{
    "schema_version": "1.1",
    "id": 686815,
    "slug": "lgpd-compliance-brazil-foreign-companies-2026",
    "title": "LGPD Compliance Brazil: Foreign Company Rules 2026",
    "excerpt": "LGPD compliance Brazil applies even without a CNPJ or office. See who is exempt, the three compliance routes, ANPD deadlines and real costs for 2026.",
    "content_primary": "markdown",
    "available_formats": [
        "markdown"
    ],
    "content_markdown": "The most expensive LGPD mistake foreign companies make is not a weak privacy policy. It is assuming the law does not apply to them at all. A US SaaS company with 4,000 Brazilian users, no office, no CNPJ, no employee in Brazil, receives an ANPD notification and has 15 days to respond in Portuguese. It ignores it, because “we are not a Brazilian company.” Eight months later it faces an administrative sanction, plus a consumer class action in São Paulo state court, plus a Brazilian bank refusing to process its payments because its local acquirer flagged the compliance risk. The legal fees alone run past R$ 60,000 before anyone even discusses the fine.\n\nHere is the short version of how to avoid it: Brazil’s *Lei Geral de Proteção de Dados* (LGPD, Law 13.709/2018) has explicit extraterritorial reach. Article 3 catches you if you process data in Brazil, if you offer goods or services to people located in Brazil, or if the data was collected while the person was physically in Brazil. Presence, incorporation and revenue thresholds are irrelevant. This article starts with the exceptions (who genuinely escapes), then gives you the rule, then compares the three real compliance routes open to a foreign group, with costs and timelines.\n\nLeia também:\n[Worker Rights in Brazil 2026: Complete Employee Guide](https://www.ribeirocavalcante.com.br/worker-rights-in-brazil-2026/)\n\n<a id=\"who-is-actually-exempt-from-the-lgpd-start-with-the-exceptions\"></a>\n## Who Is Actually Exempt From the LGPD? (Start With the Exceptions)\n\nVery few foreign companies are exempt. Article 4 of Law 13.709/2018 excludes processing done by a natural person for exclusively private and non-economic purposes, processing for journalistic, artistic or academic purposes, and public security or state defence. It also excludes data originating outside Brazil that merely transits through Brazil without being shared locally.\n\nThat transit exception is the one foreign groups reach for, and it is narrower than they hope. Article 4, IV of the LGPD covers data that comes from a country with an adequate level of protection, transits through Brazil, and is **not** communicated to any Brazilian agent or shared with any Brazilian processing operation. If your Brazilian subsidiary touches the data, indexes it, supports it, or has read access to a shared CRM, the exception collapses.\n\nThere is also a genuine exemption of scale, but not the one companies expect. Small processing agents (including small foreign companies with limited Brazilian operations) are still fully bound by the LGPD’s principles and legal bases. What ANPD Resolution CD/ANPD No. 2/2022 gives them is procedural relief: simplified records of processing, no obligation to appoint a formal Data Protection Officer, and longer deadlines for incident reporting. Relief on paperwork, not on substance.\n\nLeia também:\n[Brazil Employment Law Foreign Employers 2026 Guide](https://www.ribeirocavalcante.com.br/brazil-employment-law-foreign-employers-2026/)\n\n**Watch out:** “We only have B2B clients in Brazil” is not an exemption. The LGPD protects natural persons, and every corporate client has human contacts, buyers, signatories and technical staff whose names, emails, CPF numbers and job titles you are processing. B2B does not mean no personal data.\n\nNow the rule. Under Article 3, the LGPD applies regardless of the means used, the country where the controller is headquartered, or the country where the data is stored, whenever processing is carried out in Brazilian territory (item I), whenever the purpose is to offer or supply goods or services to individuals located in Brazil or to process their data (item II), or whenever the personal data was collected in Brazilian territory (item III). Article 3, paragraph 1 clarifies that data is considered collected in Brazil when the data subject was physically in Brazil at the moment of collection. That last point catches airport Wi-Fi sign-ups, hotel booking forms and event registrations.\n\nYou can read the full text of the law on the [Planalto government portal (Portuguese)\r\n\r\n](https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm), and the ANPD publishes its resolutions and guidance at [gov.br/anpd](https://www.gov.br/anpd/pt-br).\n\n<a id=\"what-will-the-other-side-argue-and-what-answers-it\"></a>\n## What Will the Other Side Argue, and What Answers It?\n\nThe ANPD’s strongest argument against a foreign company is not about servers. It is about targeting: you priced in reais, published a Portuguese-language page, accepted PIX or Boleto, ran Portuguese-language ads, and appointed a Brazilian reseller. Under Article 3, II of the LGPD, that is a deliberate offer of services to individuals located in Brazil, and jurisdiction follows.