Understanding Brazil's Lei Geral de Proteção de Dados and how it applies to mobile applications serving Brazilian users.
The Lei Geral de Proteção de Dados (LGPD) is Brazil's comprehensive data protection law, enacted in 2018 and fully effective since 2020. It regulates how organizations collect, store, and process personal data of individuals in Brazil.
Any mobile app that processes personal data of Brazilian residents must comply with LGPD, regardless of where the company is based. The law is enforced by the ANPD (Autoridade Nacional de Proteção de Dados).
R$50M
per infraction
Maximum fine (2% of revenue)
210M+
Brazilian users
Protected under LGPD
Brazil is Latin America's largest fintech market with over 750 fintech companies. The rise of PIX (instant payments), Open Finance regulations, and mobile-first banking has made security compliance critical for app developers.
750+
Fintech Companies
38%
of LATAM Market
PIX
150M+ Users
Article 6 of the LGPD establishes ten principles that must guide all personal data processing activities.
Art. 6, VII
Use of technical and administrative measures to protect personal data from unauthorized access.
Art. 6, VIII
Adoption of measures to prevent the occurrence of damages due to data processing.
Art. 6, I
Data processing for legitimate, specific, and explicit purposes informed to the data subject.
Art. 6, III
Limit data processing to the minimum necessary to achieve its purposes.
Art. 6, VI
Guarantee clear, precise, and easily accessible information about data processing.
Art. 6, X
Demonstration of adoption of effective measures for compliance with data protection rules.
Articles 46-49 of the LGPD establish security requirements that appaudix helps you verify.
Security Measures
Processing agents must adopt security, technical, and administrative measures to protect personal data.
Incident Notification
Controllers must communicate security incidents to ANPD and affected data subjects.
Security Systems
Systems must meet security requirements, good practices, and governance principles.
Brazilian data subjects have specific rights that your app must support.
Confirmation & Access
Users can confirm processing and access their personal data.
Correction
Users can request correction of incomplete or inaccurate data.
Anonymization
Users can request anonymization, blocking, or deletion of unnecessary data.
Portability
Users can request data portability to another service provider.
Deletion
Users can request deletion of data processed with consent.
Revocation
Users can revoke consent at any time.
The Autoridade Nacional de Proteção de Dados (ANPD) actively enforces LGPD compliance. Their 2025-2026 regulatory agenda prioritizes security measures, data subject rights, and high-risk processing activities.
appaudix scans your mobile app against LGPD security requirements, helping you identify vulnerabilities before ANPD does.
LGPD compliance scanning available on Pro and Enterprise plans
We use necessary storage for security and login. With your permission, we also use analytics to understand page journeys and marketing pixels to measure ad campaigns.