Privacy Laws
Brazil's LGPD and Canada's PIPEDA are in force today, and each sets its own deadlines. Complyanz keeps your records of processing, tracks every data subject request against its legal deadline, records your privacy officer and international transfers, and starts the right breach clock for each law. ISO 27701 is an option, not a requirement.
Two laws, one privacy program
What each law requires, and when
These are the deadlines set by the LGPD and the ANPD resolutions, and by PIPEDA and its Breach of Security Safeguards Regulations. Complyanz computes each one from the date that starts its clock.
| Law | Obligation | Deadline |
|---|---|---|
| LGPD | Confirm that you process someone's data, or give access in simplified form | Immediately (Art. 19 I). Small-scale processing agents have up to 15 days. |
| LGPD | Give a clear and complete declaration of the processing: origin, criteria and purpose | Within 15 days of the request (Art. 19 II), or 30 for small-scale processing agents |
| LGPD | Communicate a security incident to the ANPD | 3 business days from learning that personal data were affected (ANPD Resolution 15/2024), or 6 for small-scale processing agents |
| LGPD | Communicate the incident to the affected data subjects | 3 business days, or 6 for small-scale processing agents |
| LGPD | Supplement the communication to the ANPD | 20 business days from the communication, or 40 for small-scale processing agents |
| LGPD | Record every security incident, including those not communicated | Keep the record for at least 5 years |
| PIPEDA | Respond to a written access request | 30 days (s. 8(3)), extendable by up to 30 more with notice given within the first 30 (s. 8(4)); with no response by then, the request is deemed refused (s. 8(5)) |
| PIPEDA | Report a breach that creates a real risk of significant harm to the OPC, and notify the affected individuals | As soon as feasible after you determine that the breach occurred (s. 10.1). There is no fixed number of days. |
| PIPEDA | Keep a record of every breach of security safeguards, whether reported or not | 24 months from the day you determine that the breach occurred (s. 10.3) |
Other LGPD rights, such as correction or deletion, have no deadline set by regulation yet, so Complyanz applies 15 days as a house rule and labels it unofficial. Business days follow Brazil's national holidays in Brasília time, and optional days off such as Carnival count as business days, so the date shown is the earlier, safer one.
Everything the two laws ask you to show
What is in scope, and what is not
Start with any framework, add the others later
LGPD obligations, PIPEDA principles and ISO 27701 controls overlap. Complyanz keeps a crosswalk between them, so when you add a framework you see which of its requirements relate to work you have already done and can reuse the evidence. The mappings are our own reading, not an official correspondence, and reuse is always your decision.
Included in Complete, or as an add-on
The Privacy Laws module covers LGPD and PIPEDA. It is included in the Complete plan and can be added to any other plan, priced by the number of people in scope like the plans themselves.
Privacy laws FAQ
Do we need ISO 27701?
No. ISO 27701 is a voluntary, certifiable standard, and neither LGPD nor PIPEDA requires it. You can run either law in Complyanz without it. If you add it later, the crosswalk shows which of its controls relate to work you have already done; the mappings are our own reading, not an official correspondence.
Does Complyanz certify that we comply?
No. Complyanz does not certify, attest or guarantee compliance with LGPD or PIPEDA. It organizes the records, deadlines and documents that show how you comply; whether you do is for the ANPD, the OPC and the courts to decide. Your encarregado does not need a certification either.
How fast must we communicate a security incident under LGPD?
Under ANPD Resolution 15/2024, a security incident that may cause relevant risk or damage to data subjects must be communicated to the ANPD and to the affected data subjects within 3 business days of the controller learning that personal data were affected, or 6 for small-scale processing agents. The communication to the ANPD can be supplemented within 20 business days (40 for small-scale agents). Every incident, communicated or not, must be recorded and the record kept for at least five years.
Is there a deadline for PIPEDA breach reports?
No fixed number of days. A breach of security safeguards that creates a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada, and the affected individuals notified, as soon as feasible after the organization determines that the breach occurred. Complyanz shows how long each report has been open instead of a countdown. Every breach, whether or not it meets that threshold, must be recorded and the record kept for 24 months.
Can we transfer personal data from Brazil to Europe?
Yes, an adequacy decision is one of the lawful grounds for an international transfer under LGPD Article 33. ANPD Resolution 32/2026 recognizes the European Union as adequate, covering the EU member states and the EEA countries, except for public security, defense and criminal matters, and it is to be reassessed within four years. For other destinations a common route is the ANPD standard contractual clauses, which existing contracts had to adopt by 23 August 2025. Canada has no LGPD adequacy decision.
Do you cover Québec's Law 25 or Bill C-36?
No. Québec, Alberta and British Columbia have their own private-sector privacy laws, substantially similar to PIPEDA, and Québec's Law 25 has its own regime; this module covers PIPEDA only. Bill C-36, which would enact a new Protecting Privacy and Consumer Data Act, was introduced in June 2026 and is not law. Complyanz models PIPEDA as it stands today.
Build your privacy program
Create an organization, answer the privacy profile and see which LGPD and PIPEDA obligations apply to you, and why.