Does Brazil's LGPD Apply to U.S. Companies? A Practical 2026 Guide

A common question from U.S. businesses is: “We do not have an entity in Brazil, so why would Brazilian privacy law apply to us?” Under the LGPD, that is the wrong first question.

The statute expressly says its territorial scope can apply regardless of the country where the company is headquartered or where the data is located. The analysis therefore begins with the processing activity itself.

The Three Article 3 Triggers U.S. Companies Should Test

A practical applicability review should test the business against each of the three territorial triggers in Article 3 of Law No. 13,709/2018.

Trigger 1: Processing in Brazilian Territory

If a relevant processing operation is performed in Brazil, Article 3(I) may bring that activity within scope. This can matter to a U.S. group with a Brazilian subsidiary, local employees, customer-support operations, contractors, fulfillment processes, or other operational activities involving personal data in Brazil.

Trigger 2: Brazil-Facing Processing

Article 3(II) is especially important for online businesses. The current statutory language covers processing whose purpose is the offering or provision of goods or services or the processing of data of individuals located in Brazil.

That means the analysis should not be reduced to whether the website uses a .br domain, prices in Brazilian reais, or Portuguese-language marketing. Those factors can be relevant facts, but the legal text itself requires a broader look at the purpose and the individuals whose data is being processed.

Trigger 3: Personal Data Collected in Brazil

Article 3(III) covers personal data that was collected in Brazilian territory. The law further explains that, for this purpose, personal data is considered collected in Brazil when the data subject was in Brazil at the time of collection.

For a digital company, this can make the user's physical location at collection relevant even when the website, cloud environment, CRM, or business headquarters are all outside Brazil.

Practical Examples for U.S. Businesses

The following examples are not legal conclusions for every company. They are operational screening examples showing why a U.S. business should perform an Article 3 assessment.

A Critical Distinction: Location, Not Just Citizenship

This distinction matters for both compliance and content accuracy. A U.S. citizen temporarily located in Brazil can be part of a Brazil-based collection scenario. Conversely, the legal analysis should not be reduced to nationality labels when the statute asks different questions.

If the LGPD Applies, What Should a U.S. Company Review?

Applicability is only the first step. The operational question becomes: which LGPD obligations map to the company's actual processing?

A practical review usually includes at least the following workstreams:

• Data mapping: identify where Brazilian personal data enters, moves, is stored, is accessed, and leaves the organization.
• Controller/operator roles: determine the company's role by processing activity rather than assuming one role for the entire business.
• Purposes and legal bases: document why each processing activity occurs and which LGPD legal basis is relied upon.
• Transparency: make sure privacy notices describe the real operation rather than a generic policy template.
• Cookies and tracking: inventory analytics, advertising pixels, identifiers, consent interfaces, and default behavior.
• Marketing: review forms, CRM workflows, email, WhatsApp, remarketing, audience uploads, suppression, and opt-out processes.
• Vendors and subprocessors: document roles, instructions, security, incident escalation, deletion, and transfers.
• Data-subject rights: create a repeatable intake, verification, evaluation, execution, communication, and closure workflow.
• Retention: connect retention periods to purposes, obligations, disputes, security, and deletion procedures.
• Security and incidents: maintain appropriate safeguards and a process for assessing and escalating security incidents.

The LGPD's principles also matter operationally. The current law includes necessity/data minimization, transparency, security, prevention, and accountability among its core processing principles.

What About Sending Brazilian Personal Data to the United States?

If personal data subject to the LGPD is transferred to, stored in, or made accessible from the United States, the company should separately assess the LGPD's international data transfer rules.

For a U.S.-bound data flow, that means the company should identify the exporter, importer, purpose, categories of personal data, recipients, onward transfers, applicable safeguards, and the transfer mechanism that fits the actual relationship.

Do not treat “our cloud provider is U.S.-based” as the entire analysis. Cross-border access by global support teams, centralized security systems, analytics platforms, CRM tools, parent companies, subprocessors, and backup environments can also create international data flows that need to be mapped.

Does a U.S. Company Need an LGPD DPO / Encarregado?

Article 41 of the LGPD states that the controller must indicate an encarregado for personal-data processing. The identity and contact information of the encarregado must be made public in a clear and objective manner, preferably on the controller's website.

However, ANPD rules provide a relevant exception for qualifying small processing agents. Resolution CD/ANPD No. 2/2022 states that qualifying small processing agents are not required to appoint an encarregado, although an agent relying on that exemption must provide a communication channel for data subjects.

The exemption is not a blanket “small company” shortcut. The regulation contains eligibility conditions and limits, including rules related to high-risk processing, revenue, and economic groups.

10-Step LGPD Checklist for a U.S. Company

If the Article 3 screening indicates that the LGPD may apply, use this as a management-level starting point. It is deliberately broader than “update the privacy policy.”

What U.S. Companies Often Get Wrong

“We are in the United States, so the LGPD cannot apply.”

Headquarters location alone does not resolve Article 3. The statute expressly tells you to look beyond headquarters and data location.

“LGPD only protects Brazilians.”

Article 3's territorial language focuses on processing and location, not a citizenship-only test.

“We already comply with GDPR, so LGPD is covered.”

A mature GDPR program can provide useful controls, but it should be mapped to Brazilian terminology, legal bases, regulatory rules, transfer mechanisms, rights handling, and governance requirements rather than assumed to be identical.

“We only need a Brazilian privacy policy.”

A privacy notice is only one control. The operational evidence behind it—data maps, role decisions, legal bases, vendor controls, transfer mechanisms, rights workflows, retention, security, and incident handling—is usually the larger compliance task.