Data:Brazil

Purpose and Objectives

Purpose and Objectives

The LGPD is frequently described as a legal transplant of the GDPR to the Brazilian context. However, there are significant differences between the two regulations where it relates to purpose and objective. Where the GDPR explicitly prioritizes the dual objectives of fundamental rights of citizens and the free movement of personal data, Article 2 of the LGPD defines a broader set of objectives including “free enterprise, free competition and consumer protection” as well as “economic and technological development and innovation”.  

This is especially noteworthy in context of the LGPD’s equivalent of Article 20 GDPR: the right to data portability (Article 18(V) LGPD). Though Article 18 LGPD lacks Article 20 GDPR’s stipulation that data controllers must permit data portability “without hindrance from the controller”, the explicit framing in Article 2(VI) LGPD implies a pro-competitive reading of Article 18(V) LGPD.

The “economic development” objective is further apparent in the geopolitical interests that may have in part driven the drafting of the LGPD: specifically a desire to join the OECD as a full-fledged member. Accession requires compliance with OECD guidelines, including the “OECD Privacy Guidelines”. In this regard, the LGPD appears to have been successful, as accession talks were officially initiated in 2022. This was evidently of lesser concern in the EU, as 22 of its 28 member states were already OECD members at the time the GDPR was drafted. 

Legislative Competence and Constitutional Status

Similar to the European Union, Brazil’s system of government features exclusive and shared competences. Both systems divide legislative competence between exclusive and shared categories. In the EU, these are set out in Articles 3 and 4 TFEU, which have not been amended since the Lisbon Treaty and do not expressly list data protection; the Union's legislative basis is instead Article 16(2) TFEU. In Brazil, Constitutional Amendment 115/2022 added item XXX to Article 22 of the Constitution, placing the protection and processing of personal data within the Union's privative legislative competence. The same amendment made data protection a fundamental right, which the Supreme Federal Court had already recognized as implicit since at least 2020. The same amendment also made data protection a fundamental right, though the Supreme Federal Court of Brazil (Supremo Tribunal Federal) had already treated the right as implicit for several years at that point. In summary, both LGPD and GDPR are congruent in their basis in fundamental rights, but distinct in their respective complementary goals of pro-consumer economic-developmental logic (LGPD) and internal market integration (GDPR).

Data Portability beyond the LGPD

Open Schemes

Because the ANPD has not yet settled the standards that Article 40 of the LGPD leaves to it, we cannot yet say how data portability will work in Brazil under the general law. Brazil does, however, already have working examples of portability, built sector by sector and often before the LGPD:sectoral schemes already facilitate portability of telephone numbers (Anatel), credit (Central Bank) and health plans (ANS). More recently, the same logic was extended to data itself through Open Finance (2021), which had generated around R$18 billion in credit by the end of 2024, and Open Insurance (2021), with Open Energy to follow in 2027.

Competition-Based Portability: Bill No. 4675/2025

In Brazil, there are also efforts towards an obligation of data portability, but its conception comes from a different lens from that of the EU and its Digital Markets Act (DMA), with somewhat different objectives and mechanisms. The Bill No. 4675/2025 aims to amend the Brazilian Competition Law so that CADE (Conselho Administrativo de Defesa Econômica), the competition authority, can impose special rules on the largest digital companies, including, if it so decides, an obligation to allow data portability.

For data portability, CADE, on its own initiative or at the request of any interested party, decides whether a company is “systemically relevant”, similar to a DMA gatekeeper. Then, the organization decides if “free data transfer tools for end users” (Article 47-E, V(a)) applies to the specific company. If imposed by CADE, the company builds the tool and users request transfers directly from it, CADE only supervises. Unlike the DMA, where portability applies automatically to every gatekeeper, here it can vary. The provision covers both personal and non-personal data, as the DMA does. However, it doesn’t say whether data generated by the user’s activity is included and it doesn’t mention transfers to third parties either, or no requirements of real-time access while the DMA does. It also lacks rules on vetting recipients, makes coordination with the data protection authority optional, and needs about a year of procedure before any duty applies. Personal data in any transfer remains subject to the LGPD.

Only the private sector is affected; public bodies can merely ask CADE to act. Only very large holders are bound: groups with revenue above R$5 billion in Brazil or R$50 billion worldwide. Small firms are never bound and are meant to benefit as recipients of users’ data. Unlike the DMA, which designates each gatekeeper’s core platform services one by one, the bill measures size at the level of the whole group, and CADE may then limit obligations to specific services. There are no fixed exceptions. CADE “may consider” information security and the company’s other legal duties, and for personal data the LGPD protects trade secrets and excludes anonymised data.

The objective of the proposed bill would be to reduce entry barriers and promote user choice by weakening the data advantage of dominant platforms, the same competition logic as the DMA. Nevertheless, the main blind spot is that the bill creates a power for CADE, not a right for users. As a result, users’ portability will depend on which platform they use and what CADE decided for it. As of October 2026, the bill had not been voted on.

IoT Data Portability

In terms of IoT data portability, in the case of Brazil, no Brazilian law requires connected products to be designed so that users can pass that data to another provider easily, there’s not EU Data Act equivalent.

