The LGPD applies to your website if any one of three things is true: you process personal data in Brazil, you offer goods or services to people in Brazil or process the data of people located there, or the data was collected while the person was in Brazil. That is Article 3 of Brazil's General Data Protection Law, and it applies wherever your company is based and wherever your servers sit. Article 4 then removes a short list of activities, none of which covers an ordinary commercial website.
This guide is about that question of reach. For what the law requires once it applies, read what the LGPD is and how it works.
Article 3 has three triggers, and one is enough
The Lei Geral de Proteção de Dados (Law No. 13,709/2018) has applied since 18 September 2020, with administrative sanctions since 1 August 2021. Its Article 3 says the law covers any processing by a person or a public or private organisation "regardless of the means, the country of its headquarters or the country where the data is located", as long as one condition is met.
Trigger 1: the processing takes place in Brazil. Servers in Brazil, staff processing data from a Brazilian office or a local data centre are enough. This is ordinary territorial jurisdiction.
Trigger 2: the processing aims to offer goods or services to people in Brazil, or processes the data of people located in Brazil. This is where the reach becomes extraterritorial. A European shop that ships to Brazilian addresses, a SaaS platform with Brazilian subscribers, or a news site that sets a _ga cookie on visitors browsing from São Paulo all meet it, without a single employee or server in the country.
Trigger 3: the personal data was collected in Brazil. Article 3, paragraph 1, says data counts as collected in Brazil when the person was there at the moment of collection. A tourist who signs up for a service while in Rio de Janeiro generates data the LGPD covers, even if the service is run from another country.
Does Article 3 of the LGPD reach your website?
How the LGPD's reach differs from the GDPR's
The GDPR's territorial scope reaches organisations outside the EU through two triggers in its own Article 3: offering goods or services to people in the EU, and monitoring their behaviour there. The LGPD does not use the word "monitoring", but its second trigger covers "the processing of data of individuals located in the national territory". Tracking Brazilian visitors with analytics or advertising cookies is processing their data, so a site that only watches and sells nothing is still caught.
The third trigger, data collected in Brazil, has no direct GDPR equivalent. It ties the law to where the person stood at the time, not to whom the business was aiming at.
The GDPR requires most non-EU organisations in scope to appoint a representative in the EU (Article 27). The LGPD has no such rule. It does require controllers to appoint a data protection officer (encarregado) and publish their contact details (Article 41), but the ANPD's Resolution CD/ANPD No. 2/2022 exempts small processing agents from that duty, as long as they offer a channel for requests from data subjects.
| Trigger or duty | LGPD (Article 3) | GDPR (Article 3) |
|---|---|---|
| Processing in the territory | Yes | Yes, through an establishment in the EU |
| Offering goods or services to people in the territory | Yes | Yes |
| Processing data of people located in the territory, including tracking | Yes | Yes, as monitoring of behaviour |
| Data collected while the person was in the territory | Yes | No direct equivalent |
| Local representative for foreign organisations | No | Yes (Article 27) |
Article 4 lists four exemptions, all narrow
Article 4 takes four kinds of processing out of the LGPD. None of them helps a business that sells, advertises or measures traffic.
Private, non-economic use. A person processing data for purely personal reasons, such as a family photo album or a personal contact list, is outside the law. Once the activity becomes economic, the exemption ends.
Journalism, art and academic research. Processing carried out exclusively for journalism or art is exempt. Academic processing is only partly exempt: Articles 7 and 11 on legal bases still apply.
Public security, national defence, state security and criminal investigation. These fall under separate legislation. A private organisation may process such data only in procedures overseen by a public body, which must be reported specifically to the ANPD.
Foreign data in transit. Data that comes from outside Brazil and is not communicated to or shared with Brazilian processing agents, or transferred on to a third country, is exempt, provided the country of origin offers a level of protection adequate to the LGPD's. Once a Brazilian agent receives or uses the data, or it moves to another country, the exemption falls away and the rules on international data transfers come into play.
Five website scenarios
The triggers read broadly, so it helps to test them against common situations.
You run an online shop that ships to Brazil. The LGPD applies. You offer goods to people in Brazil and collect their names, addresses and payment details to do it.
You run a SaaS product with Brazilian customers. The LGPD applies. Contract performance is one of its ten legal bases and covers the service itself, but analytics cookies, marketing trackers and profiling are another matter: the ANPD's cookie guide treats consent as the most appropriate basis for non-necessary cookies.
