Introduction
Yes, the LGPD (Brazil's data protection law) applies to companies outside Brazil. If you offer goods or services to people in Brazil, or process personal data collected in Brazil, you are covered, wherever your servers and headquarters are. For a foreign company onboarding Brazilian users, that includes every CPF (Brazil's individual taxpayer ID), name, date of birth, selfie and document image you collect for identity checks.
This guide covers the points that matter most to foreign product, compliance and engineering teams: scope, legal bases for verification, sensitive data, international transfers, incidents and enforcement. It is an overview, not legal advice: confirm your specific obligations with Brazilian counsel.
When the LGPD applies to you
The LGPD (Law 13,709/2018) applies, under its Article 3, to any processing that:
- takes place in Brazil, or
- aims to offer or supply goods or services to individuals located in Brazil, or to process their data, or
- involves personal data collected in Brazil.
The location of the company does not matter. A US fintech, a European marketplace or an Asian exchange with Brazilian users is in scope for that processing. The regulator is the ANPD (Brazil's national data protection authority).
If you know the GDPR, much of the structure will look familiar: principles, legal bases, data subject rights, a data protection officer, impact assessments and transfer rules. The details differ, so do not assume a GDPR program covers Brazil without a review.
Legal bases for identity verification
Every processing activity needs one of the legal bases in Article 7. For identity checks on Brazilian users, three come up most often:
| Legal basis | Typical use in onboarding |
|---|---|
| Compliance with a legal or regulatory obligation | KYC required by your regulator, such as anti-money laundering rules for financial and crypto companies |
| Legitimate interest | Fraud prevention at signup and checkout on platforms without a legal KYC duty |
| Performance of a contract | Data strictly needed to provide the service the user signed up for |
Consent is also a basis, but it can be withdrawn, which makes it a poor fit for checks you need to keep doing. Legitimate interest requires a balancing assessment and transparency toward the user, so document it.
Biometric data is sensitive data
Selfies, face matching and liveness checks process biometric data, which the LGPD classifies as sensitive. Sensitive data has its own, narrower list of legal bases in Article 11. One of them covers fraud prevention and the security of the data subject in identification and authentication processes in electronic systems, which is the basis most document and selfie flows rely on. Article 11 bases still require that the user's fundamental rights do not prevail, and the ANPD can require a data protection impact assessment for this kind of processing.
The obligations that matter most
Transparency
Your privacy notice must say what you collect, why, on which legal basis, with whom you share it and for how long you keep it. For identity checks, name the checks: "we verify your CPF, name and date of birth with an identity verification provider" is clearer than a generic line about "security purposes".
Data minimization
Collect only what the check needs. A CPF registry lookup that returns the holder's name, gender and date of birth, such as the CPFHub.io Simple Lookup, gives you what you need for a match without address or contact data you would then have to protect.
Data subject rights
Users in Brazil can ask for confirmation of processing, access, correction, deletion of unnecessary data, information about sharing and review of automated decisions, among other rights. A rejected signup based on an automated identity check is a typical case for a review request, so keep a path to human review.
A data protection officer
Article 41 requires controllers to appoint an encarregado, the Brazilian equivalent of a data protection officer, and to publish their contact details. The ANPD has issued a specific regulation on the role.
Processors and vendors
When a vendor processes data on your behalf (an identity verification API, a cloud provider), the LGPD calls it an operador. Your contract should define instructions, security measures and what happens to the data at the end. Ask each vendor for its privacy and security documentation. CPFHub.io publishes its own on the security and compliance page.
International transfers
Sending Brazilian personal data abroad is an international transfer under Article 33, and most foreign companies do it by default. The ANPD regulated transfers in Resolution CD/ANPD 19/2024, which lists the transfer mechanisms: adequacy decisions, standard contractual clauses, equivalent clauses, specific clauses and global corporate rules.
Companies relying on the ANPD's standard contractual clauses had 12 months from the regulation's publication in August 2024 to incorporate them, without changes, into their contracts. If your Brazilian data goes to servers or vendors abroad, check that the right mechanism is in place.
Security incidents
If a security incident may cause relevant risk or damage to data subjects, the controller must notify the ANPD and the affected users. Under Resolution CD/ANPD 15/2024, the deadline is three business days, unless specific legislation sets another. Build Brazil into your incident response runbook before you need it.
Enforcement and fines
Article 52 lists the sanctions, which include warnings, publication of the infraction, blocking or deletion of the data involved, suspension of processing, and fines of up to 2% of the revenue of the company or group in Brazil in its last fiscal year, excluding taxes, capped at R$ 50 million per infraction.
For companies without a Brazilian presence, the law provides that a foreign company is notified through its agent, representative, branch or office in Brazil. Having no office in Brazil does not take you out of scope.
A checklist for foreign teams
- Map which Brazilian personal data you collect, including CPF, documents and selfies.
- Assign a legal basis to each purpose, and a specific Article 11 basis to biometric data.
- Update the privacy notice with the checks you run and the retention periods.
- Appoint an encarregado and publish the contact.
- Sign processing terms with every vendor that touches the data.
- Put a transfer mechanism in place for data that leaves Brazil.
- Add the three business day ANPD notification to your incident runbook.
- Keep a human review path for automated identity decisions.
Frequently asked questions
Does the LGPD apply if my company has no office in Brazil?
Yes, when you offer goods or services to people in Brazil or process data collected in Brazil. The law applies based on where the people and the data are, not where the company is.
Is the CPF sensitive data under the LGPD?
No. The CPF is personal data, but not sensitive data in the LGPD's definition. Biometric data, such as selfies used for face matching, is sensitive and needs an Article 11 legal basis.
Do I need consent to verify a user's CPF?
Usually not. Identity checks are commonly based on a legal or regulatory obligation or on legitimate interest in fraud prevention. Which basis fits depends on your sector, so confirm it with counsel.
Is GDPR compliance enough for Brazil?
It is a strong starting point, but not a substitute. Legal bases, transfer mechanisms, incident deadlines and the ANPD's own regulations differ, so review your program against the LGPD specifically.
Read also
- Brazil KYC Requirements in 2026: What Foreign Companies Need to Know
- KYC for Crypto Exchanges in Brazil: The Banco Central VASP Rules
- Brazil Identity Verification API: What Data You Can Get from a CPF
- How to Use a CPF Lookup API in Node.js
Conclusion
The LGPD follows Brazilian users wherever your company is. For identity verification, that means a clear legal basis for each check, a specific basis for biometrics, a transparent privacy notice, a transfer mechanism for data that leaves Brazil and a plan for incidents. Collecting only what each check needs makes every one of those steps easier.
See how CPFHub.io handles data on the security and compliance page, and test the API with 50 free credits and no credit card at cpfhub.io.
CPFHub.io
Ready to integrate the API?
50 free credits to test now. No credit card. Instant access to the documentation.
