LGPD fundamentals and scope
Why this domain is about boundaries, not definitions
The exam here asks a deceptively simple question: does this processing operation fall under Lei nº 13.709/2018 at all? Articles 3 and 4 (scope and exclusions) are tested far more often than the preamble.
The law in one paragraph
The LGPD regulates tratamento de dados pessoais - any operation involving personal data of a natural person, digital or on paper, carried out by public or private entities - to protect privacy and the free development of personality (Art. 1). Its foundations (Art. 2) include privacy, autodeterminação informativa, freedom of expression, consumer protection and human rights. Two consequences: legal entities are outside its scope (their data are protected by other rules), and the law is technology-neutral.
Article 3: three independent triggers
The LGPD applies to processing that:
- is carried out in Brazilian territory;
- aims at offering or providing goods or services to individuals located in Brazil;
- involves personal data collected in Brazil. No subsidiary, branch or CNPJ is required. Any single trigger suffices.
Article 4: exclusions
- a natural person processing for exclusively private and non-economic purposes;
- journalistic, artistic or academic purposes, with safeguards;
- public security, national defence, state security or criminal investigation, governed by specific law;
- data originating abroad that is not transferred to, or shared with, Brazilian agents;
- data that enters Brazil only to be accessed from abroad and stays abroad.
Definitions that decide cases (Art. 5)
Titular (data subject) is the natural person; controlador decides on the processing; operador processes on the controller's behalf. Dado pessoal sensível covers racial or ethnic origin, religious belief, political opinion, union membership, philosophical or religious belief, health or sexual life, genetic and biometric data. Anonymisation removes the possibility of association with an individual; pseudonymisation does not, so pseudonymised data remain personal data (Art. 12).
Worked example
A US company with no Brazilian entity runs a fitness app in Portuguese, priced in BRL and marketed to users in São Paulo, with data stored in the US. Trigger 2 is met, so the LGPD applies in full: lawful basis, Article 18 rights, DPO appointment, breach notification. The absence of a Brazilian establishment affects enforcement logistics, not the obligations.
Traps
- Assuming the LGPD follows nationality; it follows the location of people and data.
- Stretching the private/non-economic exemption to cover a monetised blog.
- Believing anonymised data can never re-enter scope: if re-identification is reasonably possible, it is personal data again.
- Missing that a Brazilian-based controller processing abroad is still caught by trigger 1.