LGPD

What it is

The Lei Geral de Proteção de Dados Pessoais, enacted 2018 and in force since 2020. Closely modelled on GDPR — same lawful-basis structure, similar data subject rights, analogous extraterritorial reach. Enforced by the Autoridade Nacional de Proteção de Dados (ANPD), which gained sanctioning power in 2023.

Why it matters

Maximum fine is 2% of Brazilian revenue (capped at R$50M per violation). ANPD enforcement has accelerated since 2023 and Brazil is one of the largest LATAM markets — a GDPR-shaped consent and privacy-policy stack covers most LGPD obligations for free.

Who it applies to

Brazilian residents — applies extraterritorially to sites processing their personal data regardless of where the operator is located.

• Jurisdictions: Other / unknown

How WQI scores it

Web Quality Index considers this standard satisfied when all of the 3 supporting factors pass.

0 of 3 supporting factors are currently collected. Sites where the remaining 3 haven't been measured will show as partial or unknown on this standard until the data lands.

Related standards

See also

GDPR , PIPEDA , POPIA

Standards that share factors with this one

Auto-computed from overlapping factor tickets in satisfiedBy, excluding standards already listed under "See also" above. Strong overlap suggests these standards rise and fall together when sites are scored.

• Australian Privacy Act + APPs 3 shared factors Privacy Australia's federal privacy law, anchored on the 13 Australian Privacy Principles. The 2024 reforms added a statutory tort for serious privacy invasions and direct OAIC penalty powers.
• Colorado Privacy Act 3 shared factors Privacy Colorado's CCPA-shaped privacy law, with a hard requirement to honour Universal Opt-Out Mechanisms like Global Privacy Control as of July 2024.
• Connecticut Data Privacy Act 3 shared factors Privacy Connecticut's CCPA-shaped privacy law. Like Colorado, recognises Global Privacy Control as a valid opt-out signal — and the AG has been actively issuing cure notices since 2023.
• COPPA 3 shared factors Privacy If your site is directed at U.S. children under 13 — or you knowingly collect from them — you need verifiable parental consent before any data collection. The 2025 amendments tightened this further around third-party advertising.
• HIPAA 3 shared factors Privacy If your site collects, displays, or transmits protected health information, HIPAA applies. A privacy policy plus an explicit Notice of Privacy Practices and a clear consent flow are the minimum visible signals.

Other references

• regulation ANPD — institutional homepage