Brazil Data Privacy

The Brazilian General Data Protection Law (“LGPD”) is Brazil’s primary regulation aimed at the protection of personal data. The LGPD applies to the processing of personal data (defined as information regarding an identified or identifiable natural person) carried out by individuals or legal entities from the public or private sector, irrespective of the means used for the processing or the country where the controller or the data is located, provided that: 1) the processing is carried out in Brazil, 2) the processing is aimed at the offering or provision of goods or services, or at the processing of data of individuals located in Brazil, or 3) the personal data was collected in Brazil.
The LGPD establishes principles and rules for processing personal data. Organizations must be able to demonstrate the adoption of measures which are capable of proving compliance with the rules of personal data protection, including the efficacy of these measures, necessitating the establishment and enforcement of compliant policies applicable to the processing of personal data.
Under the LGPD, controllers and processors (as defined under the LGPD) are required to adopt technical and administrative measures to protect personal data from unauthorized access and accidental or unlawful situations of destruction, loss, alteration, communication, or any type of improper or unlawful processing. Additionally, the LGPD grants the Brazilian National Data Protection Authority (“ANPD”) authority to establish minimum technical standards to be implemented by controllers and processors.
AWS is vigilant about your privacy and data security. Security at AWS starts with our core infrastructure. Custom-built for the cloud and designed to meet the most stringent security requirements in the world, our infrastructure is monitored 24x7 to ensure the confidentiality, integrity, and availability of our customer's data. The same world-class security experts who monitor this infrastructure also build and maintain our broad selection of innovative security services, which can help you simplify meeting your own security and regulatory requirements. As an AWS customer, regardless of your size or location, you inherit all the benefits of our experience, tested against the strictest of third-party assurance frameworks.
AWS implements and maintains technical and organizational security measures applicable to AWS cloud infrastructure services under globally recognized security assurance frameworks and certifications, including ISO 27001, ISO 27017, ISO 27018, PCI DSS Level 1, and SOC 1, 2, and 3. These technical and organizational security measures are validated by independent third-party assessors, and are designed to prevent unauthorized access to or disclosure of customer content.
For example, ISO 27018 is the first International code of practice that focuses on protection of personal data in the cloud. It is based on ISO information security standard 27002 and provides implementation guidance on ISO 27002 controls applicable to Personally Identifiable Information (PII) processed by public cloud service providers. This demonstrates to customers that AWS has a system of controls in place that specifically address the privacy protection of their content.
These comprehensive AWS technical and organizational measures are consistent with the goals of the LGPD to protect personal data. Customers using AWS services maintain control over their content and are responsible for implementing additional security measures based on their specific needs, including content classification, encryption, access management and security credentials.
As AWS does not have visibility into or knowledge of what customers are uploading onto its network, including whether or not that data is deemed subject to the LGPD, customers are ultimately responsible for their own compliance with the LGPD and related regulations. The content on this page supplements the existing Data Privacy resources to help you align your requirements with the AWS Shared Responsibility Model when you store and process personal data using AWS services.