To implement Brazil's LGPD (Law 13.709/2018), a software company maps the personal data it handles, picks a legal basis for each use, keeps records of processing, names a data protection officer, secures the data, and prepares to notify the regulator and affected people after an incident. Do the mapping first; everything else hangs on it.
This is an explanation of the law's text, not legal advice. Check scope and local detail with Brazilian counsel.
What does the law actually say you must have?
The statute is short on checklists but clear on a handful of duties. Article 37 says the controller and the operator must keep a record of the processing operations they carry out, especially when the processing rests on legitimate interest. Article 41 says the controller must appoint an officer for the processing of personal data (the "encarregado"). Article 46 says processing agents must adopt technical and administrative security measures able to protect personal data from unauthorized access and from accidental or unlawful destruction, loss, alteration, communication or any improper processing.
Article 48 requires the controller to tell the national authority (ANPD) and the data subject when a security incident may cause relevant risk or damage. Article 38 lets the ANPD require a data protection impact report. The exact deadlines and report formats for incidents come from ANPD regulations, so read the current ones on the ANPD site rather than relying on a blog.
Step one: map where personal data lives
Start with the product, not a spreadsheet template. List each service, database, log stream, analytics tool and vendor that touches data about a person in Brazil. Note the fields, the purpose, who can read them and where they are stored. A support tool that keeps screenshots with customer names counts. So does an error tracker that captures request bodies.
A constructed example: a B2B invoicing app stores contact names and emails, logs IP addresses at login, and sends product events to an analytics vendor. Three processing activities, three purposes, two vendors. That list is already the seed of your Article 37 record.
Step two: choose a legal basis per purpose
Article 7 lists the permitted bases for ordinary personal data, including consent, compliance with a legal obligation, performance of a contract, and legitimate interest. Pick one per purpose and write it down. Consent has stricter form rules (it must be clear, and in writing it sits in a clause highlighted from the others), so do not default to it when a contract or legitimate interest fits better. Sensitive data has its own, narrower list in Article 11.
Step three: name the officer and publish a contact
Appoint the encarregado and make the contact route easy to find, such as a privacy page with an email. The officer takes requests from people and talks to the ANPD. Pick someone who can reach engineering quickly.
Step four: build the technical controls
Article 46 is deliberately general, so describe what you do in concrete terms: encryption in transit and at rest, access control with logging, tested backups, secrets kept out of code, and a patching routine for dependencies. Auditors and the regulator will want evidence that these run, not a policy that says they should.
Dependencies matter here. An exploited library in your stack is a route to unauthorized access, which is exactly what Article 46 asks you to prevent. Keep an inventory of components and watch it for known vulnerabilities.
Step five: rehearse the incident path
Write a short runbook: who declares an incident, who decides whether it carries relevant risk, who drafts the notice to the ANPD and to people, and where the facts are kept. Run it once as a tabletop exercise with a made-up leak of an export file.
Penalties to keep in view
Article 52 lists sanctions. They include a warning, a simple fine of up to 2 percent of the company's revenue in Brazil in its last financial year, excluding taxes, capped at R$ 50,000,000 per infraction, and daily fines within that cap. Publicizing the infraction and blocking or deleting the data involved are also listed.
What to do
- Inventory every system and vendor holding data about people in Brazil.
- Assign one legal basis per purpose and record it.
- Keep an Article 37 record of processing and update it with each release.
- Appoint the encarregado and publish a contact.
- Document security measures and the evidence that they run.
- Write and rehearse the incident notification runbook.
- Track the ANPD's current regulations for deadlines and templates.
Safeguard can help with the dependency and evidence side: SBOM and dependency scanning show which components you ship, and compliance automation helps collect proof that controls run. It does not certify you under LGPD.
Quick check
Does LGPD require a data protection officer?
Article 41 says the controller must appoint one. The ANPD can issue rules on exceptions, so check its current guidance for small companies.
Is consent always required?
No. Article 7 lists several bases, including contract performance and legitimate interest. Choose the one that fits each purpose.
Sources
Last reviewed: 18 October 2026.