You have a blog with global traffic, including visitors from Brazil. If the site sets analytics cookies such as _ga or advertising pixels such as _fbp, you process the personal data of people located in Brazil, and the second trigger is met.
You sell only to Brazilian businesses. The LGPD still applies. Business-to-business work involves the personal data of your clients' employees and contacts, such as names, email addresses and phone numbers.
You have no Brazilian customers and do not target Brazil. If a visitor from Brazil lands on your site and you set tracking cookies, a strict reading of Article 3 brings that processing into scope. Enforcement against a business with no commercial link to Brazil is unlikely, but the legal exposure exists. Geo-targeting lets you show visitors from Brazil a banner with the choices the ANPD expects, without changing what visitors elsewhere see.
The ANPD enforces against foreign groups
A law's reach matters only if someone enforces it. The ANPD is now the Agência Nacional de Proteção de Dados (National Data Protection Agency). Law No. 15,352 of 25 February 2026 made it a regulatory agency with functional, technical, decision-making, administrative and financial autonomy (Article 55-A).
Its first fine came in July 2023, against Telekall Infoservice, a small telemarketing company: two simple fines of BRL 7,200 each, for processing without a legal basis and for breaching the ANPD's enforcement regulation, totalling BRL 14,400, plus a warning for having no data protection officer. The amount was small, and the signal was that size offers no shelter.
In July 2024, the ANPD ordered Meta to suspend the use of Brazilian users' data from its platforms to train generative AI models, with a daily fine of BRL 50,000 for non-compliance. The order was lifted later that year after Meta changed its approach.
The largest decision so far reached a foreign group's Brazilian company. On 24 August 2026, the ANPD's enforcement superintendent fined ByteDance Brasil BRL 153,769,671.33 over the personal data of children and teenagers under 18 used to register them on TikTok without a valid legal basis, and ordered it to delete the data of 13 to 18-year-olds whose legal representation was not regularised within 60 working days. It is a first-instance decision that can be appealed, but as of October 2026 it shows the agency acting against the local arm of a foreign platform.
Penalties run to 2% of Brazilian revenue
Article 52 sets out the sanctions the ANPD can impose. A simple fine reaches 2% of the revenue of the company, group or conglomerate in Brazil in its last financial year, excluding taxes, capped at BRL 50 million per infringement. Daily fines are possible within the same cap.
Beyond fines, the ANPD can issue warnings, publish the infringement, block or delete the personal data concerned, suspend part of a database or a processing activity for up to six months (extendable once), and partly or fully ban processing activities.
Fines are calculated on Brazilian revenue, not worldwide turnover, unlike the GDPR's penalty framework. For a multinational with a modest Brazilian business, the financial exposure is lower than under the GDPR. The power to suspend or ban processing can still hurt a company that depends on the Brazilian market far more than a fine.
Questions about the LGPD's reach
Does the LGPD apply to companies with no office or servers in Brazil?
Yes. Article 3 applies the LGPD to anyone who offers goods or services to people in Brazil, processes the data of people located there, or collects data while the person is in Brazil, wherever the company or its servers are.
Does a website need to target Brazil for the LGPD to apply?
No. Processing the data of people located in Brazil is enough on its own, so tracking Brazilian visitors with analytics or advertising cookies can bring a site into scope even if it sells nothing there.
Are any businesses exempt from the LGPD?
Article 4 exempts purely personal non-economic processing, exclusive journalism and art, academic research (partly), public security and criminal investigation, and foreign data in transit that is not shared in Brazil. A commercial website does not fit any of them.
Do foreign companies need a representative in Brazil?
No. Unlike the GDPR, the LGPD does not require a local representative. Controllers must appoint a data protection officer and publish the contact details, although small processing agents are exempt under Resolution CD/ANPD No. 2/2022.
Can the ANPD enforce the LGPD against foreign companies?
Yes. It ordered Meta to stop training AI on Brazilian users' data in July 2024, and on 24 August 2026 it fined ByteDance Brasil BRL 153.8 million at first instance over teenagers' data on TikTok.
Show visitors from Brazil the choices the LGPD expects
Kukie.io detects visitors from Brazil and, under an opt-in rule (the default for them on new sites), shows them a banner with Accept all and Reject all given equal weight, holds non-necessary cookies until they choose and records every choice. The banner can speak Brazilian Portuguese, one of its built-in languages, once you add it in the Banner Editor. Other regions keep their own rules, as on the global compliance overview.
