The Complete LGPD Compliance Checklist for Multinational Organizations
A step-by-step framework covering all 65 articles of Brazil's data protection law, built for privacy teams managing compliance across multiple entities and jurisdictions.
Managing LGPD compliance alongside GDPR, CCPA, and other frameworks creates blind spots. A peer-reviewed study found that although 93% of organizations consider LGPD compliance a priority, only 8.8% have achieved full compliance. This checklist gives your DPO team a clear view of what's done, what's overdue, and what's at risk across every subsidiary.
No credit card required. Instant PDF download. Used by privacy teams at 50+ multinational organizations.
65
LGPD Articles Covered
80+
Actionable Line Items
10
Compliance Categories
LGPD compliance gap: ScienceDirect empirical study, n=152 organizations, published February 2026. ANPD became an independent regulatory agency in September 2025 with expanded enforcement powers.
Why Most LGPD Compliance Efforts Stall
LGPD compliance is more than another GDPR checkbox. Organizations that treat it as one discover costly gaps when ANPD comes knocking.
GDPR Alone Leaves Gaps
While LGPD draws inspiration from GDPR, Brazil's lawmakers made key adjustments. LGPD defines 10 legal bases (compared to GDPR's 6), mandates a DPO for nearly all controllers, and requires breach notification within three business days. Generic "GDPR-plus" approaches miss these critical differences and leave real exposure.
International Bar Association: "mere compliance with the EU model does not automatically entail full compliance with its Brazilian counterpart."
ANPD's 2025-2026 Regulatory Agenda now prioritizes data subject rights, DPIAs, AI regulation, biometric data, and children's data processing, with enforcement timelines already underway.
Source: ANPD Regulatory Agenda 2025-2026 via Baker McKenzie Global Data Handbook
Multi-Entity Complexity Multiplies Risk
If your organization operates across Brazil and other jurisdictions, you are not managing one compliance program. You are managing dozens. Each subsidiary has its own processing activities, vendors, and risk profile. Spreadsheets and shared drives cannot keep pace with this reality.
The SCC grace period for international data transfers ended on August 23, 2025. From that date forward, international data transfers are only valid with properly implemented Standard Contractual Clauses or other ANPD-approved mechanisms.
Companies like Salesforce and Microsoft now require SCCs for Brazilian user data.
Source: Mayer Brown, August 2025; ANPD Resolution CD/ANPD No. 19/2024
Enforcement Is No Longer Theoretical
R$50M Maximum fine per violation (2% of revenue in Brazil)
Source: LGPD Article 52, via ICLG Data Protection Report 2025-2026
In September 2025, ANPD was formally transformed into an independent regulatory agency with expanded enforcement powers, including the ability to order establishments to cease operations and request police assistance in cases of obstruction. The agency also gained 200 new specialist positions for oversight and enforcement.
Of ANPD's seven sanctioning decisions published to date, five dealt with violations of Article 48 regarding breach notification failures.
Source: IAPP, October 2024; Trench Rossi Watanabe, October 2025
Compliance Decays Without Continuous Recertification
LGPD compliance is not a one-time project. Processing activities change, vendors rotate, and legal bases expire. The 2025 State of Data Compliance Report found that 60% of organizations experienced data breaches in non-production environments in the past year, an 11% increase from 2024. Meanwhile, 84% of organizations still allow compliance exceptions in those same environments.
Source: Perforce Delphix 2025 State of Data Compliance and Security Report
Without a system for continuous recertification, your compliance posture degrades within months. ANPD can request a Data Protection Impact Assessment (RIPD) at any time under Article 38, and organizations must be prepared to produce one on demand.
60%
of organizations experienced data breaches in non-production environments in the past year
Perforce Delphix, 2025 Report
The checklist below gives you the structure to identify every gap. The platform behind it gives you the system to close them.
Download the Free LGPD ChecklistReal outcomes from real compliance teams
200+
Hours saved on ISO 27001 prep
Medtec reclaimed over 200 hours previously spent on manual documentation, evidence gathering, and policy drafting during ISO 27001 preparation. Industry benchmarks show the typical certification process takes 6 to 12 months of effort.
Medtec, measured during ISO 27001 preparation cycle
60%
Less compliance admin time
Aircraft manufacturer cut compliance admin time by 60% in six months with automated ROPA recertification. Their DPO shifted from chasing spreadsheets to strategic privacy work, while enterprise OneTrust deployments can run into six-figure annual costs with additional implementation fees.
