Get audit-ready for LGPD
LGPD (Brazil) · Lei Geral de Protecao de Dados
Brazil's General Data Protection Law establishing rules on collection, handling, storage, and sharing of personal data, with enforcement by the ANPD.
LGPDWhat is LGPD?
Brazil's General Data Protection Law establishing rules on collection, handling, storage, and sharing of personal data, with enforcement by the ANPD.
Who it applies to
Organisations processing personal data in Brazil, or the data of people in Brazil while offering goods and services there. Extraterritorial in the same way the GDPR is.
How the standard is organised
Closely modelled on the GDPR - legal bases for processing, data subject rights and a data protection officer - supervised by the national data protection authority.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
LGPD on the Bitkosh platform
The 39 LGPD controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- Art. 18(III-IV)Correction, anonymisation, blocking and deletion rights
Correct incomplete or outdated data and anonymise, block or delete data that is unnecessary, excessive or unlawfully processed.
Data Subject Rights - Art. 42-45Liability and compensation for damage
Understand joint liability of controllers and operators for damage caused by breaches, and the grounds for exemption.
Controller & Operator - Art. 41Appointment of the encarregado (DPO)
Appoint an encarregado, publish their identity and contact details, and define duties for handling complaints and ANPD communication.
Controller & Operator - Art. 27Data sharing between public and private entities
Obtain consent or meet a listed exception before communicating personal data from public bodies to private entities, and inform the ANPD.
Public Sector - Art. 18(VII-IX)Information on sharing, consent refusal and revocation
Inform individuals about entities data is shared with, consequences of refusing consent, and honour consent revocation.
Data Subject Rights - Art. 55-JANPD supervision and cooperation
Cooperate with ANPD inspections, information requests and regulations, and track its guidance on enforcement and simplified regimes.
Governance & Sanctions
More privacy & data protection frameworks
Frequently Asked Questions
Who publishes LGPD, and who does it apply to?
How is LGPD conformance demonstrated?
How is LGPD structured?
Ready to get audit-ready for LGPD?
See how the Bitkosh Readiness Platform gets you audit-ready for LGPD — and the other 47 ready frameworks — from a single control library.