LGPD for Data Center and Cloud Operators: Roles, Security and International Data Transfers

Reviewed by Luiz Eduardo da Silva, director of LegalBR. Updated on 28 October 2026. About 9 minutes to read.

LGPD data center compliance starts with one question: does the operator decide anything about the data, or does it only provide space, power and infrastructure? The answer sets its role, its duties and its liability. This guide covers roles for colocation and cloud, incident reporting, the data protection officer, international transfers after the 2024 regulation and the 2026 EU adequacy decisions, sector localization rules and a contract checklist.

Controller or processor: LGPD roles in data center and cloud models

Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados, LGPD, Law 13,709/2018) applies to processing carried out in Brazil, among other cases. It defines the controller as the party that makes decisions about processing, and the processor as the party that processes on the controller’s behalf. In addition, the processor must follow the controller’s lawful instructions, and it is jointly liable when it breaches the law or departs from those instructions.

The table shows typical outcomes, not fixed labels. The ANPD’s guidance on processing agents assesses roles case by case, based on who actually decides. Therefore, document the role in each contract and keep operations consistent with it. Even a pure colocation operator is a controller for its own security systems, such as biometric access and video surveillance.

Security duties and incident reporting

The LGPD requires processing agents to adopt security, technical and administrative measures to protect personal data. For an infrastructure provider, that means physical security, access control, logging and resilience, with evidence a customer can audit.

Resolution CD/ANPD 15/2024

The ANPD’s incident regulation was approved on 24 April 2024. Its main rules are:

• Deadline. The controller notifies the ANPD and affected data subjects within three business days counted from its knowledge that the incident affected personal data.
• Complementary notice. Additional information may follow within 20 business days of the original notice.
• Reportable incidents. Those that may significantly affect data subjects’ interests and fundamental rights and involve, for example, sensitive data, data of children, adolescents or elderly people, financial or authentication data, protected data or large-scale processing.
• Records. The controller keeps a record of every incident, reported or not, for at least five years.

The legal duty to notify sits with the controller. Consequently, a cloud provider’s contract must require prompt notice to the customer, with the facts the customer needs to meet its own three-day clock.

The data protection officer (encarregado)

Resolution CD/ANPD 18/2024, of 16 July 2024, regulates the data protection officer (encarregado).

• The controller must appoint one; for a processor, appointment is optional but recommended.
• The appointment is made by a formal act of the processing agent.
• The officer may be an employee, an external individual or a legal entity; if a legal entity, the name of the responsible individual must be disclosed.
• The officer must be able to communicate clearly with data subjects and the ANPD in Portuguese.
• Identity and contact details must be published in a prominent place on the website.
• The officer must declare any situation that could be a conflict of interest.

For foreign groups, a global DPO can serve, provided Portuguese communication and conflict rules are met. In addition, the ANPD itself changed status: Law 15,352/2026, published on 25 February 2026, turned it into the National Data Protection Agency, keeping the ANPD acronym.

International data transfers

Cloud and data center groups move data across borders by design. The LGPD allows international transfers only on the grounds listed in its art. 33, and Resolution CD/ANPD 19/2024, published on 23 August 2024, regulates them.

What the 2024 regulation requires

• Integral adoption. The SCCs must be adopted in full, without alteration. Companies had 12 months, until 23 August 2025, to update existing contracts.
• Transparency. On request, the controller must provide the full text of the clauses within 15 days, subject to trade secrets. It must also publish, in Portuguese on its website, information about the transfer.
• Foreign clauses. The ANPD may recognize clauses from other countries as equivalent. Until then, foreign templates alone do not suffice.
• Collection abroad. Data collected directly abroad is not an international transfer, although the LGPD may still apply under its territorial rules.

The EU and EEA

Brazil and the European Union adopted mutual adequacy decisions in January 2026. Under ANPD Resolution 32/2026, transfers between Brazil and EU Member States, Iceland, Liechtenstein and Norway no longer need additional mechanisms, except for transfers made solely for public security, defense or criminal enforcement. However, transfers to the United States and other countries still need SCCs or another valid ground.

Data localization: sector rules

The LGPD has no general rule requiring personal data to stay in Brazil. Nevertheless, sector rules can impose location, notice or access conditions on a provider’s customers, and those conditions flow into the provider’s contracts.

Financial institutions

CMN Resolution 4,893/2021 governs cybersecurity and the contracting of relevant data processing, storage and cloud services by institutions authorized by the Central Bank. Payment institutions follow the parallel BCB Resolution 85/2021.

• The institution must notify the Central Bank within ten days after contracting relevant services, naming the provider and the countries and regions where services are provided and data stored.
• Services abroad require an agreement for information exchange between the Central Bank and the foreign supervisors; otherwise, the institution must request authorization at least 60 days before contracting.
• Contracts must state the countries and regions of processing, security measures, data transfer and deletion at termination, notice of subcontracting and Central Bank access to contracts and data.

In December 2025, CMN Resolution 5,274/2025 and BCB Resolution 538/2025 added detailed cybersecurity controls, with full compliance due by 1 March 2026. As a result, cloud providers serving banks should expect more audit and evidence requests.

Federal public sector

For federal agencies, Normative Instruction GSI/PR 5/2021 sets cloud security rules. As a rule, data must be hosted in Brazilian territory, and at least one updated backup must stay in Brazil. Only information without access restrictions may have backup copies abroad, and classified information cannot be processed in the cloud.

LGPD data center contracts checklist

Whether the document is a colocation MSA or a cloud data processing agreement, check these points:

• Role of each party stated for each service, including the provider’s own controller activities
• Processing only on documented instructions from the customer
• Security measures, certifications and audit rights
• Incident notice to the customer fast enough for the three-business-day deadline
• Countries and regions of storage and processing, and notice before changes
• ANPD SCCs attached in full for transfers outside adequacy jurisdictions
• Subprocessor list, notice and objection rights
• Data return and deletion at termination, with a certificate
• Regulator access clauses where the customer is a financial institution
• Liability allocation consistent with joint liability rules

For a broader view of how the LGPD reaches foreign groups, see our guide on LGPD for foreign companies.

A compliance roadmap

1. Map services and roles

   List each product and decide where the company is controller, processor or neither.

2. Map data flows

   Identify where data is stored, which group entities access it and which countries are involved.

3. Choose transfer mechanisms

   Use adequacy for EU and EEA flows and the ANPD SCCs, in full, for others.

4. Appoint the officer

   Formalize the appointment and publish identity and contact details on the website.

5. Set the incident playbook

   Define internal escalation and customer notice so controllers can meet the three-day deadline.

6. Update contracts

   Apply the checklist to MSAs and processing agreements, with sector annexes for regulated customers.

A foreign operator also needs a Brazilian entity in good standing to sign these contracts. See our guide on opening a business in Brazil; once the apostilled documents arrive, our team typically has the company ready to operate in 15 to 30 days, unless the activity requires a specific license.

Common mistakes

• Calling every provider a processor. Pure colocation often involves no processing of customer data, and the label creates obligations nobody performs.
• Forgetting the provider’s own data. Access logs, biometrics and CCTV make the operator a controller.
• Editing the ANPD clauses. The SCCs must be adopted in full; changes can invalidate the mechanism.
• Relying on EU SCCs alone. Foreign templates are not equivalent unless the ANPD recognizes them.
• Slow incident notice to customers. The controller’s three-day clock runs regardless of the provider’s internal process.
• Assuming a localization duty exists, or that none applies. Check the customer’s sector rules instead.

For other entry topics, see our guide to doing business in Brazil.

Questions investors ask