there is an infringement of this Law resulting from personal data processing by public bodies, the national authority may send a notice with appropriate measures to cease the violation.

Art. 32. The national authority may request public‑power agents to publish data‑protection impact reports and suggest the adoption of standards and best practices for personal data processing by the Public Power.

---

CHAPTER V – INTERNATIONAL DATA TRANSFER

Art. 33. International transfer of personal data is only permitted in the following cases:

I – to countries or international organizations that provide an adequate level of personal data protection as foreseen in this Law;

II – when the controller offers and proves guarantees of compliance with the principles, data‑subject rights and protection regime set out in this Law, in the form of:

a) specific contractual clauses for the particular transfer;

b) standard contractual clauses;

c) global corporate rules;

d) seals, certificates and codes of conduct regularly issued;

III – when the transfer is necessary for international legal cooperation among public intelligence, investigation and prosecution bodies, in accordance with international law instruments;

IV – when the transfer is necessary to protect the life or physical integrity of the data subject or a third party;

V – when the national authority authorizes the transfer;

VI – when the transfer results from a commitment assumed in an international cooperation agreement;

VII – when the transfer is necessary for the execution of a public policy or legal assignment of the public service, with publicity pursuant to item I of the main clause of art. 23 of this Law;

VIII – when the data subject has provided specific and highlighted consent for the transfer, with prior information about the international nature of the operation, clearly distinguishing it from other purposes; or

IX – when necessary to meet the hypotheses provided for in items II, V and VI of art. 7 of this Law.

Sole paragraph. For the purposes of item I of this article, the public‑law legal entities referred to in the sole paragraph of art. 1 of Law No. 12,527, of November 18, 2011 (Access to Information Law), within their legal competencies, may request the national authority to assess the level of personal data protection afforded by a country or international organization.

Art. 34. The level of data protection of the foreign country or international organization mentioned in item I of the main clause of art. 33 of this Law shall be assessed by the national authority, which shall consider:

I – the general and sectoral norms of the legislation in force in the destination country or international organization;

II – the nature of the data;

III – compliance with the general principles of personal data protection and data‑subject rights provided in this Law;

IV – the adoption of security measures provided in regulation;

V – the existence of judicial and institutional guarantees for respect of personal data‑protection rights; and

VI – other specific circumstances related to the transfer.

Art. 35. The definition of the content of standard contractual clauses, as well as the verification of specific contractual clauses for a particular transfer, global corporate rules or seals, certificates and codes of conduct referred to in item II of the main clause of art. 33 of this Law, shall be carried out by the national authority.

§ 1. For the verification provided in the main clause of this article, the minimum requirements, conditions and guarantees for the transfer that observe the rights, guarantees and principles of this Law shall be considered.

§ 2. In the analysis of contractual clauses, documents or global corporate rules submitted for approval by the national authority, supplementary information may be requested or verification diligences carried out regarding processing operations, when necessary.

§ 3. The national authority may designate certification bodies to carry out the provision of this article, which shall remain under its supervision as defined in regulation.

§ 4. Acts performed by certification bodies may be reviewed by the national authority and, if found non‑compliant with this Law, may be revised or annulled.

§ 5. Sufficient guarantees of compliance with the general principles of protection and data‑subject rights referred to in the main clause of this article shall also be analyzed according to the technical and organizational measures adopted by the operator, as provided in §§ 1 and 2 of art. 46 of this Law.

Art. 36. Changes in the guarantees presented as sufficient for compliance with the general principles of protection and data‑subject rights referred to in item II of art. 33 of this Law shall be communicated to the national authority.

---

CHAPTER VI – DATA‑TREATMENT AGENTS

Section I – Controller and Processor

Art. 37. The controller and the processor must keep a record of the personal data processing operations they carry out, especially when based on legitimate interest.

Art. 38. The national authority may require the controller to prepare a data‑protection impact report, including for sensitive data, concerning its processing operations, pursuant to regulation, observing commercial and industrial secrets.

Sole paragraph. Observing the provisions of the article’s main clause, the report shall contain, at minimum, a description of the types of data collected, the methodology used for collection and security assurance, and the controller’s analysis regarding measures, safeguards and risk‑mitigation mechanisms adopted.

