Brazilian Internet Law

Final version, after presidential vetoes

Law No. 13,709, of August 14, 2018

Provides for the protection of personal data and changes Law No. 12,965, of April 23, 2014 (the “Brazilian Internet Law”).

The NATIONAL CONGRESS decrees:

CHAPTER I: PRELIMINARY PROVISIONS

Art. 1:

This Law provides for the processing of personal data, including...

Art. 2:

The discipline of personal data protection is grounded on the fo...

Art. 3:

This Law applies to any processing operation carried out by a na...

Art. 4:

This Law does not apply to the processing of personal data that:

Art. 5:

For purposes of this Law, the following definitions apply:

Art. 6:

Activities of processing of personal data shall be done in good ...

CHAPTER II: PROCESSING OF PERSONAL DATA

Section I: Requirements for the Processing of Personal Data

Art. 7:

Processing of personal data shall only be carried out under the ...

Art. 8:

The consent provided in Item I of Art. 7 of this Law shall be gi...

Art. 9:

The data subject has the right to facilitated access to informat...

Art. 10:

Controller’s legitimate interest can only be grounds for proces...

Section II: Processing of Sensitive Personal Data

Art. 11:

The processing of sensitive personal data shall only occur in t...

Art. 12:

Anonymized data shall not be considered personal data, for purp...

Art. 13:

When carrying out public health studies, research entities may ...

Section III: Processing of Children and Adolescents’ Personal Data

Art. 14:

The processing of personal data belonging to children and adole...

Section IV: Termination of Data Processing

Art. 15:

The processing of personal data shall be terminated under the f...

Art. 16:

Personal data shall be deleted following the termination of the...

CHAPTER III: DATA SUBJECTS’ RIGHTS

Art. 17:

All natural person is assured ownership of her/his personal dat...

Art. 18:

The personal data subject has the right to obtain the following...

Art. 19:

Confirmation of the existence of or access to personal data sha...

Art. 20:

The data subject has the right to request review, by a natural ...

Art. 21:

Personal data concerning the regular exercise of rights by the ...

Art. 22:

The defense of the interests and rights of data subjects may be...

CHAPTER IV: PROCESSING OF PERSONAL DATA BY PUBLIC AUTHORITIES

Section I: Rules

Art. 23:

Processing of personal data by legal entities of public law ref...

Art. 24:

Public companies and mixed-capital companies that operate in th...

Art. 25:

Data shall be kept in an interoperable format and structured fo...

Art. 26:

The shared use of personal data by public authorities shall ful...

Art. 27:

Communication or shared use of personal data from a legal entit...

Art. 28:

(vetoed)

Art. 29:

The national authority may request, at any time, that entities ...

Art. 30:

The national authority may establish complementary rules for co...

Section II: Accountability

Art. 31:

When there is an infringement of this Law as a result of person...

Art. 32:

The national authority may request agents of the public authori...

CHAPTER V: INTERNATIONAL TRANSFER OF DATA

Art. 33:

of this Law shall be communicated to the national authority.

Art. 34:

The level of data protection in the foreign country or internat...

Art. 35:

The definition of the content of standard contractual clauses, ...

Art. 36:

Changes to guarantees presented as sufficient for compliance wi...

CHAPTER VI: PERSONAL DATA PROCESSING AGENTS

Section I: Controller and Processor

Art. 37:

The controller and the processor shall keep records of personal...

Art. 38:

The national authority may determine that the controller must p...

Art. 39:

The processor shall carry out the processing according to the i...

Art. 40:

The national authority may provide standards of interoperabilit...

Section II: Data Protection Officer

Art. 41:

The controller shall appoint an officer to be in charge of proc...

Section III: Liability and Loss Compensation

Art. 42:

The controller or the processor that, as a result of carrying o...

Art. 43:

Processing agents shall only not be held liable when they prove...

Art. 44:

Processing of personal data shall be irregular when it does not...

Art. 45:

When there is violation of data subject’s right in the scope of...

CHAPTER VII: SECURITY AND GOOD PRACTICES

Section I: Security and Secrecy of Data

Art. 46:

Processing agents shall adopt security, technical and administr...

Art. 47:

Processing agents or any other person that intervenes in one of...

Art. 48:

The controller must communicate to the national authority and t...

Art. 49:

The systems used for processing personal data shall be structur...

Section II: Good Practice and Governance

Art. 50:

Controllers and processors, within the scope of their competenc...

Art. 51:

The national authority shall encourage the adoption of technica...

CHAPTER VIII: MONITORING

Section I: Administrative Sanctions

Art. 52:

Data processing agents that commit infractions of the rules pro...

Art. 53:

The national authority shall define the methodologies that will...

Art. 54:

The amount of daily fines applied to infractions of this Law sh...

CHAPTER IX: THE NATIONAL AUTHORITY FOR PROTECTION OF DATA (“ANPD”) AND THE NATIONAL BOARD FOR PROTECTION OF PERSONAL DATA AND PRIVACY

Section I: The National Authority for Protection of Data (“ANPD”)

Art. 55:

(vetoed)

Art. 56:

(vetoed)

Art. 57:

(vetoed)

Section II: The National Board for the Protection of Personal Data and Privacy

Art. 58:

(vetoed)

Art. 59:

(vetoed)

CHAPTER X: FINAL AND TRANSITIONAL PROVISIONS

Art. 60:

Law No. 12,965, of April 23, 2014 (the “Brazilian Internet Law”...

Art. 61:

The foreign company shall be notified and summonsed of all proce...

Art. 62:

The national authority and the Anísio Teixeira National Institu...

Art. 63:

The national authority shall establish rules on the progressive...

Art. 64:

The rights and principles expressed in this Law do not exclude ...

Art. 65:

This Law shall come into force eighteen (18) months following i...