\n\nLet me state the authority’s case in its strongest form, because a weak version of it will not prepare you. The ANPD will argue: the LGPD was drafted precisely to prevent the outcome where a Brazilian consumer loses protection the moment the company profiting from them is incorporated abroad. Brazilian courts have accepted jurisdiction over foreign internet companies for over a decade under Article 11 of the *Marco Civil da Internet* (Law 12.965/2014), which provides that Brazilian law applies whenever at least one act of collection, storage or processing occurs in Brazil, even if the activity is carried out by a company headquartered abroad. The LGPD did not invent extraterritoriality in Brazil. It codified an established position. And the enforcement tool is not only the fine: it is publicising the infraction, blocking or deleting the data involved, and, in serious cases, partial or total suspension of the database or of the processing activity itself. For a company whose Brazilian revenue depends on a functioning database, suspension is worse than any fine.\n\nWhat answers it? Not a jurisdictional objection. In practice, three things answer it. First, documented legal bases: an Article 7 or Article 11 basis identified *in writing* for every processing purpose, dated before the incident, not reconstructed afterwards. Second, a responsive local channel: a named contact who receives and answers requests within the 15-day deadline the LGPD sets for confirming processing and providing access (Article 19, paragraph 2). Third, evidence of good-faith compliance effort, which the LGPD expressly directs the ANPD to weigh when dosing sanctions under Article 52, paragraph 1, together with the adoption of internal mechanisms and a policy of good practices and governance.\n\n**Key point:** The question an ANPD inspector asks is never “are you perfect?” It is “can you show me, in a document dated before this problem, what you were doing and why?” Compliance you cannot evidence is compliance you do not have.\n\n<a id=\"option-a-remote-compliance-with-no-brazilian-entity-how-does-it-work\"></a>\n## Option A: Remote Compliance With No Brazilian Entity, How Does It Work?\n\nRemote compliance means meeting LGPD obligations from abroad, with no CNPJ and no local entity. It is legally viable because, unlike GDPR Article 27, the LGPD contains no general requirement to appoint an EU-style local representative. Realistic setup cost for a mid-size foreign company: R$ 25,000 to R$ 45,000 in Brazilian legal fees, over 60-90 days.\n\n**How it works:** you keep your existing global privacy programme, then bolt on a Brazil layer. That layer has four parts: a Portuguese-language privacy notice that maps each purpose to an Article 7 legal basis; an appointed *encarregado* (data protection officer) whose name and contact are publicly disclosed, as Article 41 requires; a documented 15-day response workflow for data subject requests; and a transfer mechanism covering the flow of Brazilian data to your servers abroad.\n\nRequirements in practice:\n\n- A data map (ROPA) covering only the Brazilian data flows, with purpose, legal basis, retention period and recipients for each activity\n- Portuguese-language privacy notice and cookie banner, with a real refusal option\n- An *encarregado* who can operate in Portuguese, internal or outsourced\n- ANPD standard contractual clauses or approved specific clauses for the international transfer\n- An incident response plan naming who notifies the ANPD, in Portuguese, and within what timeframe\n\nPros: cheapest route, no corporate tax footprint, no accounting obligations, fast to implement. Cons: you have no Brazilian legal person to receive service of process, which means consumer claims and ANPD notifications may reach you late or through awkward channels. You also cannot easily open a local bank account, sign local supplier contracts, or hire Brazilian staff, so growth hits a ceiling. And Brazilian courts remain fully willing to hear claims against you regardless.\n\nBest suited to: SaaS, e-commerce and online education businesses with Brazilian users but no local team, and to companies testing the market before committing capital.\n\n<a id=\"option-b-full-compliance-through-a-brazilian-subsidiary-what-changes\"></a>\n## Option B: Full Compliance Through a Brazilian Subsidiary, What Changes?\n\nOnce you have a Brazilian subsidiary, LGPD compliance stops being a privacy project and becomes an employment, tax and contract project. Article 3, I applies unambiguously, and you now process employee data, payroll data, CLT records and health information. Expect R$ 45,000 to R$ 120,000 in first-year compliance spend, plus 90-150 days of implementation.