The LGPD for businesses
The LGPD for your business, made simple
Updated October 2026.
The LGPD, the Brazilian data protection law, applies to businesses of every size that process data about people: customers, employees, suppliers and patients. See what changes in practice and where technology comes in.
What changes for your business
- Know what personal data the business holds, where it is and what it is used for.
- Have a legal basis for each use, such as a contract, a legal obligation or consent.
- Control who accesses each piece of data.
- Keep data only for as long as necessary.
- Handle requests from data subjects, such as access, correction and deletion.
- Report to the ANPD and to data subjects any security incident that may cause relevant risk or harm.
What can happen if you do not comply
The law provides for sanctions applied by the ANPD, such as warnings, fines and public disclosure of the infringement, among others (article 52 of the LGPD). On top of that, a data leak often brings downtime, lost customers and reputational damage.
Where technology comes in
Access control
One user per person, with access only to what they need.
Protected backup
A copy outside the company network, with tested restores.
Access logs
Know who accessed what, and when.
Protection against attacks
Firewall, managed antivirus, two-step verification and continuous monitoring.
Incident response
A plan to detect, contain and report an incident.
How Evo PS helps
Evo PS takes care of the technical side: infrastructure, information security, backup and monitoring. Full LGPD compliance also involves legal advice and your company's internal processes.
Frequently asked questions
Do small businesses have to comply with the LGPD?
Yes. The law applies to businesses of all sizes. The ANPD has simplified rules for small processing agents.
Does cloud backup solve it?
It helps, but it is not enough. You also need to control access, test restores and protect against attacks.
What should I do if there is a data leak?
Contain the incident, assess the risk to data subjects and, when there is relevant risk or harm, report it to the ANPD and to the data subjects.
Do I need a data protection officer (DPO)?
The law provides for a data protection officer, and the ANPD rules include flexibility for small businesses. Check your case with your legal advisor.
Start with the free diagnostic
In a few minutes you see the impact of a stoppage and the protections your company is missing. Result on screen, no sign-up.
This content is for information only and does not replace legal advice.