Quick Answer: What security does the LGPD require?
Article 46 requires controllers and operators to adopt technical and administrative measures capable of protecting personal data against unauthorized access and accidental or unlawful destruction, loss, alteration, communication or other improper or unlawful processing. Those measures must apply from the design phase of the product or service through execution. The LGPD therefore creates a risk-based security duty rather than one universal technology checklist. As of August 20, 2026, ANPD's regulatory agenda still lists minimum technical security standards as an action in progress; no final universal minimum-security regulation has replaced the Article 46 risk-based standard. ANPD's existing security guide gives useful recommendations—access control, MFA, encryption, backups, patching, training and vendor controls— but the guide is non-binding and aimed specifically at small processing agents.
Key Takeaways
- Security is mandatory; one universal checklist is not. The LGPD requires measures appropriate to the processing and risk.
- Security by design is explicit. Article 46(2) says measures must be considered from product/service conception through execution.
- Security duties continue after processing ends. Article 47 keeps the security obligation alive for people involved in processing even after termination.
- Encryption and MFA are important controls, but the statute does not universally mandate them in every context. ANPD recommends them in its security guidance.
- Data minimization is a security control. Data you never collect or no longer keep cannot be exposed in the same way.
- Vendor security is part of your program. Cloud, SaaS and outsourced IT should be assessed against your actual security requirements.
- Incident readiness is part of security compliance. A reportable incident can trigger a three-business-day external communication period for the controller.
What Articles 46–49 Actually Say
Technical and administrative measures must protect against unauthorized access, destruction, loss, alteration, communication and improper processing.
Agents and anyone involved in processing must preserve information security even after processing ends.
Controllers must communicate qualifying incidents, and systems must reflect security, governance and LGPD principles.
The law requires measures capable of protecting personal data, while Article 46(1) authorizes ANPD to establish technical minimum standards considering the nature of the information, characteristics of the processing, current state of technology, sensitive data and LGPD principles. Article 46(2) adds that security measures must be observed from the design stage through execution.
Article 47: Security is not over when the contract ends
Article 47 is easy to overlook. It says processing agents—or any other person involved in a processing phase— remain obligated to guarantee the information security required by the LGPD even after processing ends.
That matters for former employees, terminated vendors, archived records, decommissioned systems and post-contract deletion. Confidentiality and security obligations should not disappear simply because the service relationship ended.
Article 49: System architecture matters
Article 49 says systems used for processing personal data must be structured to meet security requirements, good-practice and governance standards, LGPD principles and other regulatory rules.
This supports an important implementation principle: privacy and security should not be bolted on after the product ships.
Has ANPD Published Binding Minimum Security Standards Yet?
As of August 20, 2026, ANPD's current regulatory agenda lists “technical and administrative security measures (including minimum technical security standards)” as an action in progress. The official agenda says the regulatory action remains in internal drafting and that a public consultation has not yet occurred for this item.
That does not mean businesses can wait for the future regulation before implementing security. Article 46 is already binding today. The current obligation is to adopt appropriate technical and administrative measures based on the actual context and risk.
What Does “Risk-Based Security” Mean Under the LGPD?
The statute itself tells ANPD to consider the nature of the information, characteristics of processing and current state of technology. Resolution 2/2022 adds a similar risk lens for qualifying small agents by requiring essential and necessary measures considering privacy risk and the reality of the agent.
A defensible security program therefore asks:
- What data are we protecting?
- How sensitive are they?
- How many people are affected?
- What would happen if confidentiality, integrity, availability or authenticity were compromised?
- Which systems and vendors process the data?
- Is the system internet-facing?
- Are credentials, financial data, health data, biometrics, children or large-scale datasets involved?
- What security controls are technically available and proportionate?
15 Security Control Areas Businesses Should Review
The following controls combine direct LGPD requirements with operational practices that ANPD has specifically recommended in its small-agent security guidance. They are not presented as a universal statutory checklist; they are a practical implementation framework.
