Brazilian LGPD in practice: what your company must do in systems and apps

LGPD (Brazilian GDPR equivalent) came into force in 2020, but in 2026 the ANPD is finally applying heavy fines — including the cap of R$ 50 million per infringement. Companies that ignored the law for years are being notified, sued and, in some cases, having operations paralyzed until they regularize.

This guide is not legal — it is practical. We will focus on what needs to change in your systems, apps and processes for real compliance, not just "on paper". If your company collects any customer data (name, email, phone, CPF/SSN), this is for you.

Why LGPD became priority in 2026

For years, many companies treated LGPD as "legal department problem" — made a privacy policy in the site footer and moved on. In 2026, the game changed. ANPD started applying real fines (not symbolic), STJ consolidated jurisprudence on individual compensation (above R$ 5k per leak), and Brazilian consumers started using the law as a buying argument.

The 4 reasons that make LGPD urgent now:

• Real fines applied: ANPD fined more than 200 companies in 2025, values from R$ 50k to R$ 8M
• Individual compensation: courts condemn companies to pay R$ 5-15k per affected data subject in leaks
• B2B audits: large companies require LGPD compliance from suppliers in due diligence
• Customer competition: privacy seal became perceived differentiator in e-commerce and SaaS

"It is no use having a beautiful privacy policy on the site if the system does not have a button for the customer to request data deletion. ANPD audits what works, not what is written."
— Data protection specialist

What LGPD requires technically

The law establishes principles — but implementing in a real system requires concrete changes. These are the 4 areas where most companies need to intervene:

1. Explicit and granular consent

A "I have read and agree" checkbox is not enough. LGPD requires informed, specific and granular consent: the customer must be able to choose exactly what the data will be used for. Ex: accept receiving newsletter but not sharing with partners. Systems that do not separate these purposes are non-compliant.

2. Accessible data subject rights

The data subject has 9 rights over their data: confirmation, access, correction, anonymization, portability, deletion, information about sharing, consent revocation and automated decision review. Your system needs to have buttons or channels for each one — and respond within 15 days.

3. Minimization and purpose

Collect only what is necessary. If your app asks for CPF, phone and address for a simple newsletter, this is a violation. Each field needs purpose justification. Common audit: why do you collect date of birth if the system never uses it?

4. Security and incident registration

Plain text passwords, exposed database without firewall, unencrypted backup — all this is violation. The law requires reasonable technical measures and, in case of leakage, communicating to ANPD within 2 business days. Company that discovers leak in January and communicates in March takes heavy fine.

The technical compliance checklist

To put systems and apps in compliance, this is the minimum checklist every serious software house implements:

• Privacy panel in app/system: screen where user sees what data was collected, with buttons to export, correct and delete
• Audit log: immutable record of who accessed which personal data and when
• Encryption at rest and in transit: TLS on HTTP, AES encryption in database for sensitive fields
• Anonymization for analytics: data used in BI/dashboards must be anonymous or pseudonymized
• Retention policy: automatic routine that deletes data whose retention period has expired

Common errors that keep companies non-compliant

Even companies that "did LGPD" usually have holes. The most frequent:

• Privacy policy copied from another site, without reflecting what the real system does
• Cookie banner that does not block trackers until consent (consent "later" is not consent)
• Former employee with access to database months after leaving the company
• Spreadsheets with customer data being sent via WhatsApp and email between teams

LGPD compliance is not a one-time project — it is a continuous process. Internal audit every six months is the reasonable minimum, and each new product feature requires privacy review before release.

How much it costs to adequate (real ranges 2026)

The investment depends on size and current maturity. Real ranges in Brazil in 2026:

• SME with 1-2 systems (e-commerce or simple SaaS): R$ 25,000 to R$ 60,000 initial + R$ 2,000-4,000/month governance
• Medium company with 3-8 systems: R$ 80,000 to R$ 250,000 + R$ 5,000-10,000/month
• Enterprise group with multiple systems and sensitive data: R$ 400,000+ initial + R$ 15,000-40,000/month (including outsourced DPO)

Compared with potential fine and loss of trust, this investment pays off quickly. Company that leaks data and delays communication can lose much more in lawsuits than they saved on adequacy.

How to start adequacy in 90 days

A company starting from zero on LGPD can be 80% compliant in 3 months following this sequence:

1. Map all data (weeks 1-2): list what personal data your company collects, where it is stored, who has access and how long it is kept
2. Identify legal basis of each use (weeks 3-4): consent? contract execution? legitimate interest? Each purpose needs clear basis
3. Fix the critical first (weeks 5-8): implement privacy panel in app, adjust cookie banner, create data subject rights channel
4. Rewrite the policy and train the team (weeks 9-10): policy that reflects reality, mandatory training for all who handle data
5. Appoint a DPO and implement governance (weeks 11-12): data protection officer, incident response process, audit calendar

Conclusion

LGPD stopped being "legal task" and became technology project with direct product impact. In 2026, a company without real compliance is running high financial risk and losing customers to competitors that have it.

If you do not know what level of compliance your company is at, start with diagnosis. If you already know you need to adapt, choose a software house experienced in LGPD to avoid redoing the work. Poorly done adequacy costs twice as much as well done.

Frequently asked questions about LGPD in systems and apps

My company is small, do I need to worry about LGPD?

Yes. LGPD applies to any company that processes personal data, without distinction of size or revenue. ANPD in 2025-2026 began fining SMEs as well, mainly in cases of leakage or formal customer complaint. The difference is the requirement level: small company with low-risk processing (customer registration for sale) needs the basics (privacy policy, clear legal basis, channel for data subject). Company that processes sensitive data (health, biometrics, financial) needs full adequacy even if small.

Can I use data from old customers registered before LGPD?

Yes, but with rules. LGPD doesn't require re-collecting consent from the entire previous base if you have another applicable legal basis (contract execution, legal obligation, documented legitimate interest). For direct marketing and new uses not foreseen in the original registration, you need new legal basis — usually consent. The biggest risk is in those who ignore the topic and keep undifferentiated use of the old base: then any complaint becomes a problem. The safe path is to do a review of legal bases per purpose.

How much does it cost to adapt an existing system to LGPD?

For simple system (CRUD of registrations, no sensitive data, no third-party integration), technical adequacy ranges from R$ 15k to R$ 40k. For medium system with report modules, export, ERP integration and financial transaction data, it goes up to R$ 40k to R$ 120k. For complex multi-tenant platform with sensitive data (health, financial), it exceeds R$ 150k. Cost includes: collection review, granular consent implementation, access logs, deletion and portability flow, encryption at rest and in transit, team training.

What is the DPO and do I need to hire one?

DPO (Data Protection Officer, or Encarregado for LGPD) is the person responsible for mediating the relationship between company, data subjects and ANPD. LGPD requires DPO indication, but allows it to be a cumulative function (doesn't need to be full-time dedicated) or outsourced. For SME, hiring external DPO (specialist lawyer or consultancy) ranges from R$ 1k to R$ 5k/month and serves without inflating headcount. For company that processes sensitive data at scale, dedicated internal DPO is recommended.

How to know if I had a data leak and what to do?

Leakage is detected with active technical monitoring: out-of-pattern access logs, SIEM alerts, antivirus, WAF. Without monitoring tools, you usually only find out when the data appears on the dark web or a customer complains. In case of confirmed leak of relevant data, LGPD requires notifying ANPD and affected data subjects within reasonable time (ANPD recommends up to 2 business days in critical cases). Hiding the leak is the worst path: fine for failing to notify adds to the fine of the original incident.