LGPD, Brazil’s Lei Geral de Proteção de Dados, applies to any website that processes personal data of individuals located in Brazil – regardless of where the business itself is registered. If your site collects emails from Brazilian visitors, runs analytics scripts that track Brazilian users, or sells products shipped into the country, LGPD compliance isn’t optional, and the assumption that “we’re not a Brazilian company so it doesn’t apply to us” is one of the most common – and costly – misconceptions in this space.
This overview covers what LGPD actually requires from a website’s perspective, where businesses typically go wrong, and how to build a practical checklist that holds up under scrutiny.
What LGPD Actually Requires From Your Website
LGPD was modeled closely on GDPR, so if your business has already tackled European data protection requirements, much of the groundwork transfers. That said, LGPD has its own specific obligations that a copy-pasted EU privacy policy will not satisfy.
At minimum, a compliant website needs:
A privacy policy written in Portuguese (or at least offered in Portuguese for Brazilian visitors) that clearly states what data is collected, the legal basis for processing, retention periods, and how data subjects can exercise their rights.
A named data controller and, in most cases, a designated Encarregado – Brazil’s equivalent of a Data Protection Officer – with contact information published and reachable.
A cookie consent mechanism that actually blocks non-essential cookies until consent is given, not just a banner that displays and fades away regardless of user choice.
Clear mechanisms for data subject requests: access, correction, deletion, and portability, with defined response timelines.
The Legal Basis Question Most Sites Get Wrong
LGPD recognizes ten legal bases for processing personal data, and consent is only one of them. Many site owners default to “we’ll just get consent for everything,” which sounds safe but actually creates more risk, not less.
If consent is withdrawn and it was the only stated legal basis for processing, you’re legally obligated to stop that processing and potentially delete the data. Sites relying on legitimate interest or contractual necessity for core functions – like order fulfillment or fraud prevention – need to document that basis separately from marketing consent, which should always remain distinct and revocable on its own.
A common mistake here is bundling everything into one blanket consent checkbox. Regulators reviewing LGPD complaints have flagged this pattern specifically, because it obscures which basis applies to which processing activity.
Myth: LGPD Only Matters If You Have a Brazilian Legal Entity
This is the misconception worth busting directly. LGPD’s territorial scope is based on where data subjects are located and where the processing activity has effects, not where the company is incorporated. A US-based ecommerce store shipping to São Paulo, or a SaaS platform with Brazilian trial users, falls within scope the same way GDPR reaches into companies with EU visitors.
The practical consequence: geographic IP blocking or “we don’t market to Brazil” arguments rarely hold up if the site is still accessible and actually processing data from Brazilian users organically.
Building a Practical LGPD Checklist
Rather than treating this as a one-time legal review, treat it as an ongoing checklist:
1. Confirm your privacy policy is available in Portuguese and dated with its last update.
2. Verify your cookie consent tool technically blocks scripts pre-consent – test it with browser dev tools, not just visually.
3. Publish Encarregado contact details somewhere accessible, typically in the privacy policy footer.
4. Map every third-party script and subprocessor that touches visitor data, since LGPD requires disclosure of data sharing with processors, similar in spirit to the requirements covered in subprocessor lists for privacy policies.
5. Set a recurring reminder – quarterly at minimum – to re-verify that legal pages and consent mechanisms still function after site updates or plugin changes.
That last point matters more than most teams expect. A CMS update, a new marketing plugin, or a redesign can silently break a consent banner’s blocking logic or drop a legal page from the site’s navigation without anyone noticing until a complaint or audit surfaces the gap.
Where the Encarregado Role Gets Overlooked
Smaller and mid-sized businesses frequently assume the DPO/Encarregado requirement only applies to large enterprises processing sensitive data at scale. In practice, ANPD (Brazil’s data protection authority) guidance suggests most organizations processing personal data at a meaningful volume should have this role designated, even if it’s a shared responsibility rather than a full-time position. The considerations here overlap significantly with broader DPO responsibilities for mid-sized businesses, and treating it as a formality rather than an active function is a mistake that tends to surface during an actual data subject complaint, when there’s no one clearly accountable to respond within the required timeline.
Frequently Asked Questions
Does LGPD apply if my business has no physical presence in Brazil?
Yes. LGPD applies based on where data subjects are located and whether the processing activity is intended to offer goods or services to individuals in Brazil, not on where the company is registered or headquartered.
Is an English-only privacy policy enough for LGPD compliance?
Generally no. Best practice – and increasingly, expected practice under LGPD – is to provide the privacy policy in Portuguese for Brazilian visitors, since data subjects have a right to understand how their data is used in a language they can reasonably read.
What penalties apply for LGPD non-compliance?
ANPD can issue fines up to 2% of revenue in Brazil (capped per violation), along with warnings, mandated corrections, and publicized violations. Enforcement has been increasing steadily since ANPD’s sanctioning powers took effect.
Keeping LGPD Compliance Current
LGPD compliance isn’t a document you write once and file away – it’s a set of live mechanisms (consent banners, legal pages, disclosure statements) that need to keep functioning as your site evolves. The practical approach many international businesses take mirrors how they’ve already handled other regional privacy laws, adapting existing frameworks like those built for CCPA compliance for US-facing websites rather than starting from scratch. The single most useful habit: check your Portuguese-language legal pages and consent flow after every significant site change, not just once a year.