An LGPD compliance program brings together the mapping, documents, processes, and training a company needs to know what personal data it processes, why, on what legal basis, how long it retains it, who accesses it, and what happens when something goes wrong. The goal is to answer any question from a data subject or Brazil's National Data Protection Authority with evidence.
Law 13,709/2018 has been in force since 2020, with penalties effective since 2021. Many companies achieved compliance then and have not updated their inventories since.
Privacy and security in the same program
The LGPD requires technical and administrative security measures capable of protecting data against unauthorized access. A company with a comprehensive privacy policy and an exposed database still fails to comply with the law.
In the 2026 Cyber Risk Landscape, a Vultus study of 132 organizations, 38.1% had a cloud environment without multifactor authentication, one of the shortest paths to a personal data breach.
Program stages
Planning and assessment bring together executive sponsorship, department owners, an inventory of existing policies and controls, and the position of regulatory risks in the risk matrix. Mapping is the most labor-intensive stage: identifying processes that handle personal data, cataloging each data element, and mapping its lifecycle from collection to deletion, including its purpose and legal basis.
The design phase produces the documents expected by the law and the ANPD, while implementation includes training employees and third parties and establishing routines to keep the program current. A complete program typically takes several months, depending on the number of processes and systems in scope.
The core documents
The structure produces:
- ROPA: the record of processing activities, including the data involved, the company's role, and the purpose.
- DPIA: the data protection impact assessment for processing that may create risk for data subjects.
- LIA: the legitimate interest assessment, when this is the legal basis used.
- Retention schedule: how long each type of data is retained and when it is deleted.
- Policies and plans: an external privacy policy and incident response and communication plans.
The retention schedule is often the most overlooked document. The law allows personal data to be retained only while a purpose or legal obligation exists, and every unnecessary piece of retained data increases what can be leaked.
Incidents and sanctions
When an incident may cause significant risk or harm to data subjects, the company must notify ANPD and affected data subjects. ANPD regulations establish a deadline of three business days for this notification.
The authority's own figures show the volume. In its 3rd Monitoring Cycle Report, ANPD recorded 723 security incident notifications between the second half of 2023 and the first half of 2025.
Penalties range from warnings to fines of up to 2% of revenue in Brazil, capped at R$50 million per violation, as well as public disclosure, blocking or deletion of data, and suspension of processing. For many businesses, suspension of processing has a greater impact than the fine.
A data protection program integrated with security
Vultus structures compliance programs by connecting privacy, information security, and third-party management, with the inventory updated whenever a new system is purchased. Explore Vultus data protection program and read about third-party risk management. This content explains the structure of a compliance program and is not a legal opinion.
