The General Data Protection Law (Law No. 13.709/2018) regulates the processing of personal data in Brazil. Privacy Tools It was built to comply with the LGPD (Brazilian General Data Protection Law): mapping, legal bases, data subjects, incidents, and evidence all in one environment.
The LGPD applies to any processing of personal data carried out in Brazil, or that aims to offer goods and services to people in the country, by private companies and the public sector. Official source: text of the law in the Planalto e ANPD resolutions.
The main obligations of the law are:
What the law and ANPD resolutions define for your organization:
The platform was created in 2019 to comply with the LGPD (Brazilian General Data Protection Law) and organizes each obligation into a module: the Data Mapping It inventories the activities and generates the ROPA; Management of Holders' Requests and Privacy Portal They attend to the account holders within the deadline; Incident Management This leads to communication with the ANPD (National Data Protection Authority).
A Consent Management and Cookie Management and Policies They record the legal bases; Diagnoses and Assessments They produce RIPD and LIA; Third Party Risk Management It evaluates the operators. Everything is documented with an audit trail to verify compliance.
Data Mapping and ROPA as per article 37
Holders' requests with a controlled 15-day deadline
Incidents with notification to the ANPD within 3 business days.
Consent and cookies with registration and revocation
RIPD and diagnostics based on a linked legal basis
The General Data Protection Law (Law No. 13.709/2018) is the Brazilian law that regulates the processing of personal data by companies and the public sector. It defines legal bases, rights of data subjects, duties of controllers and processors, and the sanctions applied by the ANPD (National Data Protection Authority).
Yes. The law applies to any organization that processes personal data, regardless of size. Small businesses (micro-enterprises, startups, and individuals) have simplified obligations, defined by Resolution CD/ANPD No. 2/2022, such as double the time to respond to data subjects and exemption from full registration.
Confirmation of processing and access to data must be provided immediately, in a simplified format, or within 15 days with a complete declaration (art. 19). The platform monitors this timeframe for each request, with protocol, authentication of the applicant, and recording of responses.
The ANPD (National Data Protection Authority) can apply warnings, simple fines of up to 2% of the group's revenue in Brazil, limited to R$ 50 million per infraction, daily fines, public disclosure of the infraction, blocking or deletion of data, and suspension or prohibition of processing (art. 52). The sanctions have been applicable since August 2021.
The controller must appoint a data protection officer (art. 41), responsible for responding to data subjects and the ANPD. Resolution CD/ANPD No. 18/2024 details the role and waives the appointment for small data controllers, who need to maintain a communication channel with data subjects.
Speak with one of our specialists and see how the platform addresses each article of the law within your organization's context.
