Brazil's LGPD expects you to be able to show, not just claim, that you comply. Keep a record of processing operations, a data protection impact report ready on request, a published contact for your data protection officer, evidence of security measures, logs of data subject requests, and an incident notice process. This is a plain reading, not legal advice.
Where does the duty to prove come from?
Article 6 lists the principles of the law. The last one, item X, is accountability: the agent must demonstrate that it has adopted effective measures capable of proving compliance with data protection rules, including how effective those measures are. Everything below follows from that sentence. The text we read is the official Portuguese version published by the Brazilian presidency, which is the binding one. Check ANPD, the national authority, for regulations that add detail.
What goes in the binder, article by article?
Records of processing (Article 37). The controller and the operator must keep a record of the processing operations they carry out, especially when based on legitimate interest. Keep a register with purpose, data categories, legal basis, systems, recipients and retention for each operation. For software teams, tie each row to the services and databases that implement it.
Impact report (Article 38). ANPD may order the controller to produce a data protection impact report, including for sensitive data. The law says the report must contain at least a description of the data collected, the methodology used for collection and for ensuring information security, and the controller's analysis of safeguards and risk mitigation. Keep a current draft for your higher risk processing, so a request does not start a scramble.
Operator instructions (Article 39). The operator must process according to the controller's instructions, and the controller checks that. Evidence: data processing agreements, written instructions, and records of the checks.
Data protection officer (Article 41). The controller must appoint an encarregado. The person's identity and contact details must be publicly disclosed, clearly and objectively, preferably on the controller's website. The role includes accepting complaints from data subjects, receiving communications from the authority, and advising staff and contractors. The article lets ANPD set exemptions by size and volume, so check for current rules. Evidence: the appointment, the public page and a log of what the officer handled.
Security measures (Article 46). Processing agents must adopt technical and administrative measures to protect personal data from unauthorised access and from accidental or unlawful destruction, loss, alteration or disclosure, and those measures must be observed from the design phase through execution. Evidence: architecture notes, access reviews, encryption settings, testing results, and secure development records.
Incident communication (Article 48). The controller must notify the authority and the data subject of a security incident that may cause relevant risk or damage. The notice must be made in a reasonable time defined by the authority and mention at least the nature of the data affected, the data subjects involved, the technical and security measures used, the risks, the reasons for any delay, and the measures taken or to be taken. Article 48 also says that in judging severity, the authority will consider proof that appropriate measures made the data unintelligible to unauthorised third parties. Evidence: an incident runbook with a notice template that has those headings, and a record of drills.
Governance programme (Article 50). Controllers may adopt good practice and governance rules, and a privacy governance programme that, at a minimum, shows commitment to internal processes and policies and applies to all personal data under the controller's control. It is optional in form, but it is the natural home for the binder.
Data subject rights (Article 18). People may request confirmation of processing, access, correction, anonymisation or deletion, portability, information on sharing, and revocation of consent. Evidence: a request log with dates, identity checks, responses and completion.
A constructed example
A Brazilian logistics app is asked by a corporate customer for its LGPD evidence. The team sends an index: the processing register export, the DPO page link, the processor agreement template, a security overview, the incident runbook with the notice headings from Article 48, and a sample of closed rights requests with personal details removed. One folder, ten documents, a reviewer who can find each in a minute.
What to do
- Create the register of processing and name an owner for each row.
- Draft impact reports for sensitive or high risk processing.
- Appoint the encarregado and publish their contact details.
- Sign processing agreements with operators and keep the instructions.
- Document security measures from design to operation.
- Write the incident runbook around the Article 48 content list and rehearse it.
- Log every data subject request through to closure.
- Review the binder at least twice a year and after major changes.
Safeguard compliance automation can organise evidence collection for programmes like this. It does not make anyone compliant with the LGPD.
Quick check
Do I have to produce an impact report for every project?
The text lets ANPD order the controller to produce one. A prepared draft for higher risk processing makes a request easy to meet.
Where must the DPO contact be published?
The identity and contact information must be disclosed publicly, clearly and objectively, preferably on the controller's website.
Sources
Last reviewed: 18 October 2026.