Art. 39. The processor shall carry out processing according to the instructions provided by the controller, which shall verify compliance with its own instructions and the applicable norms.

Art. 40. The national authority may establish interoperability standards for portability, free data access and security, as well as retention periods for records, taking into account especially the need and transparency.

Section II – Data‑Protection Officer

Art. 41. The controller shall appoint a data‑protection officer.

§ 1. The officer’s identity and contact information shall be publicly disclosed, clearly and objectively, preferably on the controller’s website.

§ 2. The officer’s activities consist of:

I – receiving complaints and communications from data subjects, providing clarifications and taking measures;

II – receiving communications from the national authority and taking measures;

III – guiding the entity’s employees and contractors regarding the practices to be adopted concerning personal data protection; and

IV – performing other duties determined by the controller or established in complementary norms.

§ 3. The national authority may establish complementary norms regarding the definition and duties of the officer, including cases of exemption from the requirement to appoint one, according to the entity’s nature, size or volume of processing operations.

§ 4. (VETOED). (Inserted by Law No. 13,853, 2019)

Section III – Responsibility and Damage Compensation

Art. 42. The controller or processor who, by reason of exercising personal data processing activities, causes patrimonial, moral, individual or collective damage to another party in violation of data‑protection legislation, is obliged to compensate it.

§ 1. To ensure effective compensation to the data subject:

I – the processor is jointly liable for damages caused by processing when it fails to comply with data‑protection legislation obligations or does not follow the controller’s lawful instructions, in which case the processor is equated with the controller, except in the exclusion cases provided for in art. 43 of this Law;

II – controllers directly involved in the processing that caused damage to the data subject are jointly liable, except in the exclusion cases provided for in art. 43 of this Law.

§ 2. The judge, in civil proceedings, may reverse the burden of proof in favor of the data subject when, in his judgment, the allegation is plausible, there is vulnerability for evidence production, or producing evidence would be excessively burdensome for the data subject.

§ 3. Collective damage‑reparation actions whose object is liability under the article’s main clause may be exercised collectively in court, observing the provisions of the pertinent legislation.

§ 4. Whoever compensates the damage to the data subject has the right of recourse against the other responsible parties, proportionally to their participation in the harmful event.

Art. 43. Data‑treatment agents shall not be held liable only when they prove:

I – that they did not carry out the personal data processing attributed to them;

II – that, although they performed the attributed processing, there was no violation of data‑protection legislation; or

III – that the damage resulted from the exclusive fault of the data subject or a third party.

Art. 44. The processing of personal data shall be irregular when it fails to observe the legislation or when it does not provide the security that the data subject may expect, considering the relevant circumstances, among which:

I – the manner in which it is carried out;

II – the result and the risks that can reasonably be expected from it;

III – the data‑processing techniques available at the time it was carried out.

Sole paragraph. The controller or the processor shall be liable for damages arising from the violation of data security if, by failing to adopt the security measures provided for in art. 46 of this Law, it causes the damage.

Art. 45. The cases of violation of the data subject’s rights in consumer relations remain subject to the liability rules provided for in the pertinent legislation.

CHAPTER VII OF SECURITY AND GOOD PRACTICES

Section I of Security and Data Confidentiality

Art. 46. Data agents must adopt security measures, technical and administrative, capable of protecting personal data from unauthorized access and from accidental or illicit situations of destruction, loss, alteration, communication or any form of inadequate or illicit treatment.

§ 1 The national authority may establish minimum technical standards to make applicable the provisions of the article’s caput, considering the nature of the information processed, the specific characteristics of the processing and the current state of technology, especially in the case of sensitive personal data, as well as the principles set out in the caput of art. 6 of this Law.

§ 2 The measures referred to in the caput of this article must be observed from the design phase of the product or service until its execution.

Art. 47. Data agents or any other person intervening in any processing phase shall be obliged to ensure the information security provided for in this Law with respect to personal data, even after its termination.

Art. 48. The controller must notify the national authority and the data subject of a security incident that may cause relevant risk or damage to the subjects.

§ 1 The notification shall be made within a reasonable period, as defined by the national authority, and must include, at a minimum:

I – a description of the nature of the affected personal data;

II – information about the involved data subjects;

III – an indication of the technical and security measures used to protect the data, observing commercial and industrial secrets;

IV – the risks related to the incident;

V – the reasons for any delay, in case the notification was not immediate; and

VI – the measures that were or will be taken to reverse or mitigate the effects of the prejudice.

