Brazil · LGPD for foreign companies
Any company that processes personal data of people in Brazil, or offers goods and services to the Brazilian market, must appoint an encarregado under Article 41 of the LGPD, with a public contact channel and the capacity to answer data subjects and the regulator in Portuguese. Moreth.AI, a Brazilian law firm, takes the appointment, the channel and the correspondence off your plate, and reports to you in English or Spanish.
Who needs this
Accounts, billing, support tickets and usage data of users located in Brazil, even when the servers and the company are elsewhere.
Checkout, delivery, CPF for customs, marketing consent. The offer of goods to the Brazilian market alone triggers the law.
The subsidiary is a controller and needs an officer of its own. A group DPO in Europe who does not read Portuguese does not meet the resolution.
Sensitive data and large volumes raise the stakes: incident reporting to the ANPD has a three working day clock (Resolution 15/2024).
Exception: small-scale agents (startups, micro and small companies as defined by ANPD Resolution 2/2022) are exempt from appointing an officer, but must still keep a public contact channel for data subjects. If you are unsure which side of the line you are on, the first call settles it.
What the officer does
The officer is the company's face before Brazilian data subjects and before the National Data Protection Authority (ANPD). Every item below is a legal duty, not a feature.
Written act of appointment, a named substitute for absences, and the text you publish on your site and in your privacy notice.
A contact page and e-mail identified as the encarregado, monitored on business days in Brazil, answered in Portuguese.
Access, correction, deletion, portability and consent withdrawal handled within the statutory deadlines of Articles 18 and 19, with a log you can audit.
Notices, requests for information and inspection proceedings received and answered by lawyers, with you informed in your language before anything is filed.
Assessment and, when required, communication to the ANPD and to data subjects within the three working days set by Resolution 15/2024.
Written guidance to your team on Brazilian requirements, and a quarterly note in English or Spanish with requests handled, risks and regulatory changes.
Plans
Three levels. Most foreign companies start with Essential and add the compliance work only if the first review finds gaps.
EUR 490
per month
For companies that already have privacy governance and need the Brazilian appointment done right.
EUR 1,200
per month for the first six months, then EUR 690
For companies entering Brazil, or that appointed nobody and need the basics built.
from EUR 1,900
per month
For groups with sensitive data, high volumes or a Brazilian subsidiary that needs a standing privacy function.
How it works
We confirm whether the LGPD applies to you, which plan fits and what data you hold about people in Brazil.
A one-page proposal in your language, the engagement agreement, and the invoice. Everything remote.
Within five business days: act of appointment, substitute, the text for your site and privacy notice, and the live channel.
Requests answered, regulator handled, incidents assessed, and a quarterly note that tells you exactly where you stand.
Who answers for you
Author of the Manual Integral de Direito Digital and several other works on Brazilian digital law, MIT-certified in artificial intelligence and a member of the MIT Generative AI Group. He teaches AI and data protection to lawyers, judges and prosecutors, and has trained more than two thousand professionals.
Moreth.AI is his law firm, registered in Brazil and operating between Brazil and Spain, which lets it serve European and American clients in their working hours while keeping the regulator's clock in Brasília. All work is done by lawyers admitted in Brazil, in Portuguese before the ANPD, and in English or Spanish with you.
Questions
Yes. Article 3 applies the law to any processing carried out in Brazil, to processing whose purpose is offering goods or services to people in Brazil, and to data collected in Brazil. Establishment is irrelevant; the location of the data subjects and the offer are what count.
No. The LGPD has no representative figure. What it requires is the encarregado (Article 41), who must be publicly identified and reachable, and, under Resolution 18/2024, able to deal with data subjects and the ANPD in Portuguese. That is the role we take.
Yes. Resolution 18/2024 allows the officer to be a natural or legal person, internal or external. A written act of appointment is required, and the officer's identity and contact must be public.
Only if that person can receive and answer requests in Portuguese, monitor a channel aimed at Brazilian data subjects, and correspond with the ANPD. In practice, groups appoint a Brazilian officer and keep the group DPO as the internal counterpart.
Resolution 19/2024 sets the instruments: standard contractual clauses in the ANPD's wording, binding corporate rules, or adequacy. Transfer clauses are included in the Compliance and Governance plans, and can be added to Essential on request.
By an engagement agreement with the Brazilian law firm, governed by Brazilian law, invoiced monthly in EUR or USD and paid by bank transfer. There is no minimum term beyond the 30-day notice.
Request a proposal
Four fields and a website. On submission we read your public privacy notice and tell you, right away, whether an officer for Brazil is already identified there. The proposal follows within one business day.
Moreth.AI · moreth.ai