\n\nThe subsidiary is where sensitive data enters your world. Under Article 11 of the LGPD, sensitive personal data (racial or ethnic origin, religious conviction, political opinion, union membership, health, sex life, genetic and biometric data) can only be processed on a narrower set of bases, and **legitimate interest is not among them**. European teams get this wrong constantly. Under GDPR they lean on legitimate interest; under the LGPD, any HR process touching health data, occupational medical exams, union deductions or biometric time clocks needs a different basis: compliance with a legal or regulatory obligation, exercise of rights in proceedings, health protection, or specific and highlighted consent.\n\nWhat the subsidiary route requires:\n\n- A registered CNPJ, which in turn requires a valid [fiscal address in Brazil](https://address.ribeirocavalcante.com.br/) before the company can be incorporated at the Junta Comercial (Board of Trade)\n- Data protection clauses in employment contracts, satisfying the Article 9 transparency duty at or before the point of collection\n- Intragroup transfer documentation for the subsidiary-to-parent data flow\n- Processor agreements with your Brazilian payroll bureau, accountant and IT vendors\n- A named *encarregado* and a governance policy the ANPD can inspect\n\n**Important:** The subsidiary-to-parent flow of HR data is an international transfer, even inside the same corporate group. There is no intragroup exemption in the LGPD. You need a documented mechanism, and since 2024 the ANPD has published standard contractual clauses precisely for this.\n\nPros: full commercial capacity, local banking, enforceable local contracts, credible before regulators and clients, and sanctions calculated against Brazilian revenue rather than global revenue. Cons: cost, payroll obligations, and a much wider LGPD surface area. If you are still weighing incorporation, our guide on the [real timeline and costs of opening a company in Brazil](https://www.ribeirocavalcante.com.br/open-company-in-brazil-timeline-costs-2026/) sets out the sequence, and the [documents checklist](https://www.ribeirocavalcante.com.br/documents-open-company-in-brazil-2026/) covers what you need apostilled before you start.\n\n<a id=\"option-c-is-a-local-representative-or-outsourced-dpo-enough\"></a>\n## Option C: Is a Local Representative or Outsourced DPO Enough?\n\nThe middle route is appointing an outsourced *encarregado* (DPO-as-a-service) in Brazil without incorporating. Typical market cost runs from R$ 1,500 to R$ 6,000 per month depending on request volume. It satisfies Article 41 of the LGPD, which requires the controller to appoint and publicly disclose a data protection officer, but it does not create a legal person in Brazil.\n\nThis is the most under-used option and often the smartest first step. The outsourced *encarregado* receives complaints from data subjects, communicates with the ANPD, and advises your teams. Crucially, the person is a native Portuguese speaker who can answer a consumer within the 15-day window instead of routing the message through a global privacy inbox in English.\n\n**Example:** A Portuguese clinic marketing fertility treatment to Brazilian patients receives 12 data subject requests in a year. An outsourced *encarregado* at R$ 2,500 per month costs R$ 30,000 annually. A single unanswered request escalating into an ANPD proceeding easily costs more than that in defence fees alone, before considering the sanction.\n\nPros: proportionate cost, immediate local language capability, demonstrates good faith to the ANPD, no corporate footprint. Cons: the *encarregado* is not your legal representative for litigation, does not solve payment processing or contracting problems, and cannot substitute for missing legal bases. An *encarregado* with nothing documented to work from simply becomes the person who has to explain the gaps.\n\n<a id=\"how-do-the-three-routes-compare-on-cost-time-and-risk\"></a>\n## How Do the Three Routes Compare on Cost, Time and Risk?\n\nThe three routes differ mainly in exposure and capacity, not in the substantive LGPD obligations, which are identical for all of them. Sanction ceilings are set by Article 52 of Law 13.709/2018: up to 2% of the group’s revenue *in Brazil* in the last fiscal year, net of taxes, capped at R$ 50 million per infraction (roughly US$ 9.2 million at R$ 5.40 to the dollar).\n\n| Criterion | A. Remote compliance | B. Brazilian subsidiary | C. Outsourced encarregado |\n| --- | --- | --- | --- |\n| LGPD applies? | Yes (Art. 3, II and III) | Yes (Art. 3, I, II and III) | Yes (Art. 3, II and III) |\n| Indicative first-year cost | R$ 25,000-45,000 | R$ 45,000-120,000 | R$ 18,000-72,000/year |\n| Implementation time | 60-90 days | 90-150 days | 30-45 days |\n| CNPJ required | No | Yes | No |\n| Fiscal address required | No | Yes | No |\n| Employee data in scope | No local staff | Yes, full CLT scope | No local staff |\n| Sensitive data (Art. 11) exposure | Low to medium | High (HR and health) | Low to medium |\n| Can receive service of process locally | No | Yes | No |\n| 15-day response capability | Weak without local help | Strong | Strong |\n| Local banking and contracting | No | Yes | No |\n| Core documents | ROPA, PT notice, SCCs | All of A plus HR clauses, processor contracts, intragroup transfer | Appointment letter, ROPA, request workflow |\n\n<a id=\"what-changed-for-lgpd-compliance-going-into-2026\"></a>\n## What Changed for LGPD Compliance Going Into 2026?