§ 2 The national authority shall assess the seriousness of the incident and may, if necessary to safeguard the rights of the subjects, require the controller to adopt measures such as:

I – wide dissemination of the fact in the media; and

II – measures to reverse or mitigate the effects of the incident.

§ 3 In assessing the seriousness of the incident, it will be evaluated whether adequate technical measures were adopted that render the affected personal data unintelligible, within and at the technical limits of its services, to unauthorized third parties.

Art. 49. The systems used for the processing of personal data must be structured so as to meet security requirements, good‑practice and governance standards, the general principles set out in this Law and other regulatory norms.

Section II of Good Practices and Governance

Art. 50. Controllers and processors, within the scope of their competencies, for the processing of personal data, individually or through associations, may formulate good‑practice and governance rules that establish the conditions of organization, the operating regime, procedures—including complaints and petitions of data subjects—security norms, technical standards, specific obligations for the various parties involved in processing, educational actions, internal supervision and risk‑mitigation mechanisms, and other aspects related to the processing of personal data.

§ 1 When establishing good‑practice rules, the controller and the processor shall take into account, with respect to processing and data, the nature, scope, purpose and the probability and severity of the risks and benefits arising from the processing of the data subject.

§ 2 In applying the principles indicated in items VII and VIII of the caput of art. 6 of this Law, the controller, considering the structure, scale and volume of its operations, as well as the sensitivity of the data processed and the probability and severity of damage to data subjects, may:

I – implement a privacy‑governance program that, at a minimum:

a) demonstrates the controller’s commitment to adopting internal processes and policies that ensure comprehensive compliance with norms and good practices relating to personal data protection;

b) applies to the entire set of personal data under its control, regardless of how its collection was carried out;

c) is adapted to the structure, scale and volume of its operations, as well as to the sensitivity of the data processed;

d) establishes appropriate policies and safeguards based on a systematic impact and privacy‑risk assessment process;

e) aims to establish a relationship of trust with the data subject, through transparent action and mechanisms for the subject’s participation;

f) is integrated into its overall governance structure and establishes and applies internal and external supervision mechanisms;

g) includes incident‑response and remediation plans; and

h) is constantly updated based on information obtained from continuous monitoring and periodic assessments;

II – demonstrate the effectiveness of its privacy‑governance program when appropriate and, in particular, at the request of the national authority or another entity responsible for promoting compliance with good practices or codes of conduct, which independently promote compliance with this Law.

§ 3 Good‑practice and governance rules must be published and periodically updated and may be recognized and disclosed by the national authority.

Art. 51. The national authority shall encourage the adoption of technical standards that facilitate control by data subjects over their personal data.

CHAPTER VIII OF SUPERVISION

Section I of Administrative Sanctions

Art. 52. Data processing agents, due to infractions of the norms provided for in this Law, are subject to the following administrative sanctions applicable by the national authority:

(Effective)

I – warning, with indication of a deadline for adopting corrective measures;

II – simple fine, of up to 2 % (two percent) of the revenue of the private legal entity, group or conglomerate in Brazil in its last fiscal year, excluding taxes, limited in total to R$ 50,000,000.00 (fifty million reais) per violation;

III – daily fine, observing the total limit referred to in item II;

IV – publicisation of the infraction after it has been duly investigated and confirmed;

V – blocking of the personal data to which the infraction refers until its regularisation;

VI – deletion of the personal data to which the infraction refers;

VII – (VETOED);

VIII – (VETOED);

IX – (VETOED);

X – partial suspension of the operation of the database to which the infraction refers for a maximum period of 6 (six) months, renewable for an equal period, until the processing activity is regularised by the controller; (Included by Law No. 13,853 of 2019)

XI – suspension of the exercise of the personal‑data‑processing activity to which the infraction refers for a maximum period of 6 (six) months, renewable for an equal period; (Included by Law No. 13,853 of 2019)

XII – partial or total prohibition of activities related to data processing. (Included by Law No. 13,853 of 2019)