Brazil relies instead on sectoral schemes, each of which obliges the companies it supervises to let customers move their data to a competitor, works only inside its own sector, and almost always relies on the customer’s consent and standardised technical interfaces. Examples are Open Energy, under which electricity distributors must let consumers share their smart-meter data with other suppliers, and the pending bill on agricultural data (PL 4123/2020), which would do the same for farm machinery.

Sources mostly agree there’s a problem with IoT data portability in Brazil, and some opinion pieces argue for a Data Act-style law, but no study shows that a Data Act copy is the fix. The Data Act’s efficacy is still unproven: its rules have applied only since 2025, and there’s already academic pieces like Kerber (2023) which argues that portability works mainly with detailed sectoral regulation.

Nature of data concerned

Key Characteristics of LGPD

Lei Geral de Proteção de Dados (LGPD) is a Brazilian version of data protection law which resembles many characteristics of General Data Protection Regulation (GDPR) from the EU. LGPD is a general, comprehensive, horizontal data privacy law which entered into force on September 18, 2020. It’s legally binding with National Data Protection Authority (ANPD) acting as an autonomous administrative authority to issue sanctions (penalties) for violations of the LGPD.

From the Article 18(V) of LGPD, it is stated that the portability of data to another service/product provider upon express request, according to the regulations of the national authority, complying with trade and industrial secrets. Unlike GDPR Article 20 which provided detailed statutory conditions in terms of the scope of data and automated processing, LGPD renders ANPD the ultimate authority to define the regulatory framework on how to implement the right to data portability.

The Role of the ANPD

The LGPD empowers ANPD to establish interoperability standards for portability from the Article 40. Therefore, many questions remain open for the ANPD to set its own guidelines for practical implementation in terms of:

• Which data must be portable
• What constitutes portability
• How interoperability should work
• How third-party data should be handled
• Who transfers data
• Allocation of responsibility between origin and destination controllers

Yet it is important to note that the ANPD is not actually obliged to come up with such regulatory guidelines. According to its regulatory agenda released in 2021, details regarding establishing interoperability standards are not even included on the list of regulatory initiatives to be tackled in the first two years of activities of ANPD. 

Scope of Application

The LGPD is a horizontal law, applicable to processing by public and private legal persons' (Article 3). Yet there are other sector-specific data portability regulatory frameworks in financial sector (Open finance framework from the Central Bank) and insurance sector (SUSEP) as well. The LGPD has an 'extraterritorial reach. Under Article 3, a personal data processor is subject to the law when:

1. The data are either collected or processed within Brazil or
2. The data is processed for the purpose of offering goods or services to individuals in Brazil.

Hence, as long as one of these conditions is met, the country in which the company is headquartered is irrelevant, and the LGPD is fully applicable including when fulfilling data subject rights like data portability.

Structure and Effectiveness of Brazilian Data Portability Regulation

Legal Framework and Sectoral Regimes

Brazilian data portability rests on distinct instruments. The Constitution, article 5(LXXIX), protects personal data; the General Data Protection Law (LGPD), article 18(V), establishes a request-based right to data portability. Financial data sharing is governed by CMN/BCB Joint Resolution 1/2020, as amended by 4/2022; insurance by CNSP Resolution 415/2021 and SUSEP Circular 635/2021. Health-data exchange through the National Health Data Network (RNDS) follows Decree 12,560/2025. ANEEL's Open Energy remains a proposal under Public Consultation 7/2025. Consumer and competition legislation provides complementary safeguards. These regimes have different purposes and levels of legal maturity, not a single uniform portability standard.

Assessment and Policy Priorities

From a rights perspective, article 18(V) establishes a statutory entitlement, but its exercise remains incompletely specified: it requires an express request, follows ANPD regulation and preserves commercial and industrial secrecy. In September 2026, the ANPD still listed regulation of data-subject rights as under internal preparation. That demonstrates an implementation gap, not suspension of the statutory right. RNDS interoperability likewise must not be mistaken for a general patient-directed portability mechanism.

For markets, mandatory participation and standardised interfaces can lower informational barriers to entry. Yet Open Finance activity measures technical uptake, not causally established reductions in prices or concentration. Research identifies continued concentration and implementation costs; competition effects require direct assessment. Consumers may gain access to comparison tools and tailored offers, subject to comprehensible consent, security, and genuine choice. Survey findings associate lower income with lower reported adoption, without establishing national causal effects. Economic theory additionally suggests that refusal to share could disadvantage borrowers when lenders interpret non-disclosure adversely. For industry, shared interfaces reduce integration duplication but entail security and maintenance costs that smaller providers may struggle to bear. Ambiguous trade-secret exceptions and weak downstream safeguards can undermine confidence. Technical standardisation therefore requires public oversight, not merely industry agreement. 

Further legislation is neither necessarily sufficient nor the best immediate remedy. The stronger priority is binding ANPD regulation on scope, formats, timelines, secure direct transmission and reviewable secrecy refusals, coordinated with sector regulators. Accessible consent processes, independent testing, shared technical tools, consumer education and collective redress should complement regulation. Success should be measured against completed transfers, switching, prices, market entry, complaints, security incidents, and distributionBrazilian Data participation. Brazil demonstrates operational possibilities; its broader rights and welfare effects remain to be established.