\n\nThe single biggest change is that international transfers are now a regulated, documented obligation rather than a grey area. In 2024 the ANPD approved its international data transfer regulation and published official standard contractual clauses, closing a gap that had existed since the LGPD took effect in 2020. Foreign groups transferring Brazilian data abroad now have a defined mechanism and a defined deadline to adopt it.\n\nUnder Article 33 of the LGPD, international transfers are permitted to countries the ANPD recognises as offering an adequate level of protection, or through specific safeguards: standard contractual clauses approved by the ANPD, specific contractual clauses the ANPD validates, binding corporate rules, or seals and certificates. In the absence of an adequacy list, the practical answer for nearly every foreign group is the ANPD’s standard clauses, incorporated into the existing intragroup services agreement.\n\nThe second development is enforcement maturity. The ANPD moved from its guidance-and-education phase into active sanctioning, publishing preventive measures, infraction notices and sanctions on its website. Pleading “the law is new and nobody enforces it” no longer works.\n\nThe third is the interaction with Brazil’s children and adolescents digital statute and the growing regulation of AI processing, both of which raise obligations for any platform with Brazilian users. If your product allows minors to register, treat that as a separate compliance workstream, not a footnote.\n\n**Tip:** Re-check every ANPD resolution number before you rely on it. Go to gov.br/anpd, open “Documentos”, then “Resoluções”. Regulations in this area change faster than any published guide, including this one.\n\n<a id=\"which-route-should-you-choose-for-your-situation\"></a>\n## Which Route Should You Choose for Your Situation?\n\nChoose by exposure, not by cost. If your Brazilian revenue exceeds roughly R$ 1 million a year, or you hold sensitive data, or you process data about minors, the cheapest option becomes the most expensive one. The LGPD caps sanctions at 2% of Brazilian revenue per infraction, so your downside scales with what you earn here.\n\n- **If you sell digitally to Brazilian consumers with no local team:** start with Option C (outsourced *encarregado*, 30-45 days) and layer Option A’s documentation on top over the following quarter. Language capability first, paperwork second.\n- **If you already have a Brazilian subsidiary or are acquiring one:** Option B is not a choice, it is your reality. Prioritise the HR data layer and the intragroup transfer clauses, because those are the two gaps that surface in every due diligence.\n- **If you are pre-revenue and testing the market:** Option A alone is defensible. Get the Portuguese privacy notice and the ROPA right, and revisit in 12 months.\n- **If you process health, biometric or union data:** skip straight to a full Article 11 analysis regardless of route. Legitimate interest will not save you here.\n- **If you are structuring an investment vehicle:** align data compliance with your corporate structuring from day one. Our overviews of [angel investment rules for foreign investors](https://www.ribeirocavalcante.com.br/angel-investment-brazil-foreign-investors-2026/) and the [Brazil investor visa](https://www.ribeirocavalcante.com.br/brazil-investor-visa-residency-2026/) explain how the pieces fit together.\n\n<a id=\"what-is-the-step-by-step-implementation-sequence\"></a>\n## What Is the Step-by-Step Implementation Sequence?\n\nA minimum viable LGPD programme for a foreign company has five components and takes 60-120 days. Do them in order, because each one feeds the next. Skipping the data map and starting with the privacy policy is the most common sequencing error, and it produces a policy that describes processing you do not actually do.\n\n- **Step 1, data mapping (15-30 days).** Build a current inventory of every processing activity touching Brazilian data, documenting purpose, legal basis, data categories, retention period and recipients. This is the foundation document an inspector asks for first.\n- **Step 2, legal bases (10-15 days).** Assign an Article 7 basis to each ordinary processing purpose, and an Article 11 basis to each sensitive one. Where you rely on legitimate interest, write the balancing test down.\n- **Step 3, documentation and notices (15-20 days).** Portuguese-language privacy notice, cookie management, data protection clauses in employment and vendor contracts, and processor agreements with every supplier that touches the data.\n- **Step 4, governance (10-15 days).** Appoint and publicly disclose the *encarregado*, build the 15-day data subject request workflow, and write the incident response plan that names who notifies the ANPD and how.\n- **Step 5, international transfers (15-30 days).** Adopt ANPD standard contractual clauses for every cross-border flow, including intragroup flows to the parent company.\n\n**Remember:** Brazil is a Civil Law jurisdiction. Regulators and judges look to codified text and documented compliance, not to industry custom or precedent-based reasoning. A written record dated before the incident carries more weight here than a persuasive explanation offered afterwards.