Brazil's LGPD for foreign companies: scope and checklist

Summary

The LGPD can apply to processing of personal data relating to people in Brazil even when the company has no local headquarters. A defensible minimum includes mapped legal bases, an appointed data protection officer and a channel for data subjects.

Extraterritorial application

Article 3 of the LGPD applies when processing occurs in Brazil, goods or services are offered to people in Brazil, or personal data was collected in Brazilian territory.

Frequently asked questions

Must a foreign company appoint a data protection officer in Brazil?

The LGPD requires a data protection officer but does not expressly require Brazilian residence. The ANPD nevertheless expects an accessible Portuguese-language channel.