Information Security Policy
ANPD recommends that small agents establish a security policy, even a simplified one, with periodic review and controls for backups, passwords, access, sharing, software updates, email and antivirus.
Security Awareness and Training
Human error and phishing can defeat good technology. ANPD recommends awareness programs covering daily controls, phishing, password sharing, workstation locking and security-policy responsibilities.
Identity and Access Management
ANPD describes access control as authentication, authorization and auditing. Access should be granted according to business need and removed when no longer required.
Least Privilege
ANPD explicitly recommends the “need to know” / least-privilege principle and restricting high-level administrator access to people who actually require that responsibility.
Password and Authentication Controls
Remove default credentials, prevent password sharing and use appropriate password-management controls. ANPD also recommends preferential use of multi-factor authentication for systems and databases containing personal data.
Encryption and Pseudonymization
ANPD recommends solutions that make identification more difficult for sensitive stored data and cites encryption as an example. It also recommends encrypted communications and encryption of sensitive files sent by email.
Data Minimization
ANPD's guide ties security directly to Article 6 necessity: collecting and keeping unnecessary personal data increases exposure.
Backups and Recovery
ANPD recommends regular complete backups stored securely and separately from primary storage, with care to avoid real-time synchronization that would allow ransomware to corrupt the backup simultaneously.
Vulnerability and Patch Management
ANPD recommends monitoring for new versions and security fixes, keeping systems and applications updated and installing available patches.
Network and Web Security
The guide recommends managing network traffic, firewalls and—where web services are used—considering a Web Application Firewall. Email protection, anti-spam and malware controls are also recommended.
Endpoint and Mobile Device Security
ANPD recommends applying access controls to smartphones and laptops, separating personal and business devices where possible and considering remote wipe for lost or stolen devices.
Secure Disposal
Data should not survive because a laptop, hard drive, paper file or removable medium was discarded incorrectly. ANPD recommends secure formatting/destruction and documented third-party destruction services where used.
Vendor and Contract Security
ANPD recommends contract and acquisition management that addresses responsibilities, sharing, controller/operator relationships and security clauses for outsourced IT.
Cloud Security
ANPD recommends assessing whether cloud providers satisfy defined security requirements, documenting service-level expectations and applying appropriate authentication controls to cloud access.
Incident Detection and Response
Security controls must also detect and contain failures. Organizations need an internal route for employees, users and vendors to report vulnerabilities or incidents and a documented process for triage, containment, risk assessment and notification.
Does the LGPD Require Encryption or MFA?
Encryption
The LGPD does not say that every item of personal data must always be encrypted. Article 46 instead requires security measures capable of protecting the data, considering context and risk.
ANPD's security guide nevertheless recommends encryption in several practical contexts: sensitive stored data, external storage devices, network communications using TLS/HTTPS, end-to-end encrypted messaging and encrypted email/files where sensitive information is sent.
Encryption also matters in incident risk analysis. ANPD's current incident guidance gives the example that loss or theft of a device may have different risk consequences depending on whether the data was protected by encryption.
Multi-factor authentication
MFA is also not written into Article 46 as a universal statutory command. ANPD's security guide recommends preferential MFA for access to systems or databases containing personal data and for cloud services.
Does the LGPD Require ISO 27001, SOC 2 or a Penetration Test?
The LGPD does not state that every business must hold ISO 27001 certification, obtain a SOC 2 report or conduct a specific annual penetration test.
Those can be useful forms of security assurance or evidence depending on the organization, vendor and risk. But they should not be confused with the legal standard itself.
A company can have a certification and still expose personal data through weak application logic, excessive privileges, unsafe vendors, poor retention or an untested incident process.
Conversely, a smaller organization may be able to demonstrate appropriate controls without obtaining an expensive certification, provided its security is actually proportionate to its processing.
Vendor and Cloud Security Under LGPD
Outsourcing infrastructure does not outsource accountability. Article 46 applies to processing agents, and Article 39 requires operators to process according to the controller's instructions.
