The LGPD's Small-Business Regime: Who Qualifies, Who Is Excluded and Which Clocks Run at Double Speed

A Regulation the Statute Asked For

Law 13.853 of 2019 added item XVIII to Article 55-J of the LGPD, directing the ANPD to issue simplified and differentiated rules, guidance and procedures, including on deadlines, so that micro and small enterprises and self-declared startups or innovation companies can adapt to the law. The ANPD's Board of Directors responded with Resolution CD/ANPD No. 2 of 27 January 2022, published in the Diário Oficial da União on 28 January 2022 and effective on publication.

The Regulation has been amended once. Article 2 of Resolution CD/ANPD No. 15 of 24 April 2024, the security incident regulation, replaced item II of Article 14. The consolidated text on the ANPD's website shows the superseded wording struck through and the new wording marked as given by Resolution 15. The ANPD's table of regulations lists Resolution 2 as in force with that amendment and no other. This post reads the consolidated text and treats the struck language as repealed; all translations from the Portuguese are this publication's own.

Who Counts as a Small Processing Agent

Article 2, I defines small processing agents (agentes de tratamento de pequeno porte) by listing who they are, not by counting data subjects:

• Microenterprises and small enterprises, defined by cross-reference to Articles 3 and 18-A, paragraph 1 of Complementary Law 123 of 2006 and including the individual microentrepreneur (MEI)
• Startups meeting the criteria in Chapter II of Complementary Law 182 of 2021
• Private-law legal entities, expressly including non-profits
• Natural persons and unincorporated private entities that process personal data with the typical obligations of a controller or processor

The revenue lines sit in those other statutes. Under Article 3 of Complementary Law 123, a microenterprise earns gross revenue of up to R$360,000 in each calendar year and a small enterprise more than that and up to R$4,800,000, the ceiling set by Complementary Law 155 of 2016. Under Article 4, paragraph 1 of Complementary Law 182, a startup is eligible with gross revenue of up to R$16,000,000 in the previous calendar year (or R$1,333,334 multiplied by the months of activity, if fewer than twelve), up to ten years of registration in the national company register, and either an innovative business model declared in its constitutive act or enrolment in the Inova Simples regime.

Article 1's sole paragraph keeps the Regulation away from processing the LGPD itself does not reach, such as processing by a natural person for purely private, non-economic purposes.

The Three Exclusions

Qualifying under Article 2 is necessary but not sufficient. Article 3 withholds the differentiated treatment from any small processing agent that:

1. Carries out high-risk processing for data subjects (subject to Article 8, discussed below)
2. Earns gross revenue above the Article 3, II limit of Complementary Law 123, or for startups the Article 4, paragraph 1, I limit of Complementary Law 182
3. Belongs to a de facto or de jure economic group whose global revenue exceeds those limits

Article 5 puts the burden on the agent: when the ANPD asks, the agent has up to fifteen days to prove that it fits Articles 2 and 3.

The high-risk test

Article 4 makes processing high risk when it meets, cumulatively, at least one general criterion and at least one specific criterion:

The ANPD's December 2024 guidance on the encarregado applies the test to two hypotheticals. A home-care company with revenue of R$2,500,000 that processes health data about patients over 60 meets both a general and a specific criterion, so its small-enterprise status does not bring the differentiated regime with it. A credit-analysis startup using artificial intelligence for more than two million customers meets the large-scale and emerging-technology criteria and is excluded on the same reasoning.

Article 8 is the one relief that survives high-risk processing. Any small processing agent, including one carrying out high-risk processing, may organise through business representative bodies, legal entities or natural persons to negotiate, mediate and conciliate data subjects' complaints.