\n\nOne practical note on documents: contracts and corporate powers of attorney signed abroad usually need an apostille under the Hague Convention and a sworn translation (*tradução juramentada*) before a cartório (notary office) or Brazilian authority will accept them. Build 15-20 extra days into your timeline for that step.\n\n<a id=\"frequently-asked-questions-about-lgpd-compliance-for-foreign-companies\"></a>\n## Frequently Asked Questions About LGPD Compliance for Foreign Companies\n\n<a id=\"does-the-lgpd-apply-if-i-have-no-office-employee-or-cnpj-in-brazil\"></a>\n### Does the LGPD apply if I have no office, employee or CNPJ in Brazil?\n\nYes. Article 3 of Law 13.709/2018 applies the LGPD regardless of where the controller is headquartered or where the data is stored. If you offer or supply goods or services to individuals located in Brazil, process data about them, or collected the data while the person was physically in Brazil, you are in scope. The ANPD can investigate and sanction you, and Brazilian consumers can sue you in Brazilian courts under the Marco Civil da Internet. Corporate absence is not a defence, it is simply a harder position from which to defend yourself.\n\n<a id=\"is-gdpr-compliance-enough-to-satisfy-the-lgpd\"></a>\n### Is GDPR compliance enough to satisfy the LGPD?\n\nNo, though it gets you roughly 70% of the way. Four gaps matter most. The LGPD has ten legal bases for ordinary data (Article 7) rather than six, including credit protection. Sensitive data under Article 11 excludes legitimate interest as a basis, so GDPR-style HR justifications fail. The response deadline for data subject access is 15 days, not one month. And international transfers require ANPD-approved mechanisms, not EU standard clauses. A GDPR programme needs a Brazil-specific layer, not a translation.\n\n<a id=\"how-much-can-the-anpd-actually-fine-a-foreign-company\"></a>\n### How much can the ANPD actually fine a foreign company?\n\nUnder Article 52 of the LGPD, the ceiling is 2% of the group’s revenue *in Brazil* in the last fiscal year, net of taxes, capped at R$ 50 million per infraction (around US$ 9.2 million). Unlike GDPR, global turnover is not the base. But the non-monetary sanctions often hurt more: publicising the infraction, blocking or deleting the data involved, and partial or total suspension of the database or processing activity. A suspended database can end a Brazilian revenue stream overnight.\n\n<a id=\"do-i-have-to-appoint-an-encarregado-dpo-and-can-they-be-based-abroad\"></a>\n### Do I have to appoint an encarregado (DPO), and can they be based abroad?\n\nArticle 41 of the LGPD requires controllers to appoint an *encarregado* and publicly disclose their identity and contact details. The law does not expressly require Brazilian residency, and small processing agents received relief from the appointment duty under ANPD Resolution CD/ANPD No. 2/2022. In practice, however, an *encarregado* who cannot operate in Portuguese cannot meet the 15-day response deadline or communicate effectively with the ANPD. Outsourced Brazilian DPO services typically run R$ 1,500 to R$ 6,000 per month.\n\n<a id=\"does-sending-brazilian-employee-data-to-my-parent-company-count-as-an-international-transfer\"></a>\n### Does sending Brazilian employee data to my parent company count as an international transfer?\n\nYes. The LGPD contains no intragroup exemption. Sending payroll, performance or HR data from your Brazilian subsidiary to the parent abroad is an international transfer governed by Article 33, and it needs a documented mechanism: ANPD standard contractual clauses, specific clauses validated by the ANPD, or binding corporate rules. Since the ANPD published its 2024 transfer framework and model clauses, the practical route for most groups is incorporating the standard clauses into the existing intragroup services agreement.\n\n<a id=\"what-happens-if-i-ignore-an-anpd-notification\"></a>\n### What happens if I ignore an ANPD notification?\n\nThe proceeding continues without you and decisions are issued by default. Article 52, paragraph 1 of the LGPD directs the ANPD to weigh the offender’s good faith, cooperation and adoption of internal compliance mechanisms when setting sanctions. Silence removes every mitigating factor you might have had. You also lose the chance to negotiate a *termo de ajustamento de conduta* (conduct adjustment agreement), which often resolves matters without a fine. Answer within the deadline, in Portuguese, even if your answer is incomplete.\n\n**Quick recap:** The LGPD applies to you if you serve people in Brazil, full stop. The three routes (remote compliance, Brazilian subsidiary, outsourced *encarregado*) differ in cost and capacity but not in obligations. Document your legal bases before anything goes wrong, and answer data subjects within 15 days.