border.bot
Esc
  • Loading…
↑ ↓ to move↵ to openEsc to close
Docs menu
DevelopersGuides

HS codes

Origin and trade agreements

LGPD for foreign online stores

When Brazil's LGPD applies to a store outside Brazil, the legal bases, buyer rights, the 3-business-day breach notice, data transfers and the fines.

Updated · 3 official sources

Brazil's General Data Protection Law (Lei Geral de Proteção de Dados, LGPD, Law 13.709 of 2018) applies to a store outside Brazil whenever it offers goods to people in Brazil or processes data collected while they were in Brazil, wherever the store is based. A foreign seller shipping to Brazilian buyers is inside its scope; the Brazil import guide covers the customs side.

Rules as of 30 October 2026.

When does the LGPD apply to a foreign store?#

Under article 3, the LGPD applies to processing by anyone, wherever they're based, that takes place in Brazil, aims to offer goods or services to people in Brazil, or uses data collected in Brazil. Data counts as collected in Brazil when the person was there at the time, so a checkout used in São Paulo is covered.

Brazil's regulator is the ANPD, now named the National Data Protection Agency in the text as amended by Law 15.352 of 2026. It enforces the law, writes the regulations that fill in its details, and published an updated English translation of the LGPD in October 2026.

The LGPD lets a store process personal data only on one of ten legal bases in article 7. For a store, the ones that matter are performing a contract with the buyer, meeting a legal obligation, legitimate interests, protecting credit, and consent. Each processing activity needs one.

Shipping an order, taking payment and filing customs data rest on the contract and on legal obligations, so they don't need consent. Marketing emails and non-essential tracking are where stores most often fall back on consent. Where you rely on consent, it must be given in writing or another way you can prove, for specific purposes, with any written consent clause standing out from the rest of the terms; generic authorizations are void. Data about children needs specific consent from a parent or legal guardian.

What rights do Brazilian buyers have?#

Brazilian buyers can ask a store at any time to confirm that it processes their data, to see it, to correct it, and to delete or anonymize data that is excessive or processed unlawfully. They can also ask for portability, for deletion of data processed on consent, and for a list of the companies their data was shared with.

A request for confirmation or access can be answered at once in a simple format, or with a full statement of where the data came from, the criteria used and the purpose, within 15 days of the request. Build the request route into your privacy notice and your support process before you launch in Brazil.

Do you need a data protection officer?#

The LGPD requires a controller to appoint a data protection officer (encarregado) who receives complaints from data subjects and communications from the ANPD, and to publish that person's identity and contact details, preferably on its website. The ANPD may waive the requirement depending on the nature and size of the organization.

Name the officer in a Portuguese version of your privacy notice, with a contact address that Brazilian buyers and the ANPD can use.

What happens after a data breach?#

A store must notify the ANPD and the affected people of a security incident that may cause them relevant risk or damage. Under ANPD Resolution 15 of 24 April 2024, the notice is due within three business days. A first notice can be preliminary, with the rest supplied within 20 business days, if the reasons are justified.

The notice must describe the data and people affected, the security measures used, the risks, the reasons for any delay, and what you are doing to reverse or limit the damage. The ANPD can order further steps, such as full disclosure of the incident in the media.

Can you store Brazilian data abroad?#

International transfers of personal data are allowed under article 33 of the LGPD only on listed grounds: a country with adequate protection, safeguards the controller can demonstrate (specific or standard contractual clauses, binding corporate rules, or certified seals and codes), and a few other cases.

Those other cases include the buyer's specific consent to the transfer and transfers needed to perform the contract. For a store whose servers, payment provider and email platform sit outside Brazil, the usual route is contractual clauses with each provider. The EU GDPR guide covers the European side for stores that sell in both, and the country guides cover other markets.

What are the penalties?#

The ANPD can warn an organization, publish the infraction, block or delete the data, suspend the database or the processing, and fine it. A simple fine is up to 2% of the company's or group's gross revenue in Brazil in its previous fiscal year, net of taxes, capped at R$50 million per infraction.

Daily fines count toward the same cap, and the ANPD's power to sanction has applied since 1 August 2021.

What changed and when#

The LGPD's main rules have stood since 2020, but the ANPD has filled in details by regulation, such as the deadline for breach notices, and Law 15.352 of 2026 amended the provisions on the authority itself. The timeline lists the dated changes with links to the official text.

  1. Updated English text of the LGPD

    The ANPD publishes English and Spanish versions of the LGPD as amended by Law 15.352 of 2026. ANPD news, 28 October 2026 (opens in a new tab)

  2. Breach notice deadline set

    ANPD Resolution 15 sets three business days to notify the ANPD and affected people of a security incident. ANPD, communication of security incidents (opens in a new tab)

Common questions#

Does the LGPD apply if my company isn't in Brazil?#

Yes. The LGPD applies wherever the company is based if it offers goods or services to people in Brazil or processes data collected in Brazil.

How is the LGPD different from the GDPR?#

Both reach foreign companies that target people in their territory. On the LGPD side, note the ten legal bases, including protection of credit, fines capped at R$50 million per infraction, and the three-business-day deadline for breach notices.

No. Processing needed to fulfil the buyer's order rests on the contract, and customs and tax records on legal obligations. Marketing that relies on consent needs consent that is specific and provable.

Sources#