LGPD Compliance: A Practical Checklist for Companies

LGPD compliance is the process of aligning how your company collects, uses, stores and disposes of personal data with the rules of Law No. 13,709/2018, Brazil's General Data Protection Law (LGPD). In practice it comes down to four moves: knowing what data you hold, justifying each processing activity with a legal basis, appointing someone accountable for the topic and being ready to react to incidents and to data subject requests.

The problem is that many organisations still treat this as a fixed-term project, with spreadsheets scattered across legal, IT and security. When an incident happens or the ANPD comes knocking, traceability is missing. This checklist turns the law's obligations into concrete steps, from data mapping to incident notification, and shows where privacy connects to your risk programme.

Digital padlock over a keyboard symbolising data security and cyber protection

Overview of LGPD obligations for companies operating in Brazil

The LGPD applies to any organisation, public or private and of any size or sector, that processes personal data in Brazil, offers goods or services to individuals located in the country or processes data collected there (Art. 3), with narrow exceptions set out in Art. 4. It defines roles (controller, processor and data protection officer, called encarregado in the law), requires a legal basis for all processing and grants data subjects rights such as access to, correction and deletion of their data (Art. 18).

The cost of ignoring these obligations has grown. According to IBM's Cost of a Data Breach report, the average cost of a data breach in Brazil reached R$ 7.19 million in 2025, up 6.5% from R$ 6.75 million in 2024, as announced by IBM. The same study shows that healthcare recorded the highest average cost, R$ 11.43 million, followed by finance (R$ 8.92 million) and services (R$ 8.51 million). For the board, this is the direct translation of technical risk into financial impact.

The main obligations a company needs to be able to demonstrate are:

A legal basis for each processing activity, among the ten listed in Art. 7.
Transparency about purposes and data sharing.
Handling data subject rights within the statutory deadlines — a full access statement, for example, must be provided within 15 days (Art. 19).
Records of processing activities (Art. 37).
Appointment of a data protection officer and publication of their contact details (Art. 41).
Incident response, with notification to the ANPD and data subjects when there is relevant risk or harm (Art. 48).

LGPD compliance checklist: data mapping, legal bases and DPO

The path to LGPD compliance starts with visibility and ends with governance. Use this checklist as a working sequence, not as a list to tick once and forget.

1. Map your data (data mapping)

Identify every personal data flow: what you collect, from whom, for what purpose, where you store it, who you share it with and how long you keep it. This inventory feeds the record of processing activities required by Art. 37 and is the basis for the Data Protection Impact Assessment (RIPD, in Portuguese), which the ANPD may require (Art. 38).

2. Define the legal basis for each processing activity

No personal data may be processed without one of the ten legal bases in Art. 7; for sensitive data, the narrower grounds in Art. 11 apply. In a corporate setting, the most frequent are consent, performance of a contract, compliance with a legal obligation and legitimate interest. Document the basis chosen for each purpose: that justification is what you will present during an inspection.

3. Appoint a data protection officer (DPO)

The law requires the controller to appoint a data protection officer, with their identity and contact details published (Art. 41). The DPO handles data subjects, liaises with the ANPD and advises the organisation. The ANPD has already opened inspections of large companies that did not disclose their DPO's contact details or kept ineffective service channels, so this is not an optional formality.

4. Update contracts and third parties

Processors and suppliers that access personal data need contractual clauses that allocate responsibilities and require minimum security standards. Third-party risk management is part of compliance, not an appendix.

5. Implement security and governance controls

Encryption, access control, logging and internal policies underpin the LGPD's security principle. The economics reinforce the priority: the same IBM report shows that only 29% of the organisations studied in Brazil use AI governance technology, and that those making extensive use of security AI and automation had an average breach cost of R$ 6.48 million, about 26% lower than those not using these technologies (R$ 8.78 million).

Digital circuit with a padlock icon representing encryption and data compliance

How to handle incidents and notify the ANPD on time

When a security incident involving personal data occurs, the clock starts ticking. Under Resolution CD/ANPD No. 15/2024, the ANPD and the affected data subjects must be notified within 3 business days of the controller becoming aware that the incident affected personal data (Arts. 6 and 9), unless specific legislation sets a different deadline, according to the official guidance published by the ANPD. Small processing agents get twice the time, (Resolution CD/ANPD No. 2/2022, Art. 14, II, as amended by Resolution CD/ANPD No. 15/2024). The original wording of that item carried an exception for cases with potential harm to the physical or moral integrity of data subjects or to national security; Resolution 15/2024 removed it.

