LGPD Adequacy

The LGPD (Lei Geral de Proteção de Dados, Law No. 13.709/2018) is Brazil's general personal data protection statute. It has been in force since September 2020 and is enforced by the national authority, the ANPD. Adequacy is not the law itself but the response to it: the organized work of bringing an organization's processing of personal data within the limits the law sets. It is part of wider data protection practice.

The law defines duties and adequacy defines the work. Like GDPR or CCPA compliance, the term describes a programme of inventories, policies, contracts, and procedures. It is not a one-time audit or a certificate to earn.

The law

a statute that sets the principles, legal bases, data subject rights, the duties of each processing agent and the sanctions the ANPD can impose.

Adequacy

the organization-side programme: data inventory, legal basis review, role assignment, operator contracts, incident readiness, and records proving it all works.

The LGPD applies to any processing of personal data carried out in Brazil. It also applies to processing abroad when the data is collected from individuals in Brazil, or when the processing aims to offer them goods or services. A company with no Brazilian office is covered if its website signs up users in São Paulo. The obligations follow the data, not the registration address.

The scope is deliberately broad. It covers private companies of every size and sector, non-profits and public bodies, and controllers and operators each hold their own duties. Small-scale agents are not exempt. The ANPD has published simplified rules that adjust their obligations but do not remove them.

Adequacy starts with an honest picture of the present state. A data inventory records each category of personal data, its purpose and source, the systems it lives in, how long it is kept and who receives it. Data classification then shows which of those categories are sensitive. The flow map extends the inventory to movement: how data travels between systems, vendors, and channels such as email, cloud storage, and removable media.

The assessment compares that picture with the law. It checks whether each activity has a legal basis, whether sensitive data gets the stricter care Article 11 requires, whether retention periods are defined, whether operator contracts exist, and whether a rights request could actually be fulfilled from these systems. The output is a gap report and a remediation plan with owners and dates. For large-scale or high-risk processing, the ANPD can also demand a data protection impact report (RIPD), which is far easier to write once the inventory exists.

The Anexet console includes predefined patterns for identifiers such as bank accounts and passport numbers, a practical reference when you decide which identifiers to look for.

Adequacy runs as a cycle rather than a single project. Processes change, vendors change, and the ANPD keeps issuing rules, so mature programmes repeat the same five steps:

1. 1

   Inventory the data

   List every category of personal data, its purpose, its source and where it is stored.

2. 2

   Map the flows

   Trace how the data moves between systems, vendors, and channels.

3. 3

   Close the gaps

   Fix missing legal bases, retention rules, and operator contracts, each with an owner and a date.

4. 4

   Prove it works

   Keep records that show the controls operate, such as logs and an audit trail.

5. 5

   Repeat the cycle

   Run the same steps again when processes, vendors or ANPD rules change.

The LGPD was drafted with the GDPR openly in view, so the two frameworks rhyme. They share principles such as purpose limitation and data minimization, a catalog of data subject rights, a data protection officer, and notification to the authority when a data breach occurs. An organization that already runs a GDPR programme will recognize most of an adequacy plan.

The differences sit in the details, which is why a European programme cannot simply be relabeled as Brazilian:

Every processing activity must rest on at least one of the ten legal bases that Article 7 lists for ordinary personal data. They include consent, legal obligation, contract performance, protection of life or physical safety, research studies, the controller's legitimate interest and credit protection. For sensitive data, such as health, biometric, and genetic information, Article 11 narrows the list. In most cases that means specific and highlighted consent, with narrow alternatives for health care, research and life protection.

Legitimate interest is the most used and least understood basis. It requires the controller to weigh its purpose against the rights and expectations of data subjects, and to document that weighing. Consent must be tied to a specific purpose and can be revoked at any time. The law backs these bases with enforceable rights: confirmation, access, correction, anonymization, blocking or deletion, portability, and information about who the data has been shared with.

The LGPD names its actors in Portuguese, and these names appear in every adequacy plan because each role has distinct duties. The operator's liability is subsidiary but real, and the encarregado's appointment must be publicly disclosed.

Start with the personal data that would cause the most harm if it leaked, then map the channels it actually travels through. Adequacy planned for every dataset at once tends to stall, so a first pass on the riskiest flows usually delivers the most value.

The same kind of work is required under CCPA compliance in California, so an inventory built for one regime can often serve the other.

Further reading: Use Anexet Ultimate DLP system for GDPR compliance.