Brazil

Law no. 13.709/2018 is the complete Brazilian regulation regarding data protection, which oversees the collection, processing, and storage of personal data of both public and private organizations. Very close to the GDPR of the European Union, this law was made enforceable in September 2020, with administrative sanctions taking effect in August 2021, with the necessity for data processing being based on one of the ten grounds, such as consent and legitimate interest. It is highly dependent upon the Autoridade Nacional de Proteção de Dados (ANPD), an independent data regulatory agency which audited corporations, prevented any kind of illegal processing, and imposed hefty administrative fines amounting to 2% of company revenues (up to a maximum of R$ 50 million). At its mature stage currently, the LGPD is known for having a data adequacy agreement between the EU and Brazil for seamless cross-border data transfer, along with other strict enforcement objectives like artificial intelligence platforms, 72-hour breach reporting, and transparency of children's data.