The duty to notify arises when three criteria are met together: the incident is confirmed, it involves personal data covered by the LGPD and it may result in relevant risk or harm to data subjects. The notice to data subjects must use plain language and state the nature of the data affected, the security measures in place, the risks involved and the contacts for further information.

A lean response workflow usually follows these steps:

Detect and contain the incident, preserving evidence.
Assess the risk to data subjects to decide whether notification is mandatory.
Notify the ANPD and data subjects within the 3-business-day deadline.
Document everything, from the timeline to the mitigation actions.
Supplement the information: if the initial notice was preliminary, the supplement must be sent to the ANPD within 20 business days.

The difference between a calm response and a crisis usually lies in the preparation done before the incident: defined roles, a ready playbook and evidence already organised.

Integrating privacy into the risk and compliance programme

LGPD compliance pays off more when it stops being a legal silo and starts talking to the corporate risk programme. Many of the controls you implement for the LGPD, such as access management, encryption and incident response, are also required by ISO 27001, SOC 2 and the NIST CSF. Keeping separate inventories per standard creates rework and traceability gaps.

That is precisely the logic of a single control inventory: each control is implemented once and reused across frameworks, with evidence linked to the risk it mitigates. It is the model Futture applies in Eagle, its Enterprise Risk Intelligence platform, connecting risk, controls, suppliers and exposure in a single view, with decisions always left to people. If you are structuring the topic with the help of technology, it is worth reading how to choose an AI compliance tool in Brazil.

In practice, integrating privacy into risk means:

Ranking data processing activities by risk criticality, not by order of arrival.
Reusing audit evidence across the LGPD, ISO 27001 and SOC 2.
Giving the board a view of exposure in business language, with financial impact.
Monitoring continuously, instead of reviewing compliance only on the eve of the audit.

Common mistakes that lead to sanctions and how to avoid them

Most non-conformities do not come from bad faith but from operational gaps that pile up. The most frequent mistakes can be avoided with process discipline.

Treating compliance as a one-off project. Compliance is continuous; data, suppliers and purposes change all the time.
Collecting data without a clear legal basis. Asking for consent when the correct basis would be a contract or a legal obligation creates legal fragility.
Not having an effective DPO. Appointing someone on paper only, with no channel for data subjects, does not comply with the law.
Ignoring the notification deadline. Missing the 3 business days set by Resolution CD/ANPD No. 15/2024 increases your exposure before the ANPD.
Forgetting third parties. Suppliers with access to data but without adequate clauses transfer risk to the controller.
Not documenting. Without evidence that a control exists and works, compliance cannot be defended in an inspection.

Avoiding these mistakes depends less on a magic tool and more on traceability: every processing decision, every control and every piece of evidence needs an owner, a date and a justification.

Next step

Pick a single critical data flow, such as customer onboarding or payroll, and run the whole checklist on it this week: map the data, confirm the legal basis, check who is accountable for the processing and test whether you could notify the ANPD within 3 business days. This pilot reveals where your real gaps are and gives you the template for extending compliance to the rest of the organisation without relying on isolated spreadsheets.

Further reading: ANPD regulations: a map of what your company must comply with.

Frequently asked questions

What does LGPD compliance mean in practice?

It means putting processes, documentation and controls in place to handle personal data in line with Law No. 13,709/2018, Brazil's General Data Protection Law: mapping the data, defining a legal basis for each processing activity, appointing a data protection officer (encarregado) and being able to respond to incidents and to data subject requests.

What is the deadline for notifying the ANPD after a security incident?

Under ANPD Board Resolution No. 15/2024 (Resolução CD/ANPD nº 15/2024), the ANPD and the affected data subjects must be notified within 3 business days of the controller becoming aware that the incident affected personal data, whenever the incident may result in relevant risk or harm to data subjects. Small processing agents get twice the time (Resolution CD/ANPD No. 2/2022, Art. 14, II, as amended by Resolution CD/ANPD No. 15/2024).

Does every company need a data protection officer (DPO)?

The LGPD requires the controller to appoint a data protection officer (encarregado) and to publish their identity and contact details (Art. 41). Resolution CD/ANPD No. 2/2022 exempts small processing agents from this appointment, provided they keep a communication channel open to data subjects; the exemption does not apply, for example, to agents carrying out high-risk processing or exceeding the regulation's revenue thresholds.

Which legal bases do companies use most often?

Of the ten legal bases listed in Art. 7, the most common in a corporate setting are consent, performance of a contract, compliance with a legal obligation and the controller's legitimate interest.