Aircraft manufacturer, first 6 months on Priverion
100%
ROPA recertification rate
AXA achieved full ROPA recertification coverage through automated workflows. Manual ROPA management can consume hundreds of hours annually, and as the IAPP notes, maintaining these records requires constant cross-departmental coordination.
AXA, fully automated recertification via Priverion
Built for mid-market reality, not enterprise complexity
With cumulative GDPR fines exceeding 7.1 billion euros and enforcement accelerating, you need a platform that makes compliance achievable without a six-figure budget or a dedicated implementation team.
Source: DLA Piper GDPR Fines and Data Breach Survey, January 2026
Priverion
Purpose-built for multi-entity privacy management
-
Swiss data sovereignty, guaranteed
Swiss-built and Swiss-hosted. All data processing stays within Swiss infrastructure, with Swiss data residency and EU adequacy. Since Schrems II, that distinction matters.
-
Operational in weeks, not months
Medtec saved 200+ hours during ISO 27001 preparation. Aircraft manufacturer was fully operational within their first engagement, cutting 60% of compliance admin time in 6 months.
Aircraft manufacturer, first 6 months; Medtec, ISO 27001 prep
-
Predictable pricing, no expansion traps
Priced by number of entities and organizational size. Not per-user, not per-module. Your costs stay predictable as your team grows.
-
All-in-one privacy platform
ROPA, DPIA/TIA, vendor risk, incident management, DSR handling, cross-entity data mapping, and AI Register for EU AI Act readiness. One platform, one price.
-
AI-assisted, human-decided
AI drafts DPIAs, scores risks, and maps regulations. Every output is reviewed before it becomes a compliance record. No customer data is used for model training.
-
Built for group-wide complexity
Manage compliance across 50+ entities and multiple jurisdictions. AXA achieved 100% ROPA recertification, fully automated. Zurzach Care reached 100% vendor risk assessment coverage.
AXA and Zurzach Care, verified customer outcomes
OneTrust
Enterprise-scale platform built for Fortune 500
-
US-headquartered, US-hosted infrastructure
Data processed by a US-headquartered provider remains subject to the CLOUD Act. Even "sovereign cloud" offerings from US providers cannot guarantee protection from US government data requests.
Microsoft France GM confirmed this under oath before the French Senate, 2025
-
Lengthy, resource-intensive implementation
Mid-market users consistently report spending weeks configuring workflows before becoming productive. Implementation fees can add $10,000 to $50,000 to first-year costs.
Enzuzo pricing analysis, March 2026; G2 user reviews
-
Modular pricing that can expand unpredictably
Mid-market organizations (1,000 to 5,000 employees) typically pay $40,000 to $120,000 per year. Each module is billed on its own metric, and costs can scale in directions you did not anticipate.
Vendr marketplace data, February 2026; Enzuzo analysis
-
Broad but fragmented product suite
Five separate product lines, each priced independently. Many mid-market organizations end up paying for capabilities they do not need while missing features they do.
OneTrust product structure, as of 2026
-
Powerful, but complex UX
Users report a steep learning curve and a cluttered interface. Smaller teams find the platform overwhelming, especially without dedicated training resources.
G2 and Capterra user reviews, 2025 and 2026
-
Designed for large enterprise scale
OneTrust serves 14,000+ customers globally and is designed for Fortune 500 buyer profiles. For mid-market privacy teams without dedicated implementation staff, that depth can be more burden than benefit.
OneTrust product page, 2026
A note on what we don't do:
Priverion does not cover ESG, ethics hotlines, or cookie consent. We are not built for single-entity companies. Our strength is group-wide privacy program management with deep integrations where they matter: HR, procurement, and IT asset management.
The LGPD Compliance Checklist for Multi-Entity Organizations
Brazil's data protection authority has escalated enforcement significantly, with fines totaling approximately BRL 98 million between 2023 and 2025. The ANPD's 2026-2027 priority map targets AI, children's data, and data subject rights. If your organization processes personal data in Brazil, this checklist covers the operational requirements you need to address.