§ 1 Sanctions shall be applied after an administrative procedure that provides the opportunity for full defence, in a gradual, isolated or cumulative manner, according to the peculiarities of the concrete case and considering the following parameters and criteria:

I – the gravity and nature of the infractions and the personal rights affected;

II – the good‑faith of the infringer;

III – the advantage obtained or sought by the infringer;

IV – the economic condition of the infringer;

V – recidivism;

VI – the degree of damage;

VII – the cooperation of the infringer;

VIII – the reiterated and demonstrated adoption of internal mechanisms and procedures capable of minimising damage, aimed at safe and adequate data processing, in line with the provision of item II of § 2 of art. 48 of this Law;

IX – the adoption of a good‑practice and governance policy;

X – the prompt adoption of corrective measures; and

XI – the proportionality between the gravity of the fault and the intensity of the sanction.

§ 2 The provisions of this article do not replace the application of administrative, civil or criminal sanctions defined in Law No. 8,078 of September 11 1990, and in specific legislation. (Amended by Law No. 13,853 of 2019)

§ 3 The provisions in items I, IV, V, VI, X, XI and XII of the caput of this article may be applied to entities and public bodies, without prejudice to the provisions of Law No. 8,112 of December 11 1990, Law No. 8,429 of June 2 1992, and Law No. 12,527 of November 18 2011. (Promulgation of vetoed parts)

§ 4 In calculating the amount of the fine referred to in item II of the caput of this article, the national authority may consider the total revenue of the company or group of companies, when it does not have the revenue figure for the business sector in which the infraction occurred, as defined by the national authority, or when the figure is presented incompletely or is not demonstrated unequivocally and reliably.

§ 5 The proceeds from the fines applied by the ANPD, whether or not entered in active debt, shall be destined to the Diffuse Rights Defense Fund referred to in art. 13 of Law No. 7,347 of July 24 1985, and Law No. 9,008 of March 21 1995. (Included by Law No. 13,853 of 2019)

§ 6 The sanctions provided for in items X, XI and XII of the caput of this article shall be applied:

I – only after at least one of the sanctions referred to in items II, III, IV, V and VI of the caput of this article has already been imposed for the same concrete case; (Included by Law No. 13,853 of 2019)

II – in the case of controllers subject to other bodies and entities with sanctioning competence, after hearing those bodies. (Included by Law No. 13,853 of 2019)

§ 7 Individual leaks or unauthorized accesses referred to in the caput of art. 46 of this Law may be the object of direct conciliation between controller and data subject and, if no agreement is reached, the controller shall be subject to the penalties provided for in this article. (Included by Law No. 13,853 of 2019)

Art. 53. The national authority shall define, through its own regulation on administrative sanctions for infractions of this Law, which shall be subject to public consultation, the methodologies that will guide the calculation of the base value of fine sanctions.

(Effective)

§ 1 The methodologies referred to in the caput of this article must be previously published for the knowledge of data‑processing agents and must objectively present the forms and dosimetry for calculating the base value of fine sanctions, containing detailed justification of all its elements, demonstrating compliance with the criteria provided for in this Law.

§ 2 The sanction regulation and corresponding methodologies must establish the circumstances and conditions for adopting a simple or daily fine.

Art. 54. The amount of the daily‑fine sanction applicable to infractions of this Law must consider the gravity of the fault and the extent of the damage or prejudice caused and shall be justified by the national authority.

(Effective)

Sole paragraph. The notice of the daily‑fine sanction shall contain, at a minimum, a description of the imposed obligation, the reasonable period set by the body for its compliance, and the amount of the daily fine to be applied for non‑compliance.

CHAPTER IX (Text amended by Law No. 15,352 of 2026)

OF THE NATIONAL DATA PROTECTION AGENCY AND THE NATIONAL COUNCIL FOR PERSONAL DATA PROTECTION AND PRIVACY

Section I of the National Data Protection Agency

Art. 55. (VETOED).

Art. 55‑A. The National Data Protection Agency (ANPD) is created as a special‑nature autonomous agency linked to the Ministry of Justice and Public Security, endowed with functional, technical, decision‑making, administrative and financial autonomy, with its own assets and headquarters in the Federal District, pursuant to Law No. 13,848 of June 25 2019.