What the Relief Consists Of

A record of processing in simplified form

Article 37 of the LGPD requires controllers and processors to keep a record of their processing operations. Article 9 of the Regulation allows small processing agents to keep it in simplified form and commits the ANPD to supply a model. The model is published as a two-page form, Modelo de Registro das Operações de Tratamento de Dados Pessoais para Agentes de Tratamento de Pequeno Porte, with a filling-in page. Its columns are contact information for the organisation; the process, purpose and legal basis under Articles 7 or 11; the personal data involved; the categories of data subject (general, children and adolescents, elderly people); sharing outside the organisation; security measures; retention period; and observations. The form carries no publication date, and the ANPD's small-agent security guidance page links it in Excel and PDF versions.

No mandatory encarregado, with a condition

Article 11 states that small processing agents are not obliged to appoint the encarregado required by Article 41 of the LGPD. Paragraph 1 attaches the condition: an agent that does not appoint one must provide a communication channel with data subjects, to meet Article 41, paragraph 2, I, which covers accepting complaints and communications, giving clarifications and taking action. Paragraph 2 treats a voluntary appointment as a good-practice and governance policy for sanctioning purposes. Resolution CD/ANPD No. 18 of 2024, the encarregado regulation, repeats the channel requirement in its Article 3, paragraph 3. The appointment rules that apply when the waiver is not available are covered in a separate post on that regulation.

Simplified security

Article 12 still requires essential administrative and technical security measures based on minimum information-security requirements, calibrated to the privacy risk and to the agent's circumstances. Its sole paragraph states that following the ANPD's security recommendations and good practices, including its guides, counts as observance of Article 52, paragraph 1, VIII of the LGPD, one of the factors weighed when sanctions are set. Article 13 permits a simplified information security policy that takes account of implementation cost and the agent's structure, scale and volume, and paragraph 2 commits the ANPD to consider such a policy under Articles 6, X and 52, paragraph 1, VIII and IX. The ANPD's own security guide for small agents is version 1.0 of October 2021, three months older than the Regulation.

Doubled Deadlines, and the One That Changed in 2024

Article 14 grants small processing agents double time in four places. Each doubling depends on a base deadline set somewhere else, so the table below pairs them:

Item II is where the 2024 amendment bites. As originally written, it doubled the incident deadline except where there was potential harm to data subjects' physical or moral integrity or to national security, in which case the ordinary deadline applied. Resolution 15 replaced that item with a plain cross-reference to the incident regulation, and the incident regulation itself doubles the deadlines in Article 6, paragraph 8 (the notice to the ANPD and the twenty-day supplement) and Article 9, paragraph 6 (the notice to data subjects). Neither provision repeats the old exception. Article 6, paragraph 2, IX of the incident regulation also asks the notifying controller to state, where applicable, that it is a small processing agent.

Article 15 adds a timing relief that runs the other way from a doubling. The LGPD's Article 19, I requires confirmation of processing or access in simplified format immediately; the Regulation lets small processing agents provide that simplified declaration within up to fifteen days of the request.

One further doubling sits outside Resolution 2. Article 17 of the annex to Resolution CD/ANPD No. 4 of 2023, the sanctions-calculation regulation, sets twenty working days to pay a fine from official notice of the decision, and its paragraph 2 gives small processing agents, as defined by Resolution 2, double that period.

What the Regulation Does Not Relax

Article 6 is the limiting clause. Waiving or softening the obligations in the Regulation does not exempt small processing agents from the rest of the LGPD, expressly including its legal bases and principles, from other legal, regulatory and contractual data protection provisions, or from data subjects' rights. Article 7 keeps the duty to provide information about processing and to meet requests under Articles 9 and 18, by electronic, printed or any other means that secures the rights and easy access.

Article 10 promised a simplified incident-notification procedure for small agents under specific regulation. The incident regulation that followed in 2024 delivered doubled deadlines and a self-identification field, as described above, rather than a separate procedure.

Article 16 closes the Regulation with a reservation of power: the ANPD may require a small processing agent to comply with any waived or relaxed obligation, taking into account relevant circumstances such as the nature or volume of the operations and the risks to data subjects. The differentiated regime is therefore a default the regulator can withdraw from a particular agent, not a fixed status.

Frequently Asked Questions