Before approving a vendor, ask:
- Which personal data will the vendor receive?
- What systems and countries will process the data?
- How are access and privileged accounts controlled?
- Is encryption used in transit and at rest where appropriate?
- How are vulnerabilities and patches handled?
- How are backups protected and restored?
- Which subprocessors are involved?
- How quickly will the vendor report a personal-data incident?
- Can it support deletion and rights requests?
- What evidence supports its security claims?
See LGPD Vendor Compliance: What to Check Before Using a Processor.
Security Is Also About Incident Readiness
Article 48 creates the controller's external incident-notification duty. Resolution 15/2024 now gives the operational rules.
Not every security event is reportable. ANPD currently requires communication when the event is confirmed, involves personal data subject to the LGPD, and may cause relevant risk or damage to data subjects.
When those conditions are met, the controller must notify ANPD and affected individuals within three business days, unless specific legislation provides another deadline. If information is incomplete, a preliminary communication can be complemented within twenty business days.
The operator does not file the controller's Article 48 notice merely because the incident happened in the operator's system. The operator must inform the controller without unjustified delay and provide the information the controller needs.
ANPD also requires controllers to keep security-incident records for at least five years, including incidents that were not reported externally.
See LGPD Data Breach Notification: When and How Companies Must Respond.
What Changes for Small Processing Agents?
Resolution 2/2022 gives qualifying small processing agents differentiated rules, but it does not eliminate security duties.
Article 12 of the regulation says small agents must adopt essential and necessary administrative and technical measures, based on minimum information-security requirements and considering privacy risk and the reality of the agent.
Article 13 allows a simplified security policy that considers implementation cost, structure, scale and processing volume. The regulation also says ANPD can consider compliance with its security guidance when evaluating good-faith adoption of preventive measures.
Security by Design: What Should Happen Before Launch?
Article 46(2) is one of the clearest security-by-design provisions in the LGPD. Security measures should be considered during product or service conception, not only after an incident.
| Design question | Why it matters | Evidence |
|---|---|---|
| Can we collect less data? | Reduces attack surface and supports necessity. | Data-field review. |
| Who needs access? | Supports least privilege and avoids broad default access. | Role matrix. |
| What should be encrypted? | Reduces exposure in storage and transmission. | Architecture / key management. |
| How do we recover? | Availability and resilience are part of data security. | Backup / DR test. |
| How will we patch it? | Security fails quickly if deployed software becomes unmaintained. | Patch owner / SLA. |
| Which vendors receive data? | Adds external attack surface and incident dependencies. | Vendor review. |
| How do we detect abuse? | Prevention without detection leaves incidents undiscovered. | Logging / monitoring. |
| How do we delete it? | End-of-life is part of secure processing. | Retention / deletion test. |
Security Evidence: What Should a Company Be Able to Show?
Article 6 includes accountability and prevention principles. A practical security program should therefore produce evidence, not merely intentions.
Useful evidence can include:
- security policy and revision history;
- employee training records;
- system and asset inventory;
- access-control and privileged-account reviews;
- MFA and encryption coverage;
- patch and vulnerability remediation logs;
- backup and restoration tests;
- vendor-security reviews;
- incident-response exercises;
- security incident records; and
- documented risk acceptance for controls not implemented.
Common LGPD Security Mistakes
“LGPD requires encryption everywhere.”
Too broad. The LGPD requires appropriate measures; ANPD recommends encryption in several contexts, but the statute does not impose one universal encryption rule.
“MFA is optional because Article 46 does not name it.”
Too simplistic. The standard is risk-based, and ANPD recommends MFA for personal-data systems and cloud access. High-risk systems need stronger justification for any omission.
“Our cloud provider is secure, so we are done.”
Cloud security is shared. Merchant/customer IAM, misconfiguration, exposed credentials, insecure apps and excessive permissions can still create incidents.
“Security is an IT issue.”