(Text amended by Law No. 15,352 of 2026)

§ 1 (Repealed by Law No. 14,460 of 2022)

§ 2 (Repealed by Law No. 14,460 of 2022)

§ 3 (Repealed by Law No. 14,460 of 2022)

Art. 55‑B. (Repealed by Law No. 14,460 of 2022)

Art. 55‑C. The ANPD is composed of:

(Included by Law No. 13,853 of 2019)

I – a Board of Directors, the highest governing body;

II – the National Council for Personal Data Protection and Privacy; (Included by Law No. 13,853 of 2019)

III – an Internal Affairs Office; (Included by Law No. 13,853 of 2019)

IV – an Ombudsman; (Included by Law No. 13,853 of 2019)

V – (repealed); (Text amended by Law No. 14,460 of 2022)

V‑A – a Prosecutor’s Office; (Text amended by Law No. 15,352 of 2026)

V‑B – an Auditing Office; (Included by Law No. 15,352 of 2026)

VI – administrative units and specialized units. (Text amended by Law No. 15,352 of 2026)

Art. 55‑D. The Board of Directors of the ANPD shall be composed of five (5) directors, including the President‑Director.

(Included by Law No. 13,853 of 2019)

§ 1 The members of the Board of Directors shall be chosen by the President of the Republic and appointed by him after approval by the Federal Senate, pursuant to paragraph ‘f’ of item III of art. 52 of the Federal Constitution, and shall hold a commission position in the Senior Management and Advisory Group – DAS, at a minimum level 5.

§ 2 Board members shall be selected among Brazilians with an unblemished reputation, higher education and high standing in the field of expertise required for the positions.

§ 3 The term of Board members shall be four (4) years. (Included by Law No. 13,853 of 2019)

§ 4 The terms of the first appointed Board members shall be two (2), three (3), four (4), five (5) and six (6) years, as established in the appointment act.

§ 5 In the event of a vacancy during a member’s term, the remaining period shall be completed by a successor.

Art. 55‑E. Board members shall lose their positions only due to resignation, final and unappealable judicial conviction, or dismissal resulting from a disciplinary administrative process. (Included by Law No. 13,853 of 2019)

§ 1 Under the caput of this article, the Minister of State, Head of the Civil House of the Presidency of the Republic shall initiate the disciplinary administrative process, which shall be conducted by a special commission composed of stable federal public servants.

§ 2 It is the President’s competence to order preventive suspension, only when recommended by the special commission referred to in § 1 of this article, and to render the judgment.

Art. 55‑F. The provisions of art. 6 of Law No. 12,813 of May 16 2013 shall apply to Board members after they leave office. (Included by Law No. 13,853 of 2019)

Sole paragraph. Violation of the caput of this article constitutes an act of administrative improbity. (Included by Law No. 13,853 of 2019)

Art. 55‑G. A decree of the President of the Republic shall provide for the regulatory structure of the ANPD. (Included by Law No. 13,853 of 2019)

§ 1 Until the date of entry into force of its regulatory structure, the ANPD shall receive technical and administrative support from the Civil House of the Presidency of the Republic for the exercise of its activities. (Included by Law No. 13,853 of 2019)

§ 2 The Board of Directors shall establish the internal regulations of the ANPD. (Included by Law No. 13,853 of 2019)

Art. 55‑H. Commissioned positions and trust functions of the ANPD shall be transferred from other bodies and entities of the federal Executive Power. (Included by Law No. 13,853 of 2019)

Art. 55‑I. Occupants of commissioned positions and trust functions of the ANPD shall be indicated by the Board of Directors and appointed or designated by the President‑Director. (Included by Law No. 13,853 of 2019)

Art. 55‑J. The ANPD shall be competent to:

I – safeguard personal data protection, in accordance with the legislation; (Included by Law No. 13,853 of 2019)

II – safeguard the observance of commercial and industrial secrets, observing personal data protection and the confidentiality of information when protected by law or when the breach of confidentiality would violate the foundations of art. 2 of this Law; (Included by Law No. 13,853 of 2019)

III – develop guidelines for the National Policy on Personal Data Protection and Privacy; (Included by Law No. 13,853 of 2019)

IV – supervise and apply sanctions in case of data processing carried out in violation of the legislation, through an administrative process that ensures adversarial proceedings, full defence and the right of appeal; (Included by Law No. 13,853 of 2019)

