// Free LGPD checklist
Free LGPD compliance checklist (Brazil's data protection law)
Seventeen questions on the LGPD for any business handling personal data of people in Brazil, wherever you're based. About five minutes, with a scored report and suggested fixes sent by email.
The Lei Geral de Proteção de Dados (LGPD) is Brazil’s data protection law. It reaches well beyond Brazil: if you sell to customers there, employ people there, or handle personal data collected there, it likely applies to you. We support businesses in Brazil remotely, in Portuguese or English.
What the checklist covers
- Governance and accountability. Knowing whether the LGPD applies and whether you act as controller or operator, and an appointed Encarregado with published contact details.
- Data mapping and legal basis. A record of processing operations, a documented legal basis for each activity, sensitive data handled only on an Article 11 basis, and defined retention periods with deletion or anonymization at the end.
- Transparency and data subject rights. A clear privacy notice, a known channel and procedure for requests, and the ability to answer a full access request within 15 days.
- Security measures. MFA on email and every system holding personal data, role-based access removed promptly, and backups with an offline or immutable copy and a tested restore.
- Operators and international transfers. A list of every operator processing data on your behalf, and a valid mechanism, such as the ANPD’s standard contractual clauses, for each international transfer.
- Incident response. A written plan saying who assesses an incident and who decides whether to report it, the ability to notify the ANPD and affected people within three business days, and a record of every incident kept for five years.
Where to look first
Map your data and name your Encarregado. Without knowing what personal data you hold and why, you can’t choose a legal basis, answer a request, or judge an incident. Many of the security controls overlap with GDPR, so work on one helps with the other.
After the checklist
Your report shows your score and a suggested fix for every gap. We handle the technical and operational side through our compliance programs. Prefer Portuguese? Leia esta página em português.
This is a self-assessment based only on your answers. Logos Tech Systems doesn’t conduct or verify it, and doesn’t endorse the report unless we’ve reviewed it with you in a consultation. It isn’t legal advice.
// Questions
Common questions
Does the LGPD apply to companies outside Brazil?
It can. The LGPD applies when personal data is processed in Brazil, when goods or services are offered to people in Brazil, or when the data was collected in Brazil, regardless of where the company is based.
What is the Encarregado?
The person appointed to act as the channel between the business, the people whose data it holds, and the ANPD, Brazil's data protection authority. It's similar to a Data Protection Officer under GDPR, and their contact details should be published.
How fast do we have to report an incident?
Under the ANPD's incident rules, a security incident that may cause relevant risk or harm must be reported to the ANPD and the affected people within three business days of confirming it.
// Next step
Doing business in Brazil?
We support businesses in Brazil remotely, in Portuguese or English, and handle the technical side of the LGPD: access control, encryption, backups, and the records that prove it.