DocumentationSupportCosta Rica · Contact
ESENPT
Let’s talk
  • Legal

LGPDLei Geral de Proteção de Dados Pessoais

In short

The LGPD is Brazil's personal data protection law, applicable to public and private organizations. It treats health data as sensitive data: they can only be processed with specific and highlighted consent or in the cases the law lists, such as health protection by health professionals and services. It is overseen by the ANPD, which under Law 15,352/2026 (conversion of Provisional Measure 1,317/2025) is a special-nature autonomous agency named Agência Nacional de Proteção de Dados.

Type
Legal framework
Steward
Congresso Nacional (Brazil); oversight: Agência Nacional de Proteção de Dados (ANPD)
Current version
Lei 13.709/2018
Jurisdiction
Brazil
Reviewed
October 25, 2026

Explanation

What it is

Lei nº 13.709 of 14 August 2018 (Lei Geral de Proteção de Dados Pessoais) governs the processing of personal data in Brazil by natural persons and by public or private legal entities. It applies when processing takes place in Brazil, when it aims to offer goods or services to people in Brazil or to process their data, or when the data were collected in the country (Art. 3). Its administrative sanctions (Arts. 52 to 54) have applied since 1 August 2021.

Health data

Article 5(II) lists "data concerning health" among sensitive personal data. Article 11 allows them to be processed:

  • with the data subject's consent, given in a specific and highlighted manner, for specific purposes (item I);
  • without consent, where indispensable for cases such as legal obligations, public policies, studies by research bodies, protection of life or health protection, "exclusively, in a procedure carried out by health professionals, health services or a health authority" (item II).

Article 11 §4 prohibits controllers from communicating or sharing health data to obtain an economic advantage, except in the cases it lists, and §5 prohibits private health plan operators from using health data for risk selection. Article 13 governs research bodies' access to databases for public health studies.

Authority and sanctions

Provisional Measure 1,317/2025, converted into Law 15,352 of 25 February 2026, made the ANPD a special-nature autonomous agency named Agência Nacional de Proteção de Dados, linked to the Ministry of Justice and Public Security. Sanctions include fines of up to 2% of revenue in Brazil, capped at BRL 50 million per infraction (Art. 52).

ANPD regulations

CD/ANPD ResolutionSubject
2/2022Small processing agents
4/2023Calculation and application of sanctions
15/2024Security incident communication
18/2024Data protection officer (encarregado)
19/2024International transfer and standard contractual clauses
32/2026Recognizes the European Union as providing adequate protection

Latest amendment

As of October 2026, the latest law amending the text is Law 15,352/2026.

Common misconceptions

  • Believing all health data processing requires consent. Article 11(II) provides for health protection.
  • Believing it only applies to companies. Chapter IV governs processing by public authorities.
  • Using the old name. Since Law 15,352/2026, the ANPD acronym stands for Agência Nacional de Proteção de Dados.

Usage examples

  1. A hospital can process health data without consent when indispensable for health protection in a procedure carried out by health professionals or services (Art. 11(II)(f)).

  2. Private health plan operators cannot use health data to select risks when contracting or excluding beneficiaries (Art. 11 §5).

  3. CD/ANPD Resolution 15/2024 regulates the communication of security incidents to the ANPD and to data subjects.

  4. CD/ANPD Resolution 19/2024 approved the international transfer regulation and the standard contractual clauses.

  5. On 26 January 2026, the ANPD recognized the European Union as adequate (CD/ANPD Resolution 32/2026), and the European Commission adopted an adequacy decision for Brazil dated the same day.

Relation to other terms

Relies on0

This term does not rely on other glossary terms.

Depend on this one0

No glossary term depends on this one.

Sources

  1. Planalto — Lei nº 13.709, de 14 de agosto de 2018 (Lei Geral de Proteção de Dados Pessoais), texto compiladoplanalto.gov.br
  2. Planalto — Lei nº 15.352, de 25 de fevereiro de 2026 (conversão da Medida Provisória nº 1.317, de 2025)planalto.gov.br
  3. ANPD — Regulamentações da ANPDgov.br
  4. European Commission — Adequacy decisionscommission.europa.eu
Health interoperability glossary