Brazil's Lei Geral de Proteção de Dados (LGPD) has been in force since 2020, and for the first few years most engineering teams filed it under "GDPR's Brazilian cousin, we'll get to it." That stopped being a safe filing in July 2023, when the regulator, the ANPD, issued its first fine: R$14,400 against Telekall Infoservice, a tiny operation selling WhatsApp contact lists, sanctioned for processing without a legal basis and for having no data protection officer. Small fine, big signal: enforcement is not reserved for Meta.
Meta got its turn anyway. In July 2024 the ANPD ordered Meta to suspend the use of Brazilians' personal data for training its AI models, and the suspension held for two months until Meta reworked the rollout. That is the part of LGPD that fine amounts don't capture: the ANPD can halt your processing, not just bill you for it.
This post looks at LGPD from the database, because that is where the law gets tested. The statute talks about principles and rights; the sanction proceedings talk about who could access what, whether anyone noticed, and how long notification took. All three questions are answered by your database controls, not your privacy policy.
Not a Translated GDPR
If you already run a GDPR program, about 80% carries over. The cast is even the same: the data subject (titular), the controller (controlador), the processor (operador), and the DPO (encarregado).
The remaining 20% is where teams get surprised:
| Dimension | LGPD | GDPR |
|---|---|---|
| Legal bases | 10 (Art. 7), including credit protection | 6 (Art. 6) |
| Maximum fine | 2% of Brazil revenue, capped at R$50M per infraction | 4% of global revenue |
| Breach notification | 3 business days (Resolution CD/ANPD 15/2024) | 72 hours |
| DPO | Expected of controllers by default; small agents exempted | Required only above thresholds (public bodies, large-scale monitoring) |
| Regulator | One national authority with preventive measures that can suspend processing | Per-country DPAs |
Three of these deltas matter operationally.
First, the fine cap cuts both ways. R$50M per infraction is a smaller worst case than GDPR's 4% of global revenue, which tempts finance teams to price LGPD risk lower. But the ANPD's preventive measures reset that math: an order to stop processing, like Meta's, costs more than most fines would.
Second, "3 business days" sounds more generous than GDPR's 72 hours until you try to meet it. The clock starts when you learn of the incident, and what you must deliver is scoped: which data, which subjects, what risk. Two of the sanctioned public bodies (IAMSPE, which notified 1.5 million affected subjects late, and the Santa Catarina health department) were cited for slow or insufficient notification, not for being breached.
Third, the DPO expectation is broader than GDPR's. Telekall was fined partly for simply not having one. If your GDPR analysis concluded you're under the DPO threshold, that conclusion does not transfer.
What the ANPD Actually Sanctions
Read the docket so far and a pattern emerges. Telekall: no legal basis, no DPO. IAMSPE and Santa Catarina: weak security controls, missing impact assessment, late breach notification. Meta: no valid legal basis for a new processing purpose. Nothing exotic. The ANPD is sanctioning teams that couldn't demonstrate the basics: know what you process, secure it, notify on time, and prove all three.
That's good news for database teams, because "prove the basics" is a tractable engineering problem. Here is the work, mapped to where it lands in the database.
The Database Work
Know where the personal data lives
Brazilian schemas have their own tells: cpf (the 11-digit taxpayer ID), rg (state identity card), cnh (driver's license), cns (national health card), plus the universal email and phone columns. Classification is step one because every other control keys off it: you cannot mask, delete, or report on columns you haven't found. Pay extra attention to Art. 11 sensitive categories (health, biometrics, religion, political opinion, racial or ethnic origin), which carry stricter bases and heavier sanctions.
Restrict by statement, not by connection
LGPD's necessity principle (Art. 6) says process only what the purpose requires. At the database layer that means least privilege at the query level: the support engineer who needs order status does not need SELECT * on the customers table. Standing superuser access for humans is exactly the "inadequate security measure" language that shows up in ANPD decisions. Grant scoped, time-boxed access on request instead.
Mask the human path, and be honest about its boundary
For the everyday case (a developer debugging against production, an analyst pulling numbers), dynamic data masking lets the query run while returning ***.***.***-42 instead of a real CPF. One boundary to state plainly: query-layer masking governs humans going through your tooling. Your application's own connection is unaffected, and backups stay cleartext. For lower environments, use static masking or full anonymization instead. Art. 12 is the payoff: data that is genuinely anonymized, with no reasonable means of reversal, falls outside LGPD entirely. Irreversible anonymization is the highest-leverage control in the whole law.
Retention and erasure that reach every copy
Art. 18 gives subjects the right to deletion, and Arts. 15-16 require erasure when the processing purpose ends. The hard part is the word "every": the row in the primary, the replica, the analytics warehouse, the S3 backup from last quarter. Where a record must stay immutable for a conflicting retention duty (tax, anti-fraud), the practical pattern is to keep PII in a separate store referenced by opaque ID, or encrypt it per user and erase by deleting the key.
The 3-business-day clock runs on your audit trail
You cannot scope a breach in 3 business days without being able to answer who read or changed what, when, from where. This is the same lesson we learned in our own SOC 2 audit: "logging enabled" is a configuration; audit evidence is an artifact you can produce on demand. If reconstructing a week of access to the customers table takes your team longer than an afternoon, the notification deadline is already lost.
Replicas cross borders too
Resolution CD/ANPD 19/2024 regulates international transfers and ships Brazil's version of standard contractual clauses. Engineering teams tend to read "transfer" as an API integration, but a read replica in us-east-1 and a backup bucket in Frankfurt are transfers as well. Inventory where every copy of Brazilian personal data physically sits before the legal team papers the SCCs.
Where Bytebase Fits
Bytebase covers the human-to-database slice of this list: classification-driven dynamic masking in the SQL Editor, just-in-time access grants with expiry, four-eyes approval on data changes, and an audit log you can filter and export when the 3-day clock starts. It does not encrypt your backups, place your replicas, or govern your application's own connection; those controls live in your infrastructure layer, and you need both halves.
Closing Thoughts
The ANPD's first years of enforcement have not punished sophisticated failures. They punished a company with no DPO, hospitals that notified late, and a platform that skipped the legal basis. LGPD compliance is not a translation project from your GDPR binder; it is the ability to prove, from the database outward, that the basics hold. So far, every name on the sanction list is a team that couldn't.