Brazil LGPD

Lei Geral de Protecao de Dados: technical safeguards, processing activity records, supplier tracking.


Short name	LGPD
Region	Americas
Country or scope	Brazil
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers LGPD

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for LGPD.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for LGPD and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`BR-LGPD-46` Technical Security Measures	Processing agents must adopt technical and administrative measures able to protect personal data from unauthorised access and from accidental or unlawful destruction or alteration, which includes integrity verification of software components (LGPD Art. 46)	Scan
`BR-LGPD-37` Records of Processing Operations	Controllers and processors must keep records of the personal data processing operations they carry out, which presupposes an inventory of the software performing that processing (LGPD Art. 37)	Scan
`BR-LGPD-39` Processor Chain Accountability	Processors must carry out processing according to the controller's instructions, and the controller must verify compliance, requiring identification of the suppliers behind processing components (LGPD Arts. 39-42)	Scan
`BR-LGPD-48` Security Incident Notification Readiness	Controllers must notify the ANPD and data subjects of security incidents that may cause relevant risk or damage, which requires the ability to determine quickly which components and versions were affected (LGPD Art. 48)	Scan
`BR-LGPD-50` Governance and Good Practice Documentation	Good-practice and governance programmes must be demonstrable through documented, up-to-date records, met by SBOMs bearing a document identity and creation timestamp (LGPD Art. 50)	Scan
`BR-LGPD-6X` Accountability Principle - Provenance	The accountability principle requires agents to demonstrate the effective measures taken to comply, including who produced the compliance documentation itself (LGPD Art. 6(X))	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`LGPD-A6`	Process Personal Data According to Good Faith Principles
`LGPD-A7`	Establish a Lawful Basis for Processing Personal Data
`LGPD-A9`	Provide Clear Notice of Processing Activities
`LGPD-A11`	Obtain Explicit Consent for Sensitive Data Processing
`LGPD-A17`	Fulfil Data Subject Ownership Rights
`LGPD-A18`	Respond to Data Subject Rights Requests Within 15 Days
`LGPD-A37`	Maintain Records of Processing Activities
`LGPD-A38`	Conduct Data Protection Impact Assessments
`LGPD-A46`	Implement Proportionate Technical and Administrative Security Measures
`LGPD-A48`	Notify ANPD and Data Subjects of Security Incidents
`LGPD-A50`	Establish a Privacy Governance Programme
`LGPD-DPO`	Appoint a Data Protection Officer

Policy templates

Written for LGPD:

Lawful Basis and Consent Management Policy (LGPD)
Data Subject Rights Policy (LGPD)
Security Incident Notification and DPIA Policy (LGPD)

And 22 from the standard set, adapted to LGPD.