Sources: Baker McKenzie Global Data Handbook; IAPP LGPD enforcement analysis
What you will get:
- + A step-by-step data mapping and ROPA framework aligned with LGPD Articles 7 and 37, covering all 10 lawful bases for processing
- + Breach notification workflow template meeting the ANPD's required reporting timeline, plus a DSAR response process for the 15-day deadline
- + Vendor contract audit checklist incorporating ANPD's Standard Contractual Clauses (Resolution 19/2024) for international data transfers
- + DPIA (RIPD) preparation guide for high-risk processing, including AI systems, biometric data, and large-scale monitoring activities
LGPD penalties reach up to 2% of revenue in Brazil, capped at BRL 50 million per violation. Non-monetary sanctions include public disclosure of violations, processing bans, and mandatory data deletion.
Source: Baker McKenzie, Global Data and Cyber Handbook: Brazil
Get the Checklist
Enter your work email and we will send the LGPD compliance checklist directly to your inbox.
Free PDF. No demo required. We'll send it to your inbox.
We respect your privacy. See our data protection notice.
Stop managing compliance in spreadsheets
Your DPO has better things to do than chase ROPA updates across 47 spreadsheets
With cumulative GDPR fines now exceeding 7.1 billion euros and enforcement accelerating across every sector, manual compliance processes are a liability you can't afford. See how Priverion gives multi-entity organizations automated recertification, cross-border data transfer confidence, and audit-ready evidence packages, all hosted on Swiss infrastructure.
Source: DLA Piper GDPR Fines and Data Breach Survey, January 2026
60%
reduction in compliance admin time
Aircraft manufacturer, first 6 months
200+
hours saved in ISO 27001 prep
Medtec
100%
automated ROPA recertification
AXA
No commitment required. See the platform with your own data scenarios in 30 minutes.
Swiss-built and Swiss-hosted
Predictable pricing, no per-user fees
Operational in weeks, not months
▸ About this page: references, definitions, and FAQs
Key Takeaways
This page provides a comprehensive LGPD compliance checklist with 80+ actionable items covering all 65 articles of Brazil's Lei Geral de Proteção de Dados. It is designed for multinational privacy teams managing compliance across multiple entities and jurisdictions, addressing the critical differences between LGPD and GDPR, ANPD enforcement developments, international data transfer requirements, and continuous recertification needs.
Definitions
What is the LGPD?
LGPD (Lei Geral de Proteção de Dados Pessoais, Law No. 13,709/2018) is Brazil's comprehensive data protection law. It regulates the processing of personal data by individuals and legal entities, whether public or private, and applies to any processing carried out in Brazil, targeting individuals located in Brazil, or involving data collected in Brazil. The LGPD defines 10 legal bases for processing and established the ANPD as the supervisory authority. Source: IAPP, LGPD English Translation
What is the ANPD?
ANPD (Autoridade Nacional de Proteção de Dados) is Brazil's national data protection authority, responsible for overseeing, implementing, and enforcing the LGPD. In September 2025, the ANPD was formally transformed into an independent regulatory agency with expanded enforcement powers and 200 new specialist positions. Source: IAPP
What is a RIPD (Data Protection Impact Assessment)?
RIPD (Relatório de Impacto à Proteção de Dados Pessoais) is the Brazilian equivalent of a Data Protection Impact Assessment (DPIA). Under LGPD Article 38, the ANPD can request a RIPD at any time, and organizations must be prepared to produce one on demand for processing activities that may pose risks to data subjects' fundamental rights.
What are Standard Contractual Clauses under the LGPD?
Standard Contractual Clauses (SCCs) under the LGPD are contractual mechanisms approved by the ANPD for legitimizing international transfers of personal data from Brazil. Following ANPD Resolution CD/ANPD No. 19/2024, the grace period for international data transfers ended on August 23, 2025, making SCCs or other ANPD-approved mechanisms mandatory for cross-border data flows.
LGPD vs. GDPR: Key Differences
| Aspect | LGPD (Brazil) | GDPR (EU) |
|---|---|---|
| Legal bases for processing | 10 legal bases including credit protection | 6 legal bases |
| DPO requirement | Mandatory for nearly all controllers | Required only in specific circumstances |
| Breach notification deadline | Within a "reasonable time" (ANPD guidance: 3 business days) | 72 hours to supervisory authority |
| Maximum fine | 2% of revenue in Brazil, capped at R$50M per violation | 4% of global annual turnover or €20M |
| Supervisory authority | ANPD (independent agency since Sept 2025) | National DPAs in each EU member state |
| International transfer mechanisms | SCCs, adequacy decisions, BCRs, specific contractual clauses | SCCs, adequacy decisions, BCRs, codes of conduct |
| Data subject rights | Confirmation, access, correction, anonymization, portability, deletion, information on sharing, consent revocation, review of automated decisions | Access, rectification, erasure, restriction, portability, objection, automated decision-making |
Frequently Asked Questions
What is the LGPD and how does it differ from the GDPR?