Access approvals, vendor procurement, employee training, retention, contracts and incident communications require business, privacy, legal and management participation.
“We have a policy, so Article 46 is covered.”
A policy without implemented technical and administrative controls does not protect personal data.
“Small companies are exempt.”
Incorrect. Resolution 2 requires essential and necessary technical and administrative measures for qualifying small agents.
“We will think about incidents when one happens.”
A three-business-day external reporting period leaves little room to invent governance during the event.
25-Point LGPD Security Checklist
Turn Article 46 Into an Operational Security Review
The Brazil LGPD Compliance Playbook — 2026 Edition includes a Security Incident Assessment, Vendor Privacy and Security Review, Data Mapping Worksheet, Processing Inventory / ROPA, Retention Schedule, Data-Subject Request tools, International Transfer Review, 100-point compliance audit and 30-day implementation roadmap.
Frequently Asked Questions
What security measures does the LGPD require?
Article 46 requires technical and administrative measures capable of protecting personal data against unauthorized access, accidental or unlawful destruction, loss, alteration, communication and other improper or unlawful processing. The exact controls depend on context and risk.
Does the LGPD require encryption?
Not as one universal rule for every personal-data field. ANPD recommends encryption in several contexts, including sensitive stored data, external media, communications and sensitive files. The appropriate design depends on risk, sensitivity, processing and current technology.
Does the LGPD require MFA?
Article 46 does not expressly prescribe MFA universally. ANPD recommends preferential use of MFA for systems or databases containing personal data and cloud services.
Are ISO 27001 or SOC 2 mandatory under LGPD?
The LGPD does not make either certification universally mandatory. They can support security assurance and vendor due diligence but do not replace the Article 46 risk-based analysis.
Has ANPD issued final minimum technical security standards?
As of August 20, 2026, ANPD's regulatory agenda still lists minimum technical security standards as an action in progress, with the regulatory work in internal drafting. Existing ANPD security guidance should not be confused with a final universal binding minimum-standard regulation.
What does security by design mean under the LGPD?
Article 46(2) requires security measures to be observed from the design phase of the product or service through execution. In practice, this means considering data minimization, access, authentication, encryption, vendor risk, logging, deletion and incident response before launch rather than only after a problem occurs.
Do small companies have to comply with LGPD security requirements?
Yes. Resolution 2/2022 requires qualifying small processing agents to adopt essential and necessary administrative and technical measures, considering privacy risk and the reality of the agent.
How quickly must a reportable security incident be notified?
Resolution 15/2024 requires the controller to notify ANPD and affected data subjects within three business days when the reportability threshold is met, unless specific legislation provides another deadline.
What does an operator have to do after an incident?
The operator must inform the controller without unjustified delay and provide the information needed for the controller's assessment and communication. ANPD recommends defining incident duties contractually.
How long must security incident records be kept?
Under Resolution 15/2024, controllers must keep personal-data security incident records for at least five years, including incidents that were not communicated externally.
Official Sources Used for This Guide
- Law No. 13,709/2018 — LGPD, current compiled text Primary source for Articles 6, 44, 46–50 and the statutory security, liability, incident and governance framework.
- ANPD — Information Security Guide for Small Processing Agents Official non-binding guidance covering policy, training, contracts, access control, MFA, stored data, encryption, backups, communications, vulnerability management, mobile devices and cloud services.
- ANPD — Security Checklist for Small Processing Agents Official checklist accompanying ANPD's security guidance.
- Resolution CD/ANPD No. 2/2022 — Small Processing Agents Binding rules requiring essential and necessary technical/administrative measures and allowing a simplified security policy for qualifying small agents.
- ANPD — Security Incident Communication Current August 2026 incident guidance: reportability threshold, three-business-day controller deadline, operator escalation without unjustified delay, twenty-business-day complement and five-year incident recordkeeping.
- ANPD — Current Regulatory Agenda Official 2026 status showing technical and administrative security measures, including minimum technical security standards, still in regulatory development.