Brazil

Lei nº 13.709/2018 (LGPD) art. 3 applies 'independentemente do meio, do país de sua sede ou do país onde estejam localizados os dados'. Marco Civil da Internet (Lei nº 12.965/2014) art. 11 §2 extends Brazilian law to foreign-seated companies that offer services to the Brazilian public or that have a group company established in Brazil. Lei nº 15.211/2025 (ECA Digital) art. 40 requires providers to 'manter representante legal no País com poderes para receber citações'. Decreto nº 12.975/2026 art. 16-A(I) goes further and requires providers of internet applications to 'constituir e manter sede e representante legal no País, com poderes para responder perante as esferas administrativa e judicial' — an office, not only an agent. The LGPD does require every controller to name a data protection officer (encarregado), but does not say that person must be in Brazil.

Sector by sector, checked 18 August 2026: • BANKING AND PAYMENTS — conditional, and the tightest sector. Under Resolução CMN nº 4.893/2021, a supervised institution may have data processed and stored abroad, but only where the arrangement does not restrict the Banco Central's access to the data, and the central bank must be able to work with the supervisor in the host country. Prior notice to the Banco Central is required. Effect: a country allowlist in practice, without ever using that word. Marked medium confidence — see 'unconfirmed'. • INSURANCE — no localisation rule located, checked 18 August 2026. SUSEP's cybersecurity and outsourcing circulars mirror the central bank's access-and-audit approach rather than requiring Brazilian storage. Confidence medium; SUSEP's own pages could not be opened during this run. • SECURITIES — no localisation rule located, checked 18 August 2026. Confidence medium. • HEALTH — no localisation rule located, checked 18 August 2026. The binding constraint is professional secrecy for doctors and clinics rather than geography. • TELECOMS — no localisation rule. Anatel's cybersecurity regulation (R-Ciber) sets security and incident duties, not storage location. But the Marco Civil pins Brazilian law onto any collection, storage or processing where at least one step happens in Brazil, and sets minimum log-keeping periods. • GOVERNMENT CLOUD — open, and this is the finding most trackers get wrong. Decreto nº 8.135/2013, which pushed federal communications data onto systems run by federal bodies, was revoked by Decreto nº 9.637/2018. The current federal cloud contracting model, Portaria SGD/MGI nº 5.950/2023, sorts workloads by how sensitive they are and by logical and physical isolation — not by which country the servers are in. • MAPPING AND AERIAL SURVEY — restricted, but as an activity rather than as storage. Aerial surveying of Brazilian territory is controlled by the armed forces, and a foreign organisation may only take part exceptionally. • EDUCATION, GAMING, DEFENCE — no separate localisation rule located, checked 18 August 2026.

Resolução CD/ANPD nº 19, de 23 de agosto de 2024, sets five mechanisms: adequacy decisions; the Brazilian standard contractual clauses, which are fixed and may not be modified; foreign clause sets formally recognised as equivalent; bespoke specific clauses, which need the regulator's prior approval and are meant for exceptional cases; and global corporate rules for a group of companies. Existing contracts had twelve months from publication to be brought into line — that is 23 August 2025. The adequacy list is populated, but with exactly one entry: Resolução nº 32/2026, of 26 January 2026, recognised the European Union as an adequate international organisation, and the regulator's own guidance is that transfers to an adequate destination 'podem ocorrer sem a necessidade de mecanismos adicionais'. No other adequacy decision, no specific clause set and no global corporate rules had been approved as at this check. The narrow escape hatches in the Act itself — the person's specific consent to the transfer, protection of someone's life, international legal cooperation — remain available but are not built for routine or bulk transfers.

The Autoridade Nacional de Proteção de Dados (ANPD) was confirmed as an autarquia de natureza especial with functional, technical, decision-making, administrative and financial autonomy by Lei nº 15.352, de 25 de fevereiro de 2026, which also created 200 specialist posts by converting 797 vacant administrative posts, at no extra cost. Observable enforcement, not text: on 12 August 2026 the authority issued a preventive measure against Discord under the ECA Digital, giving three business days to suspend the 'Go Live' feature and equivalent video-sharing, over failures to prevent minors being exposed to self-harm and suicide content. Decretos nº 12.975 and nº 12.976, both of 20 May 2026, added platform regulation, supervision and infringement powers over user rights. One quirk worth knowing: the authority's own website and social media are running in restricted mode until the end of the October 2026 general elections, which makes some material harder to find but does not pause enforcement. Rated active rather than aggressive: fines are still relatively few, and the loudest actions so far are orders to stop doing something rather than large financial penalties.