\n\n<a id=\"get-your-lgpd-compliance-for-foreign-companies-in-brazil-reviewed\"></a>\n## Get Your LGPD Compliance for Foreign Companies in Brazil Reviewed\n\nWorking out which of these three routes fits your business is not something to decide from a blog post. It depends on your Brazilian revenue, the data categories you hold, whether minors or health data are involved, and how your group already moves data across borders. Our bilingual team, registered with the OAB (Brazilian Bar Association), handles LGPD structuring, ANPD standard contractual clauses, employment data compliance and data protection due diligence for foreign investors. You can also read our broader overview of [compliance for foreign companies in Brazil in 2026](https://www.ribeirocavalcante.com.br/compliance-for-foreign-companies-in-brazil-2026/) for how data protection sits alongside tax, corporate and labour obligations.\n\nConcrete next step: send us your current privacy notice, your list of Brazilian data flows, and whether you hold a CNPJ. We will tell you which route applies and what the first 30 days look like.\n\nTalk to a specialist lawyer now\n[ Talk to a Lawyer on WhatsApp](https://www.ribeirocavalcante.com.br/ads/wpp.html)",
    "content_hash": {
        "algo": "sha256",
        "scope": "content_markdown",
        "value": "5d338eb64139a2b8540c8392fbd1beabc6c98c9e459dbb1022600a0bd5c5600c"
    },
    "date_published": "2026-09-24T13:36:43-03:00",
    "date_modified": "2026-09-24T13:36:43-03:00",
    "author": {
        "name": "Lucas Ribeiro Cavalcante",
        "url": "https://www.ribeirocavalcante.com.br/autor/lucas/"
    },
    "canonical_url": "https://www.ribeirocavalcante.com.br/lgpd-compliance-brazil-foreign-companies-2026/",
    "json_url": "https://www.ribeirocavalcante.com.br/lgpd-compliance-brazil-foreign-companies-2026.json",
    "word_count": 3609,
    "reading_time": 19,
    "robots": {
        "index": true,
        "follow": true
    },
    "license": {
        "name": "CC BY-NC-ND 4.0",
        "url": "https://creativecommons.org/licenses/by-nc-nd/4.0/deed.pt-br",
        "notice": "Conteúdo protegido. Cite a fonte com link para a URL canônica. Reprodução integral proibida."
    },
    "publisher": {
        "name": "Ribeiro Cavalcante Advocacia",
        "url": "https://www.ribeirocavalcante.com.br/"
    },
    "publisher_ref": "https://www.ribeirocavalcante.com.br/org.json",
    "language": "pt-BR",
    "site": "Ribeiro Cavalcante Advocacia",
    "categories": [
        {
            "id": 4610,
            "name": "Business &amp; Investment",
            "slug": "business-investment",
            "url": "https://www.ribeirocavalcante.com.br/english/business-investment/"
        }
    ],
    "tags": [
        {
            "id": 10156,
            "name": "anpd notification response",
            "slug": "anpd-notification-response",
            "url": "https://www.ribeirocavalcante.com.br/tag/anpd-notification-response/"
        },
        {
            "id": 10155,
            "name": "brazil data protection law foreign company",
            "slug": "brazil-data-protection-law-foreign-company",
            "url": "https://www.ribeirocavalcante.com.br/tag/brazil-data-protection-law-foreign-company/"
        },
        {
            "id": 10158,
            "name": "brazil privacy law extraterritorial",
            "slug": "brazil-privacy-law-extraterritorial",
            "url": "https://www.ribeirocavalcante.com.br/tag/brazil-privacy-law-extraterritorial/"
        },
        {
            "id": 5328,
            "name": "compliance brazil foreign company",
            "slug": "compliance-brazil-foreign-company",
            "url": "https://www.ribeirocavalcante.com.br/tag/compliance-brazil-foreign-company/"
        },
        {
            "id": 5330,
            "name": "labor compliance brazil",
            "slug": "labor-compliance-brazil",
            "url": "https://www.ribeirocavalcante.com.br/tag/labor-compliance-brazil/"
        },
        {
            "id": 5329,
            "name": "lgpd brazil",
            "slug": "lgpd-brazil",
            "url": "https://www.ribeirocavalcante.com.br/tag/lgpd-brazil/"
        },
        {
            "id": 5590,
            "name": "LGPD compliance Brazil",
            "slug": "lgpd-compliance-brazil",
            "url": "https://www.ribeirocavalcante.com.br/tag/lgpd-compliance-brazil/"
        },
        {
            "id": 10157,
            "name": "lgpd data protection officer brazil",
            "slug": "lgpd-data-protection-officer-brazil",
            "url": "https://www.ribeirocavalcante.com.br/tag/lgpd-data-protection-officer-brazil/"
        }
    ],
    "featured_image": {
        "url": "https://cdn.ribeirocavalcante.com.br/2026/09/compliance-for-foreign-companies-in-brazil-686815-1790267834.webp",
        "width": 1400,
        "height": 788,
        "alt": "Imagem representando Compliance for Foreign Companies in Brazil — Ribeiro Cavalcante Advocacia"
    },
    "faq": [
        {
            "question": "Does LGPD compliance in Brazil apply to companies with no office or CNPJ?",
            "answer": "Yes. Article 3 of Law 13.709/2018 applies based on where the data subject is located, not where the company is incorporated. A foreign SaaS with only Brazilian users is fully covered."
