Jurisdiction Guide
Brazil Privacy & Data Protection Laws
Every regime below can apply to a business handling Brazil residents' data, depending on whether you have an established presence there, actively offer goods or services to residents, or monitor their behavior. This is a general reference, not a determination for your specific business — run the full questionnaire to see which of these actually apply to you.
Comprehensive Privacy Law · 1
Art. 3 gives LGPD explicit, GDPR-style extraterritorial reach: it applies to processing carried out in Brazilian territory (regardless of the controller's HQ or where data is stored), OR where the processing activity is aimed at offering/supplying goods or services to, or processing data of, individuals located in Brazil — broader than GDPR's 'monitoring' prong, sweeping in essentially any processing of Brazil-located individuals' data. Art. 4 exempts purely private/non-economic processing by a natural person, exclusively journalistic/artistic/academic purposes, and exclusively public-safety/national-defense/security/criminal-investigation purposes. No general nonprofit, government, small-business, or health/financial-sector exemption — those are instead treated as sensitive/regulated data categories under the general law.