The Lei Geral de Proteção de Dados (LGPD) is Brazil's comprehensive data protection law, enacted in August 2018 and enforced from August 2021. Modeled on GDPR, LGPD applies to any organization processing personal data of individuals located in Brazil, regardless of where the organization is based. LGPD establishes 10 legal bases for data processing — including consent and legitimate interest — and grants data subjects rights including access, correction, deletion, portability, and consent withdrawal. The National Data Protection Authority (ANPD) enforces LGPD and can impose fines of up to 2% of a company's Brazilian revenue per violation.