Brazil

The privacy law is Lei nº 13.709/2018, known as the LGPD. Article 3 applies it whatever the medium, whatever country your head office is in, and wherever the data sits. The internet law is Marco Civil da Internet (Lei nº 12.965/2014). Its article 11 extends Brazilian law to foreign-based companies that offer services to the Brazilian public. It also covers foreign companies with a group company established in Brazil. Lei nº 15.211/2025, the children's digital statute, article 40, makes providers keep a legal representative in Brazil who can accept court papers. Decreto nº 12.975/2026, article 16-A(I), goes further. Providers of internet applications must set up and keep a head office in Brazil. They must also keep a legal representative there, able to answer to regulators and to courts. That means an office, not just an agent. The LGPD does require every company that decides how data is used to name a data protection officer, called the encarregado. It does not say that person must be in Brazil.

Checked industry by industry on 18 August 2026: • BANKING AND PAYMENTS. Conditional, and the tightest industry. Under Resolução CMN nº 4.893/2021, a supervised institution may have data handled and stored abroad. But the arrangement must not restrict the Banco Central's access to that data. The central bank must also be able to work with the supervisor in the host country. You must give the Banco Central notice first. The result is that only some countries work, even though the rules never list them. Marked medium confidence. See the unconfirmed list. • INSURANCE. We found no rule about where data must be stored, checked 18 August 2026. SUSEP's cybersecurity and outsourcing circulars copy the central bank's access-and-audit approach. They do not require Brazilian storage. Confidence medium. We could not open SUSEP's own pages. • SECURITIES. We found no rule about where data must be stored, checked 18 August 2026. Confidence medium. • HEALTH. We found no rule about where data must be stored, checked 18 August 2026. What binds doctors and clinics is professional secrecy, not geography. • TELECOMS. No rule about where data must be stored. Anatel's cybersecurity regulation, called R-Ciber, sets security and incident duties. It says nothing about storage location. But the Marco Civil applies Brazilian law to any collection, storage or use of data where at least one step happens in Brazil. It also sets minimum log-keeping periods. • GOVERNMENT CLOUD. Open. Decreto nº 8.135/2013 pushed federal communications data onto systems run by federal bodies. Decreto nº 9.637/2018 revoked it. The current federal cloud contracting model is Portaria SGD/MGI nº 5.950/2023. It sorts workloads by how sensitive they are and by how well they are isolated, physically and logically. It does not sort them by which country the servers are in. • MAPPING AND AERIAL SURVEY. Restricted, but the limit is on the activity, not on storage. The armed forces control aerial surveying of Brazilian territory. A foreign organisation may take part only in exceptional cases. • EDUCATION, GAMING, DEFENCE. We found no separate rule about where data must be stored, checked 18 August 2026.

Resolução CD/ANPD nº 19, de 23 de agosto de 2024, sets five routes. One: an official decision that a country is safe enough. Two: the Brazilian standard contract clauses, which are fixed text you may not change. Three: a foreign set of clauses formally recognised as equivalent. Four: tailor-made clauses, which need the regulator's approval first and are meant for rare cases. Five: global corporate rules for a group of companies. Existing contracts had twelve months from publication to catch up. That deadline was 23 August 2025. The safe-country list has exactly one entry. Resolução nº 32/2026, of 26 January 2026, recognised the European Union as an international organisation that is safe enough. The regulator's own guidance says transfers to a safe destination can happen with no extra paperwork. No other country has been recognised. No tailor-made clauses and no global corporate rules had been approved when we checked. The law itself has a few narrow escape routes. The person's specific consent to the transfer. Protecting someone's life. International legal cooperation. These still work, but they are not built for routine or bulk transfers.

The Autoridade Nacional de Proteção de Dados, or ANPD, is now a special-status independent agency. Lei nº 15.352, de 25 de fevereiro de 2026, confirmed that. It has autonomy over its functions, its technical work, its decisions, its administration and its money. The same law created 200 specialist posts by converting 797 empty administrative posts, at no extra cost. Here is what it has actually done. On 12 August 2026 it issued a preventive order against Discord under the children's digital statute. Discord had three business days to switch off the 'Go Live' feature and similar video sharing. The reason was a failure to stop minors seeing self-harm and suicide content. Decretos nº 12.975 and nº 12.976, both of 20 May 2026, added powers to regulate platforms, supervise them and penalise breaches of user rights. One quirk is worth knowing. The authority's website and social media run in restricted mode until the October 2026 general elections end. That makes some material harder to find. It does not pause enforcement. We rate it active rather than aggressive. Fines are still few. The loudest actions so far are orders to stop doing something, not large fines.