V – consider petitions of data subjects against controllers after the subject has demonstrated that a complaint to the controller was not resolved within the period established by regulation; (Included by Law No. 13,853 of 2019)

VI – promote among the population knowledge of the rules and public policies on personal data protection and security measures; (Included by Law No. 13,853 of 2019)

VII – promote and develop studies on national and international practices of personal data protection and privacy; (Included by Law No. 13,853 of 2019)

VIII – stimulate the adoption of standards for services and products that facilitate the exercise of control by data subjects over their personal data, which shall consider the specificities of activities and the size of the responsible parties; (Included by Law No. 13,853 of 2019)

IX – promote cooperation actions with personal data protection authorities of other countries, of an international or transnational nature; (Included by Law No. 13,853 of 2019)

X – provide for the forms of publicity of personal data processing operations, respecting commercial and industrial secrets; (Included by Law No. 13,853 of 2019)

XI – request, at any time, from public entities that carry out personal data processing operations, specific information on the scope, nature of the data and other details of the processing performed, with the possibility of issuing a complementary technical opinion to guarantee compliance with this Law; (Included by Law No. 13,853 of 2019)

XII – prepare annual management reports on its activities; (Included by Law No. 13,853 of 2019)

XIII – issue regulations and procedures on personal data protection and privacy, as well as impact reports for personal data protection for cases where processing represents high risk to the guarantee of the general principles of personal data protection provided for in this Law; (Included by Law No. 13,853 of 2019)

XIV – hear data‑processing agents and society on matters of relevant interest and account for its activities and planning; (Included by Law No. 13,853 of 2019)

XV – collect and apply its revenues and publish, in the management report referred to in item XII of the caput of this article, the breakdown of its revenues and expenses; (Included by Law No. 13,853 of 2019)

XVI – conduct audits, or order their conduct, within the scope of the supervisory activity referred to in item IV and with due observance of the provision in item II of the caput of this article, on personal data processing performed by data‑processing agents, including the public sector; (Included by Law No. 13,853 of 2019)

XVII – enter, at any time, into commitments with data‑processing agents to eliminate irregularities, legal uncertainty or contentious situations within administrative processes, in accordance with Decree‑Law No. 4,657 of September 4 1942; (Included by Law No. 13,853 of 2019)

XVIII – issue simplified and differentiated norms, guidelines and procedures, including regarding deadlines, so that micro‑enterprises and small businesses, as well as incremental or disruptive innovation initiatives that self‑declare as startups or innovation companies, can comply with this Law; (Included by Law No. 13,853 of 2019)

XIX – ensure that the processing of data of elderly persons is carried out in a simple, clear, accessible and appropriate manner, in accordance with this Law and Law No. 10,741 of October 1 2003 (Elderly Statute); (Included by Law No. 13,853 of 2019)

XX – decide, in the administrative sphere, in a terminative manner, on the interpretation of this Law, its competencies and omitted cases; (Included by Law No. 13,853 of 2019)

XXI – communicate to the competent authorities any criminal infractions of which it becomes aware; (Included by Law No. 13,853 of 2019)

XXII – inform internal control bodies of non‑compliance with the provisions of this Law by federal public administration bodies and entities; (Included by Law No. 13,853 of 2019)

XXIII – coordinate with public regulatory authorities to exercise its competencies in specific economic and governmental sectors subject to regulation; (Included by Law No. 13,853 of 2019)

XXIV – implement simplified mechanisms, including electronic ones, for the registration of complaints about personal data processing that is out of compliance with this Law. (Included by Law No. 13,853 of 2019)

§ 1 When imposing administrative conditions on personal data processing by private data‑processing agents, such as limits, charges or obligations, the ANPD must observe the requirement of minimal intervention, ensuring the foundations, principles and rights of data subjects provided for in art. 170 of the Federal Constitution and this Law. (Included by Law No. 13,853 of 2019)

§ 2 Regulations and norms issued by the ANPD must be preceded by public consultation and hearings, as well as regulatory impact analyses. (Included by Law No. 13,853 of 2019)

