brazil-lgpdlisted

# Brazil LGPD Compliance (Lei 13.709/2018) ## Overview The Lei Geral de Proteção de Dados Pessoais (LGPD), enacted as Lei 13.709 on 14 August 2018 and effective from 18 September 2020 (with sanctions enforceable from 1 August 2021), is Brazil's comprehensive data protection law. The LGPD applies to any processing of personal data carried out in Brazil, where the processing activity aims to offer goods or services to individuals located in Brazil, or where the personal data was collected in Brazil (Art. 3). The Autoridade Nacional de Proteção de Dados (ANPD) serves as the supervisory authority with rulemaking, enforcement, and advisory functions. ## Ten Lawful Bases Under Article 7 The LGPD provides ten distinct legal bases for processing personal data, exceeding the six lawful bases under EU GDPR. Each base operates independently — organisations may rely on any applicable base without a prescribed hierarchy. ### 1. Consent of the Data Subject (Art. 7, I) **Requirements under Art. 8**: - Consent must be provided in writing or by other means that demonstrate the free, informed, and unequivocal expression of the data subject's will - Written consent must appear in a clause separate from other contractual provisions (Art. 8, §1) - The burden of proof that consent was obtained rests with the controller (Art. 8, §2) - Consent is void if based on misleading information or where the data subject was not adequately informed (Art. 9, §1) - Consent may be revoked at any time by ex