LGPD compliance for a company is the process of organizing how personal data is handled so that it meets Brazil's Law 13,709/2018, with defined owners, documented rules and evidence that day-to-day practice matches what is on paper. For most organizations, the challenge is less technical and more organizational: knowing which data exists, why it is used and who is accountable for it.
This guide walks through a practical order of work, from the first step to the role of the data protection officer (DPO), in a straightforward way and without alarmism.
In short
- Start with executive sponsorship, a clear scope and named owners.
- Data mapping (an inventory, or ROPA) is the foundation for everything else: purpose, legal basis, retention and sharing.
- Every use of data needs a legal basis among the ten listed in Article 7, and consent and legitimate interest call for extra care.
- The DPO must be appointed through a formal act, with published contact details, under ANPD Resolution CD/ANPD 18/2024.
- Compliance is an ongoing process, not a project with an end date.
What is LGPD compliance in a company?
LGPD compliance is the set of actions a company takes to handle personal data in line with Law 13,709/2018: mapping the data, defining the legal basis for each use, appointing the DPO, formalizing policies and contracts, responding to data subjects and maintaining security and incident response. It is not a project with an end date, but an ongoing process.
In practice, it means turning the law into routines: who decides about the data, who carries out the work, where the data lives, for how long and how data subjects exercise their rights.
Where should LGPD compliance start?
Before opening any spreadsheet, three decisions help a great deal:
- Executive sponsorship: without leadership support, the project loses priority at the first business urgency.
- Initial scope: pick the areas or processes that hold the most data (HR, sales, support, product) and move forward in waves.
- Owners: set up a core group with legal, IT/security and business areas, and decide who will be the DPO.
It is also worth understanding your role in each operation. According to the ANPD guidance on processing agents and the DPO, the controller makes the decisions about processing and the processor handles data on the controller's behalf. The same organization can be a controller in one operation and a processor in another, and employees are not processing agents.
| Role | What it does | Common example |
|---|---|---|
| Controller | Decides the purpose and means of processing | A company that collects customer data |
| Processor | Handles data on the controller's behalf | An email marketing or payroll platform |
| DPO | Channel between controller, data subjects and ANPD | A person or firm formally appointed |
Data mapping: the foundation
Mapping, also called an inventory or ROPA (record of processing activities), answers simple questions that the rest of the compliance work relies on:
- Which personal data is processed?
- For what purpose?
- What is the legal basis?
- How long is it kept (retention)?
- Who is it shared with?
- Which processors and systems are involved, including cloud services?
Start simple, with interviews per area and a spreadsheet. Then validate with technical teams where the data actually lives, because the real flow almost always differs from the diagram. A living inventory, reviewed whenever a new product or vendor appears, is worth more than a perfect but outdated document.
What are the legal bases in practice?
Article 7 of the LGPD lists ten legal bases:
- consent;
- compliance with a legal or regulatory obligation;
- execution of public policies;
- studies by a research body;
- performance of a contract;
- regular exercise of rights;
- protection of life;
- health protection;
- legitimate interest;
- credit protection.
Two deserve special attention. Consent must be freely given, informed and specific, and the data subject must be able to withdraw it, so it is not the best choice when the processing is necessary to deliver the service. Legitimate interest requires a documented balancing test showing that the company's interest does not override the data subject's rights. Recording that analysis is what provides certainty if the decision is ever questioned.
When does a company need to appoint a DPO?
The LGPD provides that the controller must appoint a DPO (in Portuguese, the "encarregado"). For processors, appointment is optional. Small-scale processing agents are exempt, except where processing is high risk, but they must keep a channel of communication with data subjects, under Resolution CD/ANPD 2/2022. When in doubt, appointing one is good practice.