§ 3. The ANPD and the public bodies and entities responsible for regulating specific sectors of economic and governmental activity shall coordinate their activities, within the corresponding spheres of action, in order to ensure the fulfillment of their duties with the greatest efficiency and to promote the proper functioning of the regulated sectors, in accordance with specific legislation, and the processing of personal data, as provided for in this Law. (Included by Law No. 13,853, 2019)

§ 4. The ANPD shall maintain a permanent communication forum, including technical cooperation, with public administration bodies and entities responsible for regulating specific sectors of economic and governmental activity, in order to facilitate the ANPD’s regulatory, supervisory and punitive competencies. (Included by Law No. 13,853, 2019)

§ 5. In the exercise of the competencies referred to in the caput of this article, the competent authority shall safeguard business secrecy and the confidentiality of information, in accordance with the law. (Included by Law No. 13,853, 2019)

§ 6. Complaints collected pursuant to item V of the caput of this article may be analyzed in an aggregated manner, and any measures arising from them may be adopted in a standardized way. (Included by Law No. 13,853, 2019)

Art. 55‑K. The application of the sanctions provided for in this Law is exclusively the competence of the ANPD, and its competencies shall prevail, with respect to personal data protection, over the related competencies of other entities or public administration bodies. (Included by Law No. 13,853, 2019)

Single paragraph. The ANPD shall coordinate its actions with other bodies and entities that have sanctioning and normative competencies related to personal data protection and shall be the central body for interpreting this Law and for establishing norms and guidelines for its implementation. (Included by Law No. 13,853, 2019)

Art. 55‑L. The ANPD’s revenues consist of: (Included by Law No. 13,853, 2019)

1. the appropriations recorded in the Union’s general budget, special credits, additional credits, transfers and allocations granted to it; (Included by Law No. 13,853, 2019)
2. donations, legacies, subsidies and other resources destined for it; (Included by Law No. 13,853, 2019)
3. amounts derived from the sale or lease of its movable and immovable property; (Included by Law No. 13,853, 2019)
4. amounts derived from financial market investments of the revenues provided for in this article; (Included by Law No. 13,853, 2019)
5. (VETOED); (Included by Law No. 13,853, 2019)
6. resources originating from agreements, conventions or contracts concluded with entities, organizations or companies, public or private, national or international; (Included by Law No. 13,853, 2019)
7. the proceeds from the sale of publications, technical material, data and information, including for public bidding purposes. (Included by Law No. 13,853, 2019)

Art. 55‑M. The ANPD’s patrimony consists of the assets and rights: (Included by Law No. 14,460, 2022)

1. transferred to it by the offices of the Presidency of the Republic; (Included by Law No. 14,460, 2022)
2. that it acquires or incorporates. (Included by Law No. 14,460, 2022)

Art. 56. (VETOED).

Art. 57. (VETOED).

Section II – The National Council for Personal Data Protection and Privacy

Art. 58. (VETOED).

Art. 58‑A. The National Council for Personal Data Protection and Privacy shall be composed of 23 (twenty‑three) representatives, titular and alternate, from the following bodies: (Included by Law No. 13,853, 2019)

1. five (5) from the Federal Executive Branch; (Included by Law No. 13,853, 2019)
2. one (1) from the Federal Senate; (Included by Law No. 13,853, 2019)
3. one (1) from the Chamber of Deputies; (Included by Law No. 13,853, 2019)
4. one (1) from the National Council of Justice; (Included by Law No. 13,853, 2019)
5. one (1) from the National Council of the Public Prosecutor’s Office; (Included by Law No. 13,853, 2019)
6. one (1) from the Brazilian Internet Steering Committee; (Included by Law No. 13,853, 2019)
7. three (3) from civil society entities with activities related to personal data protection; (Included by Law No. 13,853, 2019)
8. three (3) from scientific, technological and innovation institutions; (Included by Law No. 13,853, 2019)
9. three (3) from trade union confederations representing economic categories of the productive sector; (Included by Law No. 13,853, 2019)
10. two (2) from entities representing the business sector related to personal data processing; and (Included by Law No. 13,853, 2019)
11. two (2) from entities representing the labor sector. (Included by Law No. 13,853, 2019)

§ 1. The representatives shall be appointed by act of the President of the Republic, delegation permitted. (Included by Law No. 13,853, 2019)