        },
        {
            "question": "Who is exempt from the LGPD?",
            "answer": "Only narrow cases: purely private non-economic processing by individuals, journalistic, artistic or academic purposes, public security and state defence, and data that merely transits through Brazil without local sharing."
        },
        {
            "question": "Do we need a Data Protection Officer for LGPD compliance in Brazil?",
            "answer": "Most controllers must appoint a DPO (encarregado) with published contact details. Small processing agents under ANPD Resolution CD/ANPD No. 2/2022 are exempt from a formal DPO but still bound by all LGPD principles."
        },
        {
            "question": "What happens if we ignore an ANPD notification?",
            "answer": "The 15-day deadline runs regardless. Ignoring it typically leads to administrative sanctions, plus exposure to consumer class actions and Brazilian banks or acquirers refusing to process your payments."
        },
        {
            "question": "Does the LGPD apply if we only have B2B clients in Brazil?",
            "answer": "Yes. The LGPD protects natural persons, and B2B relationships still involve names, emails, CPF numbers and job titles of employees and signatories, which are personal data."
        }
    ],
    "table_of_contents": [
        {
            "level": 2,
            "text": "Who Is Actually Exempt From the LGPD? (Start With the Exceptions)",
            "anchor": "who-is-actually-exempt-from-the-lgpd-start-with-the-exceptions"
        },
        {
            "level": 2,
            "text": "What Will the Other Side Argue, and What Answers It?",
            "anchor": "what-will-the-other-side-argue-and-what-answers-it"
        },
        {
            "level": 2,
            "text": "Option A: Remote Compliance With No Brazilian Entity, How Does It Work?",
            "anchor": "option-a-remote-compliance-with-no-brazilian-entity-how-does-it-work"
        },
        {
            "level": 2,
            "text": "Option B: Full Compliance Through a Brazilian Subsidiary, What Changes?",
            "anchor": "option-b-full-compliance-through-a-brazilian-subsidiary-what-changes"
        },
        {
            "level": 2,
            "text": "Option C: Is a Local Representative or Outsourced DPO Enough?",
            "anchor": "option-c-is-a-local-representative-or-outsourced-dpo-enough"
        },
        {
            "level": 2,
            "text": "How Do the Three Routes Compare on Cost, Time and Risk?",
            "anchor": "how-do-the-three-routes-compare-on-cost-time-and-risk"
        },
        {
            "level": 2,
            "text": "What Changed for LGPD Compliance Going Into 2026?",
            "anchor": "what-changed-for-lgpd-compliance-going-into-2026"
        },
        {
            "level": 2,
            "text": "Which Route Should You Choose for Your Situation?",
            "anchor": "which-route-should-you-choose-for-your-situation"
        },
        {
            "level": 2,
            "text": "What Is the Step-by-Step Implementation Sequence?",
            "anchor": "what-is-the-step-by-step-implementation-sequence"
        },
        {
            "level": 2,
            "text": "Frequently Asked Questions About LGPD Compliance for Foreign Companies",
            "anchor": "frequently-asked-questions-about-lgpd-compliance-for-foreign-companies"
        },
        {
            "level": 3,
            "text": "Does the LGPD apply if I have no office, employee or CNPJ in Brazil?",
            "anchor": "does-the-lgpd-apply-if-i-have-no-office-employee-or-cnpj-in-brazil"
        },
        {
            "level": 3,
            "text": "Is GDPR compliance enough to satisfy the LGPD?",
            "anchor": "is-gdpr-compliance-enough-to-satisfy-the-lgpd"
        },
        {
            "level": 3,
            "text": "How much can the ANPD actually fine a foreign company?",
            "anchor": "how-much-can-the-anpd-actually-fine-a-foreign-company"
        },
        {
            "level": 3,
            "text": "Do I have to appoint an encarregado (DPO), and can they be based abroad?",
            "anchor": "do-i-have-to-appoint-an-encarregado-dpo-and-can-they-be-based-abroad"
        },
        {
            "level": 3,
            "text": "Does sending Brazilian employee data to my parent company count as an international transfer?",
