Lei Geral de Protecao de Dados Pessoais (Lei 13.709/2018)
Below is what the official text of Lei Geral de Protecao de Dados Pessoais (Lei 13.709/2018) states about whom it covers, when it applies to a business and since when. Where the pages we read do not say, the row says "not stated".
The wording shown is taken from the official page named in each row. The duties of a business and the contents of a privacy notice are in the paid checklist.
Typical situations, run through the same conditions as the check
- A for-profit business established in Brazil: Applies, or may apply: conditions to check.
- A US business with users in Brazil: Applies, or may apply: conditions to check.
- A US business with no users in Brazil: Not triggered by these answers.
Judged on 2026-10-06. Our law data was last verified on 2026-10-06; a law that took effect after that date is not in it. These situations leave other answers blank or neutral: use the check for your own.
What the official text states
| Question | What the official text states | Source |
|---|---|---|
| What it covers | The Law governs the processing of personal data, including in digital media, by natural persons or public or private legal entities, to protect the fundamental rights of freedom and privacy and the free development of the personality of natural persons.Official wordingEsta Lei dispõe sobre o tratamento de dados pessoais, inclusive nos meios digitais, por pessoa natural ou por pessoa jurídica de direito público ou privado, com o objetivo de proteger os direitos fundamentais de liberdade e de privacidade e o livre desenvolvimento da personalidade da pessoa natural. | www.planalto.gov.br read 2026-10-06 |
| When it applies to a business | The Law applies to any processing operation by a natural or legal person, regardless of the medium, the country of its headquarters or where the data are located, provided the operation is carried out in Brazil, or the activity aims to offer goods or services to, or process data of, individuals located in Brazil (or the data were collected in Brazil). Conditions to check: Art. 3 has three alternative triggers: (I) the processing operation is carried out in Brazil, (II) the activity aims to offer goods or services or process data of individuals located in Brazil, (III) the data were collected in Brazil (art. 3 para 1: the subject is in Brazil at collection). We test only the users-in-Brazil trigger; processing carried out in Brazil is not captured. The art. 4 exclusions (e.g. purely personal use, journalism, public security) apply. Smaller-business relief by ANPD regulation was not read. Official wordingindependentemente do meio, do país de sua sede ou do país onde estejam localizados os dados, desde que: I - a operação de tratamento seja realizada no território nacional; II - a atividade de tratamento tenha por objetivo a oferta ou o fornecimento de bens ou serviços ou o tratamento de dados de indivíduos localizados no território nacional; | www.planalto.gov.br read 2026-10-06 |
| In force from | Not stated on the official pages we read. Art. 65 says the Law enters into force 24 months after its publication (and 1 Aug 2021 for arts. 52-54) but the publication date is not in the text we read, so no date can be stated from it. | — |
| Privacy notice | Included in the paid checklist. See the checklist | — |
| Consent and opt-out | Included in the paid checklist. See the checklist | — |
| Rights of individuals | Included in the paid checklist. See the checklist | — |
| Data protection officer | Included in the paid checklist. See the checklist | — |
| Breach notification | Included in the paid checklist. See the checklist | — |
| What the privacy notice must contain | Included in the paid checklist. See the checklist | — |
What we do not cover
These areas are outside this site, so nothing on this page says anything about them:
- Privacy laws for particular sectors (for example health care, banking and credit, education)
- Rules specific to children's online privacy
- Cookie and electronic-communications rules (including consent for cookies and marketing messages)
- Employee, job applicant and contractor data
- Rules on sending personal data to other countries
- US state data-breach notification laws (a separate set of state laws)
- US state privacy laws that are not yet in force, and state laws on particular topics (for example biometric or health data)
- Privacy laws of countries that are not listed here
- Planned changes to the laws listed here