§ 2. The representatives referred to in items I, II, III, IV, V and VI of the caput of this article and their alternates shall be indicated by the heads of the respective public administration bodies and entities. (Included by Law No. 13,853, 2019)

§ 3. The representatives referred to in items VII, VIII, IX, X and XI of the caput of this article and their alternates:

1. shall be indicated in accordance with regulation; (Included by Law No. 13,853, 2019)
2. may not be members of the Brazilian Internet Steering Committee; (Included by Law No. 13,853, 2019)
3. shall have a term of two (2) years, with one (1) possible renewal. (Included by Law No. 13,853, 2019)

§ 4. Participation in the National Council for Personal Data Protection and Privacy shall be considered relevant public service, unpaid. (Included by Law No. 13,853, 2019)

Art. 58‑B. The competencies of the National Council for Personal Data Protection and Privacy are:

1. to propose strategic guidelines and provide subsidies for the preparation of the National Policy on Personal Data Protection and Privacy and for the ANPD’s actions; (Included by Law No. 13,853, 2019)
2. to prepare annual evaluation reports on the execution of actions of the National Policy on Personal Data Protection and Privacy; (Included by Law No. 13,853, 2019)
3. to suggest actions to be carried out by the ANPD; (Included by Law No. 13,853, 2019)
4. to develop studies and hold debates and public hearings on personal data protection and privacy; and (Included by Law No. 13,853, 2019)
5. to disseminate knowledge about personal data protection and privacy to the population. (Included by Law No. 13,853, 2019)

Art. 59. (VETOED).

CHAPTER X – FINAL AND TRANSITIONAL PROVISIONS

Art. 60. Law No. 12,965, of 23 April 2014 (Civil Framework for the Internet) shall now apply with the following amendments:

“Art. 7 …

X – definitive deletion of personal data that the user has provided to a given internet application, at his request, at the termination of the relationship between the parties, except for cases of mandatory record keeping provided for in this Law and in the law that deals with personal data protection; …” (NR)

“Art. 16 …

II – of personal data that are excessive in relation to the purpose for which consent was given by its holder, except in the cases provided for in the Law that deals with personal data protection.” (NR)

Art. 61. The foreign company shall be notified and summoned of all procedural acts provided for in this Law, regardless of power of attorney or contractual or statutory provision, in the person of the agent or representative or person responsible for its branch, agency, subsidiary, establishment or office located in Brazil.

Art. 62. The national authority and the National Institute for Educational Studies and Research Anísio Teixeira (Inep), within the scope of their competencies, shall issue specific regulations for access to data processed by the Union for compliance with the provisions of § 2 of art. 9 of Law No. 9,394, of 20 December 1996 (Law of Guidelines and Bases of National Education), and for matters concerning the National System of Higher Education Evaluation (Sinaes), as dealt with by Law No. 10,861, of 14 April 2004.

Art. 63. The national authority shall establish norms on the progressive adequacy of databases constituted up to the date of entry into force of this Law, taking into account the complexity of processing operations and the nature of the data.

Art. 64. The rights and principles expressed in this Law do not exclude others provided for in the national legal order related to the matter or in international treaties to which the Federative Republic of Brazil is a party.

Art. 65. This Law enters into force:

• I – on 28 December 2018, regarding arts. 55‑A, 55‑B, 55‑C, 55‑D, 55‑E, 55‑F, 55‑G, 55‑H, 55‑I, 55‑J, 55‑K, 55‑L, 58‑A and 58‑B; (Included by Law No. 13,853, 2019)
• I‑A – on 1 August 2021, regarding arts. 52, 53 and 54; (Included by Law No. 14,010, 2020)
• II – 24 (twenty‑four) months after the date of its publication, regarding the remaining articles. (Included by Law No. 13,853, 2019)

Brasília, 14 August 2018; 197th of Independence and 130th of the Republic.

MICHEL TEMER

Torquato Jardim

Aloysio Nunes Ferreira Filho

Eduardo Refinetti Guardia

Esteves Pedro Colnago Junior

Gilberto Magalhães Occhi

Gilberto Kassab

Wagner de Campos Rosário

Gustavo do Vale Rocha

Ilan Goldfajn

Raul Jungmann

Eliseu Padilha

This text does not replace the version published in the Official Gazette on 15 August 2018, and was partially republished on 15 August 2018 – Extra edition.