What to account for
Check scope and the transparency notice
LGPD Article 3 covers processing linked to Brazil. Article 9 requires purposes, duration, controller contact, sharing and rights.
Make rights usable
ANPD describes rights including confirmation, access, correction and relevant deletion or anonymization requests. Provide a working contact and a process that can reach the systems holding the data.
Review overseas processing
ANPD Resolution 19/2024 regulates international transfers, including approved contractual mechanisms. Map foreign hosting and vendors before choosing and documenting the applicable transfer route.
Common mistakes to check
Using consent as the answer to every purpose
Article 7 provides several legal bases; consent is one of them. Match each purpose to an applicable basis rather than treating a banner as the basis for every operation.
Promising unconditional immediate deletion
ANPD explains that deletion rights have conditions, including legal retention exceptions. Describe an accurate request process and explain applicable retention instead of promising an impossible result.
Your review checklist
Our suggested review process. The linked requirements above explain the platform or legal basis.
Map the service’s connection to Brazil
Record where people use the service, where data are collected, and which company controls the processing. List forms, cookies, SDKs and back-office providers in one inventory.
Complete the decisions behind the notice
For each purpose, confirm data categories, legal basis, recipients, retention and transfer safeguards. Assign someone to maintain the rights contact and respond to requests.
Review language and actual controls
Review the draft with the people responsible for privacy. Prepare visitor-facing wording in the language your Brazilian audience understands and test request and consent flows before publication.
Example
A subscription service serving Brazil
A fictional service uses account forms, payment processing, support software and hosting outside Brazil. Its team maps each data flow and asks the responsible reviewer to confirm bases and transfers.
A notice connected to operations
The team reviews the generated draft, adds verified retention and contact details, and tests an access request across its tools. It schedules a review whenever a provider changes.
Questions before publishing
Can LGPD apply to a company outside Brazil?
Yes. Article 3 uses processing, offering goods or services, and collection connections to Brazil; company location alone does not decide scope.
Must there be a way to request access?
Access is among the rights described by ANPD. Make the contact and handling process work for the data your service holds.
Is mentioning a foreign vendor enough?
No. Review the applicable international-transfer mechanism as well as transparency. ANPD’s transfer regulation addresses these mechanisms.
Source review and changes
First edition: platform requirements, implementation checks and fictional worked example. Sources reviewed on the date above; verify changes before relying on them.