An online learner registers for a course, submits assignments, checks grades, and joins virtual classes. Each activity generates personal data, which may pass through an institution’s learning management system (LMS) and several third-party tools. Understanding what LGPD is helps education providers assess how that information should be collected, used, and protected.
Brazil’s data protection law can affect student registration, attendance records, assessments, learning analytics, and online classroom tools.
What Does LGPD Require Organizations to Do?
Brazil’s Lei Geral de Proteção de Dados Pessoais (LGPD), established by Law No. 13,709/2018, regulates how organizations process personal data. It establishes individuals’ data rights, requires an appropriate legal basis for processing, and sets obligations for security and accountability. Its requirements can apply to organizations outside Brazil when their activities meet the law’s territorial criteria.
Which Education Providers and Businesses Must Comply With LGPD?
LGPD can apply to organizations operating in Brazil and to certain businesses based abroad. Its scope depends on the circumstances of data processing, not simply on where a company has its headquarters.
The law may apply when:
- Data processing takes place in Brazil.
- An organization offers goods or services to individuals located in Brazil, or processes their personal data for that purpose, under the law’s criteria.
- The personal data being processed was collected in Brazil, subject to the law’s conditions.
For example, a US-based learning platform serving students in Brazil may need to comply with LGPD. Hosting student records on servers in the United States does not automatically exempt the company.
Education providers should review their activities, the data they handle, and the services they offer before deciding whether the law applies.
What Personal Data Does LGPD Protect?
LGPD covers information relating to an identified or identifiable person. In education, this can include:
- Names, email addresses, and account details.
- Enrollment records, attendance, grades, and assessment results.
- Online identifiers and records of platform activity.
- Employment and training records linked to individual learners.
The law also defines sensitive personal data, a category that includes information about racial or ethnic origin, religious beliefs, political opinions, trade union membership, health, and genetic or biometric data linked to an individual. These data categories are subject to specific legal requirements under LGPD.
For example, an LMS that uses facial recognition to record attendance may process sensitive biometric data. Education providers must consider the applicable legal basis, required safeguards, and potential impact on learners, particularly children and adolescents.
What Are the Main LGPD Compliance Requirements?
Education providers need to consider four areas when reviewing their data practices: the legal basis for processing, individuals’ rights, data security, and accountability.
1. Establish a Valid Legal Basis
LGPD recognizes multiple legal bases for processing personal data. Consent is one option, but it is not required for every activity. Depending on the circumstances, another basis may apply, such as complying with a legal obligation or processing data necessary to perform a contract.
Sensitive personal data is subject to a separate set of legal bases under Article 11 of the law.
Consider a platform that collects contact details to manage course enrollment. If it later wants to use those details for an unrelated marketing campaign, it should check whether that new use is permitted and whether additional transparency or safeguards are needed.
2. Respect Learners’ Data Rights
Individuals have rights concerning their personal data, including the right to request confirmation of processing, access their data, correct inaccurate information, and seek anonymization or deletion in circumstances permitted by law.
Education providers need a clear way to handle these requests. If a learner finds an error in their academic record, for instance, the institution should be able to verify the request, correct the information, and update relevant systems.
3. Protect Student Records and Learning Platforms
Organizations must use appropriate technical and administrative measures to protect personal data against unauthorized access, loss, destruction, alteration, and other improper processing.
For education providers, this means restricting access to student records, applying security updates, reviewing connected tools, and establishing clear data-retention practices.
Software vulnerabilities can undermine security controls and expose connected systems to attack. The PHP project’s security advisory for CVE-2026-109618 illustrates why organizations must promptly assess and patch affected server-side software.
A case involving schools in Brazil highlights the challenges of protecting student data. In August 2026, Brazil’s National Data Protection Authority (ANPD) ordered the suspension of facial recognition used to record attendance in public schools in Paraná. According to SC Media’s report on the decision, the regulator raised concerns about the legal basis for processing students’ biometric data and the adequacy of security safeguards. The measure was preventive, not a general ban on facial recognition in schools.
4. Document Decisions and Responsibilities
Organizations should be able to explain what personal data they collect, why they need it, who can access it, and which third parties receive it.
For an institution using an external LMS, this includes understanding how the provider handles learner information and clarifying each party’s responsibilities. Contracts, internal procedures, and actual data practices should reflect those responsibilities.
LGPD vs. GDPR: What Are the Key Differences?