Minimums. Marco Civil da Internet article 13: internet connection providers keep connection records for one year, under secrecy, in a controlled and secure place. Article 15: internet application providers that are set up as companies keep application access records for six months. Tax: the Código Tributário Nacional works on a five-year window. Article 150 fixes five years for confirming a return. The time limits for assessment and collection in articles 173 and 174 run on the same five-year scale. So five years is the working minimum for books and tax records. Maximums. LGPD article 16 says personal data must be deleted once you have finished using it. It gives four exceptions. Meeting a legal or regulatory duty. Research, with data anonymised where possible. Passing data to a third party on the same terms. And your own exclusive use of the data in anonymised form. Where a keep-it rule and a delete-it rule clash, the first exception is the answer. A legal duty to keep data lets you hold it past the point where your original purpose ended. It does not let you use it for anything else.

Clock one: personal data breach. Resolução CD/ANPD nº 15, de 24 de abril de 2024, gives you three working days to tell the regulator. Three things must all be true first. The incident is confirmed. It involves personal data covered by the privacy law. And it could cause real risk or harm to the people affected. The same three-working-day deadline applies to telling those people. Use plain language. Tell them individually where you can. Your notice must state several things. The kinds of data affected. The security measures in place. The risks you found. The reason for any delay. What you did to limit the damage. The date you found the incident. And a contact point. The regulator can demand a copy of what you sent people at any time. Clock two: intimate content shared without consent. Decreto nº 12.976/2026 requires removal within two hours of being told. Clock three: industry rules. Banks report incidents to the Banco Central under the cyber security and cloud resolution. Telecoms operators report to Anatel under the R-Ciber regulation. Both run separately with their own deadlines. We did not verify the exact hour counts for those two. Two things to get right. The privacy clock is not the only clock. And it starts when you confirm the breach, not when the report reaches your legal team.

(1) Resolução CD/ANPD nº 19/2024 makes the Brazilian standard contract clauses fixed text. A foreign set of clauses works only where formally recognised as equivalent. Tailor-made wording needs approval first. Old contracts had twelve months from 23 August 2024 to catch up. That window closed on 23 August 2025. (2) Lei nº 15.211/2025 article 9 bans letting users declare their own age. Article 24 requires accounts of users up to 16 to be linked to a parent's or guardian's account. Article 22 bans profiling to target ads at children and adolescents. It also bans emotional analysis, augmented reality, extended reality and virtual reality for ad targeting. Article 26 bans building behaviour profiles of child and adolescent users, including from data collected to check their age. Article 7 requires products to run by default at the highest level of protection available. (3) Decreto nº 12.975/2026 article 16-A(I) requires an office and a legal representative, able to answer to regulators and to courts. It took effect sixty days after publication on 21 May 2026. (4) Marco Civil article 12 allows a fine of up to 10 percent of the group's Brazilian revenue in its last financial year, before tax. It also allows the activity to be suspended or banned. The children's digital statute, article 35(II), uses the same 10 percent of Brazilian group revenue. Where there is no revenue, it charges between 10 and 1,000 reais per registered user, capped at 50 million reais per breach. The privacy law's own cap is 2 percent of Brazilian revenue, capped at 50 million reais per breach. That is the smallest of the three. (5) LGPD article 52 gives the regulator several powers. It can block the personal data or delete it. It can suspend the database in part or in full. It can suspend your use of the data, and ban that use in part or in full. The Discord order of August 2026 shows how this is used.

Timeline. March 2026: the children's digital statute came into force and the regulator began watching app stores and operating systems. August 2026: the watching widened and the final guidance was published. January 2027: full enforcement begins. October 2026: general elections, during which the regulator's own site and social media run restricted. Powers the authority already holds. These matter more than the bills waiting in Congress: • The safe-country list. It was empty until January 2026 and now holds exactly one entry, the European Union. The authority can add destinations, and it can remove one, by resolution. Removing one would force thousands of contracts back onto standard clauses overnight. • Approving tailor-made contract clauses and global corporate rules is entirely up to the authority. None had been granted when we checked. • The authority has 200 new specialist posts and full control of its own budget from February 2026. The amount of enforcement can rise sharply with no change in the law. • The children's statute lets the authority set the detailed rules itself, including how age must be checked. Waiting, not binding: the artificial intelligence bill, PL 2338/2023, reached the Chamber of Deputies on 17 March 2025. On 17 June 2026 it was recorded as awaiting a committee opinion, with related bills attached to it.