Floor. Marco Civil da Internet art. 13: connection records kept under secrecy, in a controlled and secure environment, 'pelo prazo de 1 (um) ano'. Art. 15: internet application providers organised as companies keep application access records 'pelo prazo de 6 (seis) meses'. Tax: the Código Tributário Nacional works on a five-year window — art. 150 §4 fixes five years for homologation, and the assessment and collection limitation periods in arts. 173 and 174 run on the same five-year scale, so five years is the practical floor for books and fiscal records. Ceiling. LGPD art. 16: 'Os dados pessoais serão eliminados após o término de seu tratamento', with four carve-outs — compliance with a legal or regulatory obligation, research with anonymisation where possible, transfer to a third party on the same terms, and the controller's own exclusive use in anonymised form. Conflict resolution: the first carve-out is the express answer. A statutory retention duty is a lawful reason to keep data past the point where the original purpose ended, but it does not licence keeping it for anything else.

Clock one — personal data breach. Resolução CD/ANPD nº 15, de 24 de abril de 2024: 'a comunicação à ANPD ... deverá ser realizada pelo controlador no prazo de três (3) dias úteis'. Three cumulative triggers: the incident is confirmed, it involves personal data covered by the privacy law, and it is 'capaz de acarretar risco ou dano relevante aos titulares'. The same three-working-day deadline applies to telling the individuals, in plain language, individually where possible, and the notice must state the categories of data affected, the security measures in place, the risks identified, the reason for any delay, the mitigation taken, the date the incident was discovered and a contact point. The regulator may demand a copy of what you sent people at any time. Clock two — non-consensual intimate content. Decreto nº 12.976/2026 requires removal 'em até duas horas após a notificação'. Clock three — sectoral. Banking incident reporting to the Banco Central under the cyber security and cloud resolution, and telecoms incident reporting to Anatel under the R-Ciber regulation, run separately with their own deadlines; the exact hour counts for these two were not verified in this run. The common failure mode is treating the privacy clock as the only clock, and starting it from the day the report lands on the legal team's desk rather than from confirmation.

(1) Resolução CD/ANPD nº 19/2024 makes the Brazilian standard contractual clauses non-negotiable text. Foreign clause sets only work where formally recognised as equivalent; bespoke wording needs prior approval. Twelve-month retrofit window from 23 August 2024 expired 23 August 2025. (2) Lei nº 15.211/2025 art. 9 §1 bans self-declared age ('vedada a autodeclaração'); art. 24 requires accounts of users up to 16 to be linked to a parent or guardian's account; art. 22 bans profiling to target advertising at children and adolescents, and bans emotional analysis, augmented reality, extended reality and virtual reality for ad targeting; art. 26 bans building behavioural profiles of child and adolescent users, including from the data collected to verify their age. Art. 7 §1 requires products to run by default at the highest available level of protection. (3) Decreto nº 12.975/2026 art. 16-A(I): office and legal representative, with authority to answer administratively and judicially. In force sixty days after publication on 21 May 2026. (4) Marco Civil art. 12: 'Multa de até 10% (dez por cento) do faturamento do grupo econômico no Brasil no seu último exercício, excluídos os tributos', plus temporary suspension or prohibition of the activities. The ECA Digital art. 35(II) uses the same 10 percent of Brazilian group revenue, or where there is no revenue, between 10 and 1,000 reais per registered user, capped at 50 million reais per infringement. The LGPD's own cap is 2 percent of Brazilian revenue capped at 50 million reais per infringement — the smallest of the three. (5) LGPD art. 52 sanctions include blocking the personal data concerned, deleting it, partial or total suspension of the database, suspension of the processing activity and partial or total prohibition of processing. The Discord order of August 2026 is the live example of how this is used.

Timeline. March 2026: the children's digital statute came into force and the regulator began monitoring app stores and operating systems. August 2026: monitoring widened and the final regulatory guidance was published. January 2027: full enforcement action begins. October 2026: general elections, during which the regulator's own site and social media run restricted. Dormant switches, which matter more than the pending bills: • The adequacy list. It was empty until January 2026 and now holds exactly one entry, the European Union. The authority can add destinations, and it can withdraw one, by resolution. A withdrawal would instantly require thousands of contracts to fall back on standard clauses. • Approval of specific contractual clauses and of global corporate rules is entirely at the authority's discretion, and none had been granted at this check. • The authority now has 200 new specialist posts and full budget autonomy from February 2026. Enforcement volume can rise sharply without any change in the law. • The children's statute lets the authority set the detailed rules by regulation, including how age must be checked. Pending, not binding: the artificial intelligence bill (PL 2338/2023, which reached the Chamber of Deputies on 17 March 2025) was recorded as 'Aguardando Parecer' — awaiting a committee opinion — on 17 June 2026, with related bills attached to it.