LGPD and the European Union’s General Data Protection Regulation (GDPR) share the goal of protecting personal data, but they have distinct legal requirements and enforcement frameworks. The European Commission’s overview of EU data protection rules explains the GDPR framework.
| Area | LGPD | GDPR |
| Territorial scope | Applies when processing meets Brazil’s legal criteria | Applies when processing meets the GDPR’s territorial criteria |
| Legal bases | Multiple legal bases, with specific rules for sensitive data | Multiple legal bases, with specific rules for special-category data |
| Regulatory authority | Autoridade Nacional de Proteção de Dados (ANPD) | National data protection authorities in EU member states within the GDPR framework |
| Maximum administrative fine | Up to 2% of qualifying Brazilian revenue, excluding taxes, capped at R$50 million per infraction | Up to €20 million or 4% of worldwide annual turnover for certain infringements, whichever is higher |
Beyond fines, LGPD violations can also lead to measures such as warnings, public disclosure of an infraction, blocking or deletion of personal data, and restrictions on processing activities. For education providers, these consequences make data protection an operational priority, not just a legal requirement.
International data transfers also matter when an education provider uses overseas hosting or third-party learning tools. Businesses should identify where learner data goes and determine which transfer requirements apply. The ANPD’s guidance on international data transfers explains the relevant framework.
Organizations handling data connected to both Brazil and the EU should assess each law separately. GDPR compliance does not automatically establish LGPD compliance.
How Can Education Providers Build an LGPD Compliance Program?
Start by tracing how learner information moves through the organization, from registration to course completion and record retention.
- Map the data. Identify what learner information is collected, where it is stored, why it is needed, and which vendors receive it.
- Check the legal basis. Confirm that each processing activity has an appropriate legal basis, paying particular attention to sensitive data and new uses of existing records.
- Review privacy notices. Explain data practices and individual rights in clear language.
- Assess platforms and vendors. Review security controls, contractual responsibilities, data retention, and international transfers.
- Prepare for requests and incidents. Set procedures for data-rights requests, suspected breaches, internal escalation, and regulatory reporting. Under applicable ANPD rules, controllers generally must report qualifying security incidents to the authority and affected individuals within three business days, subject to applicable exceptions. The ANPD’s security incident reporting guidance explains the reporting requirements.
- Review changes. Reassess data practices when introducing new analytics tools, facial recognition, integrations, or additional categories of personal information.
These checks help education providers identify gaps before they lead to data exposure, operational disruption, or regulatory concerns.
Privacy reviews should also consider whether accessible digital education tools handle learner information responsibly while remaining usable for learners with disabilities.
Conclusion
LGPD affects how education providers and learning platforms handle personal information connected to Brazil. From enrollment details and assessment records to biometric attendance systems, each use of learner data requires appropriate consideration of legal grounds, individual rights, and security.
Start by mapping the information your organization collects, checking why it is needed, reviewing who can access it, and identifying the third parties that process it. These steps provide a practical foundation for assessing LGPD obligations and addressing gaps in your data practices.
For practical guidance on learning technology, training, and digital education, explore the resources available from Valasys EdTech.
Frequently Asked Questions (FAQs)
Q1. Does LGPD Apply to US or Other Foreign Businesses Handling Brazilian Customers’ Data?
Yes. LGPD can apply to US and other foreign businesses when their activities meet the law’s territorial criteria. Storing personal data outside Brazil does not automatically exempt a company. Businesses should consider where the data was collected, the services they offer, and how they process the information.
Q2. Does LGPD Apply to Employee and Job Applicant Data?
Yes. Employee and job applicant information can fall within LGPD when the law applies to the processing. Employers should identify an appropriate legal basis, limit access to authorized personnel, and establish suitable retention and security practices.
Q3. Does Every Education Provider Need to Appoint a Data Protection Officer?
Not necessarily. LGPD provides for a person responsible for communication between an organization, individuals, and the ANPD. Applicable regulations may relax or exempt appointment requirements in certain circumstances. Education providers should check which requirements apply to their organization.
Q4. Can an LMS Provider and an Educational Institution Have Different LGPD Responsibilities?
Yes. Their responsibilities depend on their roles in processing personal data and the applicable legal requirements. An institution may decide why learner information is collected, while an LMS provider may process it to deliver its services. Both parties should clarify their responsibilities and reflect them in their contractual and operational arrangements.
Q5. Can Learning Analytics Be Used Under LGPD?
Potentially. Education providers should consider the purpose of the analytics, the personal data involved, the applicable legal basis, and any additional safeguards required. Analytics involving sensitive information, children, or profiling that may significantly affect learners deserves particular scrutiny. Educational value alone does not make every data use permissible.