Brazil Lgpd

Brazil LGPD Compliance (Lei 13.709/2018)

Overview

The Lei Geral de Proteção de Dados Pessoais (LGPD), enacted as Lei 13.709 on 14 August 2018 and effective from 18 September 2020 (with sanctions enforceable from 1 August 2021), is Brazil's comprehensive data protection law. The LGPD applies to any processing of personal data carried out in Brazil, where the processing activity aims to offer goods or services to individuals located in Brazil, or where the personal data was collected in Brazil (Art. 3). The Autoridade Nacional de Proteção de Dados (ANPD) serves as the supervisory authority with rulemaking, enforcement, and advisory functions.

Ten Lawful Bases Under Article 7

The LGPD provides ten distinct legal bases for processing personal data, exceeding the six lawful bases under EU GDPR. Each base operates independently — organisations may rely on any applicable base without a prescribed hierarchy.

1. Consent of the Data Subject (Art. 7, I)

Requirements under Art. 8:

• Consent must be provided in writing or by other means that demonstrate the free, informed, and unequivocal expression of the data subject's will
• Written consent must appear in a clause separate from other contractual provisions (Art. 8, §1)
• The burden of proof that consent was obtained rests with the controller (Art. 8, §2)
• Consent is void if based on misleading information or where the data subject was not adequately informed (Art. 9, §1)
• Consent may be revoked at any time by express statement of the data subject, via a free and facilitated procedure (Art. 8, §5)

Implementation at Zenith Global Enterprises:

• Marketing communications to Brazilian customers require opt-in consent with a standalone consent clause
• Consent records stored in the consent management platform with timestamp, scope, and version
• Consent withdrawal mechanism accessible through the customer privacy portal within two clicks
• Granular consent for each processing purpose (marketing, profiling, third-party sharing)

2. Compliance with Legal or Regulatory Obligation (Art. 7, II)

Scope: Processing necessary for the controller to comply with a legal or regulatory obligation under Brazilian law. This includes tax reporting under the Código Tributário Nacional, anti-money laundering under Lei 9.613/1998, and employment record retention under the Consolidação das Leis do Trabalho (CLT).

Implementation at Zenith Global Enterprises:

• Employee payroll records retained for 5 years per CTN Art. 173
• Employment records retained for the duration of the employment relationship plus 5 years per CLT Art. 11
• Anti-money laundering records retained for 5 years from the last transaction per Lei 9.613/1998, Art. 10

3. Execution of Public Policies by the Public Administration (Art. 7, III)

Scope: Processing by the public administration for the execution of public policies provided in laws, regulations, or contracts. This base is available only to public administration bodies and is not applicable to private-sector organisations.

Zenith Global Enterprises relevance: Not applicable as a private-sector entity. If engaged in public-private partnerships, the government partner invokes this base.

4. Research by Research Bodies (Art. 7, IV)

Scope: Processing for carrying out studies by research bodies, ensuring anonymisation of personal data whenever possible. Research bodies must comply with specific ethical standards and are subject to oversight by the relevant ethics committees.

Zenith Global Enterprises relevance: If collaborating with academic institutions on logistics optimisation research, ensure data shared for research purposes is anonymised or pseudonymised with the research body assuming controller responsibility.

5. Contract Performance (Art. 7, V)

Scope: Processing necessary for the execution of a contract or preliminary procedures related to a contract to which the data subject is a party, at the request of the data subject.

Implementation at Zenith Global Enterprises:

• Processing customer shipping addresses, contact details, and payment information to fulfil freight forwarding contracts
• Pre-contractual processing of credit assessments when customers request trade credit terms
• Processing employee data necessary for execution of the employment contract

6. Exercise of Rights in Judicial, Administrative, or Arbitration Proceedings (Art. 7, VI)

Scope: Processing necessary for the regular exercise of rights in judicial, administrative, or arbitration proceedings. This permits retention and use of personal data where necessary for litigation or regulatory proceedings.

Implementation at Zenith Global Enterprises:

• Retention of customer correspondence and transaction records relevant to pending or anticipated customs disputes
• Preservation of employee performance records where termination is contested before the Justiça do Trabalho (Labour Courts)

7. Protection of Life or Physical Safety (Art. 7, VII)

Scope: Processing necessary for the protection of the life or physical safety of the data subject or a third party. This base is reserved for genuine emergency situations where consent cannot reasonably be obtained.

Implementation at Zenith Global Enterprises:

• Processing of employee medical emergency information during workplace incidents at Brazilian warehouse facilities
• Sharing driver location data with emergency services during road transport incidents

8. Health Protection (Art. 7, VIII)

Scope: Processing necessary for the protection of health, exclusively in a procedure carried out by health professionals, health services, or health authorities. This base is narrower than the life protection base and is restricted to health-sector actors.

Zenith Global Enterprises relevance: Limited to occupational health processing by the company's contracted occupational medicine providers under Norma Regulamentadora NR-7 (PCMSO).

