LGPD Compliance Roadmap: From Data Map to ANPD-Ready

Applicability and inventory. Confirm which entities and flows touch Brazil (processing in Brazil, offering to Brazil, or data collected in Brazil), then build the data map: systems, data categories, purposes, retention, recipients, and transfers. Assign one lawful basis per purpose as you map, not after, because basis choice drives notice language, consent tooling, and whether legitimate-interest balancing memos are needed. Everything downstream consumes this inventory.

The nine Article 18 rights: confirmation, access, correction, anonymization/blocking/deletion of unnecessary or noncompliant data, portability, deletion of consent-based data, information on sharing, information on the consequences of refusing consent, and revocation. Immediate simplified responses plus 15-day complete declarations for access. Intake must be free, accessible, and verify identity proportionately. Deletions and corrections propagate to processors and sharing partners, which the data map's recipient column makes tractable.

The RIPD (Relatorio de Impacto a Protecao de Dados) is the LGPD's DPIA. The ANPD can demand it at any time, and expects it for legitimate-interest processing, high-risk or large-scale processing, and sensitive data. Unlike the GDPR there is no exhaustive trigger list, so the defensible pattern is a screening question in the data map plus full RIPDs for the flows a regulator would ask about first: profiling, biometrics, children's data, large-scale sharing. A GDPR DPIA restructured to LGPD terminology satisfies it.

The LGPD makes operators directly liable for damage caused by noncompliant processing and binds them to controllers' instructions. Contracts should fix: processing scope and purposes, security measures, sub-operator authorization, breach notification to the controller in time to meet the 3-working-day ANPD clock, DSR assistance on the 15-day timeline, transfer instruments where the operator is abroad, and deletion or return at termination. Brazilian courts also apply joint liability provisions (Article 42), so indemnities matter more than under GDPR.

Resolution 2/2022 gives micro-enterprises, small businesses, and startups simplified duties: no mandatory DPO (but a published contact channel is still required), simplified records, doubled deadlines for some obligations, and simplified breach communication. The substantive rules, lawful bases, rights, security, transfers, still apply in full. Companies near the threshold should document their classification; claiming small-agent status without qualifying is itself a violation the dosimetry regulation treats as aggravating.