The LGPD (Lei Geral de Proteção de Dados) is Brazil's comprehensive data protection law, enacted in 2018 and effective since September 2020. While inspired by the GDPR, the LGPD defines 10 legal bases for processing compared to GDPR's 6, mandates a Data Protection Officer for nearly all controllers, and requires breach notification to the ANPD within three business days. As the International Bar Association notes, "mere compliance with the EU model does not automatically entail full compliance with its Brazilian counterpart."
What are the penalties for LGPD non-compliance?
Under LGPD Article 52, penalties include fines of up to 2% of revenue in Brazil, capped at R$50 million per violation. Additional sanctions include publicization of the infringement, blocking or deletion of personal data, and suspension of processing activities. Since September 2025, the ANPD operates as an independent regulatory agency with expanded enforcement powers. According to the IAPP, of ANPD's seven sanctioning decisions published to date, five dealt with violations of Article 48 regarding breach notification failures.
How many legal bases does the LGPD define for data processing?
The LGPD defines 10 legal bases for personal data processing: consent, legitimate interest, contract performance, regulatory compliance, public policy execution, health protection, research, credit protection, legal proceedings, and protection of life. This is broader than the GDPR's 6 legal bases and reflects Brazil's specific regulatory context, including the inclusion of credit protection as a standalone legal basis.
What is the ANPD and what enforcement powers does it have?
The ANPD (Autoridade Nacional de Proteção de Dados) is Brazil's national data protection authority. In September 2025, it was formally transformed into an independent regulatory agency with expanded enforcement powers, including 200 new specialist positions for oversight and enforcement. The ANPD can impose fines, order cessation of data processing operations, and request police assistance in cases of obstruction.
Are Standard Contractual Clauses required for international data transfers from Brazil?
Yes. The grace period for international data transfers ended on August 23, 2025, per ANPD Resolution CD/ANPD No. 19/2024. From that date, international data transfers are only valid with properly implemented Standard Contractual Clauses or other ANPD-approved mechanisms. Major technology companies including Salesforce and Microsoft now require SCCs for Brazilian user data.
How does Priverion help with LGPD compliance for multinationals?
Priverion is a Swiss-hosted GRC platform purpose-built for multi-entity privacy management. It provides automated ROPA recertification, DPIA/TIA workflows, vendor risk management, incident management, DSR handling, and cross-entity data mapping. All data processing stays within Swiss infrastructure, with Swiss data residency. AXA achieved 100% ROPA recertification coverage through automated workflows, and Aircraft manufacturer cut compliance admin time by 60% in six months.
What does the ANPD's 2025 to 2026 Regulatory Agenda prioritize?
The ANPD's 2025 to 2026 Regulatory Agenda prioritizes data subject rights, Data Protection Impact Assessments (RIPDs), AI regulation, biometric data processing, and children's data processing. Enforcement timelines are already underway, making proactive compliance preparation essential for organizations processing personal data under the LGPD.
Why is continuous recertification important for LGPD compliance?
LGPD compliance is not a one-time project. Processing activities change, vendors rotate, and legal bases expire. According to the Perforce Delphix 2025 State of Data Compliance and Security Report, 60% of organizations experienced data breaches in non-production environments in the past year, an 11% increase from 2024. Meanwhile, 84% of organizations still allow compliance exceptions in those same environments. Without a system for continuous recertification, compliance posture degrades within months.
Key Statistics
According to a peer-reviewed ScienceDirect empirical study (n=152 organizations, published February 2026), 93% of organizations consider LGPD compliance a priority, yet only 8.8% have achieved full compliance. Cumulative GDPR fines have exceeded €7.1 billion as of January 2026, per the DLA Piper GDPR Fines and Data Breach Survey. The ANPD gained 200 new specialist positions upon becoming an independent agency in September 2025. The Perforce Delphix 2025 report found that 60% of organizations experienced data breaches in non-production environments, with 84% still allowing compliance exceptions. The LGPD maximum fine is R$50 million per violation (2% of revenue in Brazil), as specified in LGPD Article 52.