9. Legitimate Interest of the Controller or Third Party (Art. 7, IX)

Requirements under Art. 10:

• Processing must be for legitimate purposes based on concrete situations, including:
  • (I) Support and promotion of the controller's activities
  • (II) Protection of the data subject or of the provision of services that benefit the data subject, in connection with the exercise of their rights
• Only strictly necessary data may be processed for the stated purpose
• The controller must adopt transparency measures, including a legitimate interest impact assessment
• If the ANPD requests it, the controller must produce a Relatório de Impacto à Proteção de Dados Pessoais (RIPD) — the LGPD equivalent of a DPIA

Implementation at Zenith Global Enterprises:

• Fraud detection on customer payment transactions using pattern analysis
• IT security monitoring of employee network activity to prevent data breaches
• Customer relationship management analytics to improve service quality
• Legitimate interest assessment documented for each use case using the three-part balancing test: (1) legitimate purpose, (2) necessity, (3) balancing against data subject rights

10. Credit Protection (Art. 7, X)

Scope: Processing for the protection of credit, including credit scoring. This base is unique to the LGPD and has no direct equivalent in the GDPR. It permits processing for credit risk assessment, credit bureau operations, and commercial credit evaluation.

Implementation at Zenith Global Enterprises:

• Credit scoring of corporate customers applying for trade credit terms
• Sharing payment history with credit bureaus (Serasa Experian, SPC Brasil, Boa Vista) in compliance with Lei 12.414/2011 (Positive Credit Registry)
• Retention of credit assessment records for the statutory period

Sensitive Data Processing Under Article 11

Sensitive personal data (dados pessoais sensíveis) includes data on racial or ethnic origin, religious conviction, political opinion, trade union membership, health data, sex life, genetic data, and biometric data (Art. 5, II).

Processing of sensitive data requires one of eight specific bases under Art. 11:

1. Specific and highlighted consent from the data subject
2. Compliance with a legal obligation (without consent)
3. Shared processing by the public administration for public policy execution
4. Research bodies (with anonymisation where possible)
5. Exercise of rights in judicial/administrative/arbitration proceedings
6. Protection of life or physical safety
7. Health protection in medical procedures
8. Fraud prevention and security of the data subject in identification processes

Key distinction from GDPR: The LGPD does not include legitimate interest or contract performance as bases for sensitive data processing.

Data Protection Officer (Encarregado) Requirements

Appointment (Art. 41)

The controller must appoint a Data Protection Officer (Encarregado pelo Tratamento de Dados Pessoais). ANPD Resolution CD/ANPD No. 2/2022 (amended by Resolution CD/ANPD No. 18/2024) provides that:

• Small-scale processing agents (agentes de tratamento de pequeno porte) may appoint a simplified contact channel instead of a formal DPO
• The DPO's identity and contact information must be publicly disclosed, preferably on the controller's website
• The ANPD may establish additional rules regarding the DPO's qualifications

DPO Functions (Art. 41, §2)

Zenith Global Enterprises DPO Structure

Data Subject Rights (Arts. 17-22)

Rights Catalogue

Right to Review Automated Decisions (Art. 20)

The data subject has the right to request review of decisions made solely on the basis of automated processing, including profiling, that affect their interests. The controller must provide clear and adequate information regarding the criteria and procedures used for automated decision-making, subject to commercial and industrial secrecy.

ANPD Resolution CD/ANPD No. 2/2022 clarified that small-scale processing agents may provide simplified explanations, but all controllers must enable human review upon request.

Zenith Global Enterprises implementation:

• Automated credit scoring decisions are flagged for human review upon data subject request
• Credit model criteria documented and available in simplified form for disclosure
• Human reviewer assigned within 5 business days of request receipt

International Data Transfer Mechanisms (Art. 33)

The LGPD permits international transfer of personal data only under the following conditions:

Zenith Global Enterprises International Transfer Framework

ANPD Enforcement Framework

Administrative Sanctions (Art. 52)

ANPD Dosimetry Regulation (Resolution CD/ANPD No. 4/2023)

The ANPD published its dosimetry regulation establishing the methodology for calculating administrative sanctions. Key factors:

Notable ANPD Enforcement Actions

ANPD Administrative Proceeding No. 00261.000489/2022-62 (Telekall Infoservice):

• First administrative fine imposed by the ANPD (July 2023)
• Violation: Offering a list of WhatsApp contacts for political campaign messaging without lawful basis
• Sanctions: Warning for failure to appoint a DPO; fine of R$14,400 for processing personal data without a lawful basis
• Significance: Established that even microenterprises must comply with LGPD fundamentals

ANPD Administrative Proceeding regarding INSS data sharing (2023):

• The ANPD investigated the sharing of social security benefit data by the Instituto Nacional do Seguro Social (INSS) with financial institutions
• Resulted in a recommendation to suspend data sharing until appropriate safeguards were implemented
• Significance: Demonstrated ANPD willingness to act against public administration bodies

LGPD Data Protection Impact Assessment (RIPD)

When Required

The ANPD may request a Relatório de Impacto à Proteção de Dados Pessoais (RIPD) from the controller under Art. 38. While not mandatory for every processing activity, the RIPD is strongly recommended for:

• Processing based on legitimate interest (Art. 10, §3)
• Processing of sensitive data (Art. 11)
• Processing of children's data (Art. 14)
• Automated decision-making (Art. 20)
• International data transfers (Art. 33)

RIPD Contents (Art. 38, sole paragraph)

Zenith Global Enterprises RIPD Register

Compliance Programme Implementation Checklist