Lei Geral de Proteção de Dados Pessoais (General Personal Data Protection Law)

Art. 3 gives LGPD explicit, GDPR-style extraterritorial reach: it applies to processing carried out in Brazilian territory (regardless of the controller's HQ or where data is stored), OR where the processing activity is aimed at offering/supplying goods or services to, or processing data of, individuals located in Brazil — broader than GDPR's 'monitoring' prong, sweeping in essentially any processing of Brazil-located individuals' data. Art. 4 exempts purely private/non-economic processing by a natural person, exclusively journalistic/artistic/academic purposes, and exclusively public-safety/national-defense/security/criminal-investigation purposes. No general nonprofit, government, small-business, or health/financial-sector exemption — those are instead treated as sensitive/regulated data categories under the general law.