            "anchor": "does-sending-brazilian-employee-data-to-my-parent-company-count-as-an-international-transfer"
        },
        {
            "level": 3,
            "text": "What happens if I ignore an ANPD notification?",
            "anchor": "what-happens-if-i-ignore-an-anpd-notification"
        },
        {
            "level": 2,
            "text": "Get Your LGPD Compliance for Foreign Companies in Brazil Reviewed",
            "anchor": "get-your-lgpd-compliance-for-foreign-companies-in-brazil-reviewed"
        }
    ],
    "internal_links": [
        {
            "anchor_text": "Worker Rights in Brazil 2026: Complete Employee Guide",
            "url": "https://www.ribeirocavalcante.com.br/worker-rights-in-brazil-2026/"
        },
        {
            "anchor_text": "Brazil Employment Law Foreign Employers 2026 Guide",
            "url": "https://www.ribeirocavalcante.com.br/brazil-employment-law-foreign-employers-2026/"
        },
        {
            "anchor_text": "real timeline and costs of opening a company in Brazil",
            "url": "https://www.ribeirocavalcante.com.br/open-company-in-brazil-timeline-costs-2026/"
        },
        {
            "anchor_text": "documents checklist",
            "url": "https://www.ribeirocavalcante.com.br/documents-open-company-in-brazil-2026/"
        },
        {
            "anchor_text": "angel investment rules for foreign investors",
            "url": "https://www.ribeirocavalcante.com.br/angel-investment-brazil-foreign-investors-2026/"
        },
        {
            "anchor_text": "Brazil investor visa",
            "url": "https://www.ribeirocavalcante.com.br/brazil-investor-visa-residency-2026/"
        },
        {
            "anchor_text": "compliance for foreign companies in Brazil in 2026",
            "url": "https://www.ribeirocavalcante.com.br/compliance-for-foreign-companies-in-brazil-2026/"
        }
    ],
    "cta": [
        {
            "label": "Talk to a Lawyer on WhatsApp",
            "url": "https://www.ribeirocavalcante.com.br/ads/wpp.html",
            "type": "whatsapp"
        }
    ],
    "legal_basis": [
        {
            "title": "Planalto government portal (Portuguese)",
            "url": "https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm"
        }
    ],
    "external_references": [
        {
            "title": "gov.br/anpd",
            "url": "https://www.gov.br/anpd/pt-br"
        },
        {
            "title": "fiscal address in Brazil",
            "url": "https://address.ribeirocavalcante.com.br/"
        }
    ],
    "related_posts": [
        {
            "title": "Foreign Arbitral Award Brazil: STJ Homologation 2026",
            "url": "https://www.ribeirocavalcante.com.br/foreign-arbitral-award-brazil-stj-2026/",
            "json_url": "https://www.ribeirocavalcante.com.br/foreign-arbitral-award-brazil-stj-2026.json",
            "relationship": "cluster"
        },
        {
            "title": "Documents to Open Company in Brazil: 2026 Checklist",
            "url": "https://www.ribeirocavalcante.com.br/documents-open-company-in-brazil-2026/",
            "json_url": "https://www.ribeirocavalcante.com.br/documents-open-company-in-brazil-2026.json",
            "relationship": "cluster"
        },
        {
            "title": "Open Company in Brazil: Real Timeline and Costs 2026",
            "url": "https://www.ribeirocavalcante.com.br/open-company-in-brazil-timeline-costs-2026/",
            "json_url": "https://www.ribeirocavalcante.com.br/open-company-in-brazil-timeline-costs-2026.json",
            "relationship": "cluster"
        },
        {
            "title": "Angel Investment Brazil: Foreign Investor Rules 2026",
            "url": "https://www.ribeirocavalcante.com.br/angel-investment-brazil-foreign-investors-2026/",
            "json_url": "https://www.ribeirocavalcante.com.br/angel-investment-brazil-foreign-investors-2026.json",
            "relationship": "cluster"
        },
        {
            "title": "Arbitration in Brazil: Enforce Foreign Awards 2026",
            "url": "https://www.ribeirocavalcante.com.br/doing-business-brazil/international-arbitration/",
            "json_url": "https://www.ribeirocavalcante.com.br/arbitration-in-brazil-enforce-awards-2026.json",
            "relationship": "cluster"
        }
    ]
}