Resolution CD/ANPD 18/2024, dated July 16, 2024, details the role. In short, it sets out the guidance below, which is also discussed by Legismap:
- the appointment is made through a formal act, in writing, dated and signed, with a formally designated substitute;
- the DPO's identity and contact details are published prominently, for example on the website;
- the DPO deals with ANPD and advises the organization on incident and processing records, the data protection impact assessment (DPIA, "RIPD" in Portuguese), governance, security, privacy by design, contracts and international transfers;
- communication with ANPD is in Portuguese;
- the processing agent must remove conflicts of interest;
- responsibility for compliance remains with the agent, not only with the DPO.
The ANPD guidance also clarifies that the DPO needs neither certification nor registration with the Authority, and can be internal or outsourced. What matters most is autonomy, access to senior management and enough time for the role.
Policies, contracts and data subject rights
Once the map is ready, formalize what supports the routine:
- A clear privacy policy for the public and an internal data protection policy.
- Processor contracts that define purpose, security measures, subprocessors, return or deletion of data and support during incidents.
- A data subject request workflow: who receives requests, who verifies identity, who replies and within what time.
- Regular training, because most failures come from processes and habits, not from tools.
For the security side, references such as ISO/IEC 27001, the NIST Cybersecurity Framework and the CIS Controls help turn requirements into verifiable practices.
Security, incidents and impact assessments
A tested incident response plan is part of compliance. According to Confidata, Resolution CD/ANPD 15/2024 provides that, when an incident affects personal data, notification to ANPD and to data subjects must happen within 3 business days of becoming aware of the event, with the possibility of supplementing the notice within 20 business days. Incident records must be kept for at least 5 years.
For that reason, decide in advance who assesses the event, who decides to notify and where the evidence is stored. This avoids improvisation at the moment when time is shortest.
An impact assessment (DPIA) mainly makes sense for higher-risk or higher-volume processing, such as sensitive data or the use of new technologies. When in doubt, the DPO and the legal team assess the need case by case.
What does ANPD expect, and what is the regulatory landscape?
According to Congresso em Foco, Law 15,352 of 2026 turned ANPD into a regulatory agency with technical, decision-making, administrative and financial autonomy. The reported change concerns the Authority's structure and autonomy. Because it is recent and based on press coverage, it is worth checking the official text of the law before citing it in formal documents.
According to Confidata, oversight follows ANPD's 2026-2027 Priority Topics Map, and the Authority referred to its sanctions area bodies and companies that did not answer inquiries about their DPO. The takeaway is simple: keep the DPO's contact details up to date and respond to the Authority's requests.
As for sanctions, Article 52 of the LGPD provides for a warning, a simple fine of up to 2% of revenue capped at R$ 50 million per infraction, publicizing the infraction, and blocking or deletion of the data. The best response is not worry, but documentation and routine.
Compliance checklist
- Engaged leadership and a defined scope.
- DPO appointed through a formal act, with published contact details.
- Data inventory with purpose, legal basis, retention and sharing.
- Documented legitimate interest test where applicable.
- Policies, processor contracts and a data subject request workflow.
- Incident response plan and records kept.
- Periodic reviews and training.
Frequently asked questions
Does every company need a DPO?
The controller must appoint a DPO. Processors may do so as good practice, and small-scale agents are exempt, except for high-risk processing, but they must keep a channel open with data subjects.
Does the DPO need a certification?
No. According to the ANPD guidance, the DPO requires neither certification nor registration with the Authority. Knowledge and autonomy are what matter.
Can the DPO be outsourced?
Yes. The DPO can be an internal or external person, as long as there is a formal appointment, published contact details and no conflict of interest.
Is consent always the best legal basis?
No. It is one of the ten bases in Article 7, and often another basis, such as performance of a contract or a legal obligation, describes the situation better.
How long does LGPD compliance take?
It depends on the size and complexity of the company. What matters is treating it as an ongoing process, with reviews whenever a product, vendor or data flow changes.
Conclusion
LGPD compliance is less about perfection and more about consistency: knowing which data exists, justifying each use, having a clear DPO and responding well when something falls outside the plan. If your team wants support to structure this path, Cloud Minds Trusted can help with governance and security. See our Security, Governance and Cloud page and get in touch.