Brazil: New Data Protection Law

In Brazil, Law No. 13.709 /18 provides the first general regulation on data protection. The goal of the new law is to regulate the handling of personal data, also for digital media, as well as controlling registers that save such information.

Through the new law, personal data – similar to the DSGVO in Europe – can only be handled and saved with the consent of the affected person.

Mandatory Consent

The person whose data will be handled needs to explicitly agree with the data collection and the specific usage of it. Therefore, generic consent forms become invalid.

Access to Information

Also, the data owner needs to have access to his information in order to update, correct or delete them. He furthermore has to right to withdraw his consent for using his data at any time.

Although the new law will only become effective in March 2020 (18 months after its publishing) companies need to start implementing the necessary changes as soon as possible due to their complexity. Despite their terms and conditions, companies need to adapt any system handling personal data such as data protection systems, entry systems, and system controlling, preventing or finding technical problems.


It is important to mention that non-compliance with the new law will lead to administrative sanctions op up to 50 Mio. R $!