03 / Compliance Landscape
Three overlapping legal frameworks govern every background check
LGPD, CLT labour law, and constitutional privacy rights. Brazil is one of the few countries where screening sits at the intersection of all three simultaneously.
LGPD + CLT + Constitution: the triple compliance layer
Fines up to 50 million BRL or 2% of annual revenue. ANPD enforcement is active.
What's happening
LGPD (Lei 13.709/2018) requires explicit, purpose-limited consent for all personal data processing. CLT (labour code) ties worker privacy and dignity to employment relationships. Article 5, X of the Constitution guarantees inviolability of privacy. All three apply to BGV simultaneously.
Why it matters
ANPD has moved from guidance-only to active enforcement. Fines, compliance orders, and public warnings have increased substantially since 2024. Consent must be explicit, granular, and purpose-limited. Blanket consent forms are non-compliant.
Where it breaks
Screening that violates worker dignity can result in labour court sanctions under CLT. Courts have used constitutional provisions to restrict employer screening scope. Blanket criminal screening of all candidates is prohibited.
Reality insight
Candidates retain full data subject rights throughout the screening process: access, correction, deletion, portability. Consent withdrawal must not be used as grounds for adverse hiring decisions. Each verification type should be separately specified in consent.
3
Overlapping legal frameworks
LGPD + CLT + Constitution
50M BRL
Maximum LGPD fine
Or 2% of annual revenue
Full
Data subject rights
Access, correction, deletion, portability
Criminal check role restrictions
- Positions of trust (cargo de confianca): roles with fiduciary responsibility, access to confidential information, or authority to act on behalf of the employer.
- Childcare and education roles: positions involving direct contact with minors.
- Finance and banking: roles with access to financial systems, cash handling, or client funds.
- Security positions: roles involving physical security, access control, or sensitive facility management.
Prohibited practice
Screening all candidates for criminal records as a default policy is prohibited. Employers and BGV vendors who conduct criminal checks on roles outside the permitted categories risk labour court claims for discriminatory hiring practices. The burden is on the employer to demonstrate that the role justifies a criminal check.
Restricted
Criminal check scope
Only for positions of trust, childcare, finance, security
2
Separate processes
Federal (PF) and state (SSP) checks
27
Jurisdictions
26 states + federal district
Procurement implication
Consent must state exactly what data is collected, why, and who receives it. Each verification type (criminal, employment, education, credit) should be separately specified. Cross-border data transfers require explicit consent or transfer to countries with "adequate" protection as recognised by ANPD.
Decision trigger
Does your vendor's consent framework specify each verification type separately? Can they produce documented LGPD compliance, consent capture audit trails, and breach notification SLAs on demand?
05 / Decision Impact
Three scenarios. Three different risk exposures.
Your operating context determines your verification risk. Each scenario maps to a distinct failure mode in the Brazilian market.
Nearshore Scale-Up
100+ hires/month across multiple Brazilian states. Multi-state candidates require parallel criminal searches. eSocial gaps compound when candidates transition between formal and informal employment.
Risk: Criminal search scope narrows under volume pressure, creating jurisdictional blind spots.
High exposure
Market Entry into Brazil
First nearshore engagement. No baseline for the triple compliance layer (LGPD + CLT + Constitution). Criminal check restrictions on role categories not understood.
Risk: Verification programme designed without understanding which checks are legally permitted for which roles.
High exposure
LGPD Audit Exposure
ANPD enforcement action, client audit, or SOC 2 review requires evidence of LGPD-compliant consent capture, data residency documentation, and breach notification SLAs.
Risk: Vendor cannot produce granular consent records, cross-border transfer safeguards, or DPIA documentation.
Medium-high exposure
Decision trigger
The right question is not "which vendor is cheapest." It is: which criminal jurisdictions does each check cover, and can the vendor prove LGPD compliance under audit?
Executive Intelligence Summary
Brazil: 7 conclusions for decision-makers
Criminal records are fragmented across 27 jurisdictions. No single "complete clearance" lookup exists. Programmes must coordinate parallel requests to Policia Federal and relevant state SSP authorities. Searching only the state of residence creates false-negative risk.
eSocial + FGTS Digital gives Brazil one of the strongest formal employment record systems in the world. Pre-start registration is mandatory. Employment dates are highly reliable. The gap is informal employment, contract work, and MEI self-employment, which remain invisible.
Three overlapping legal frameworks govern every background check. LGPD, CLT labour law, and constitutional privacy rights apply simultaneously. Blanket criminal screening of all candidates is prohibited. Only specific role categories qualify.
ANPD enforcement is active, not theoretical. Fines up to 50 million BRL or 2% of annual revenue. Consent must be explicit, granular, and purpose-limited. Each verification type should be separately specified.
Education verification resolves through three tiers with dramatically different timelines. 26% via e-MEC portal (1-3 days), 36% via direct registrar contact (5-12 days), 38% via MEC accreditation review (7-14 days). Accreditation timeline validation is essential: institutions frequently lose accreditation after graduation.
Standard full-pack TAT is 8-11 days metro, 11-18 days multi-state. Any vendor promising sub-5-day completion is skipping jurisdictions or verification layers. Federal vs state criminal fragmentation alone adds 3-5 days.
Vendor evaluation should test for jurisdictional coverage, not presentation quality. Ask for criminal jurisdiction lists, eSocial access documentation, e-MEC accreditation timeline validation, LGPD consent audit trails, and cross-border data transfer safeguards.
Country benchmark
Brazil Verification Benchmark Pack
Market-specific constraints, institutional access data, typical timelines, and source verification pathways. PDF format, designed for internal circulation.
Request benchmark
Delivery in this market
Verification in this jurisdiction is executed by a regional cell with direct institutional access, operating under our central programme office. Cases run in parallel with other active markets. Evidence standards, quality gates, and escalation protocols are identical regardless of geography. Surge capacity is pre-built, not assembled on demand.
About this brief. Reflects the regulatory and operational landscape as of May 2026. LGPD remains the baseline; ANPD has been issuing expanded guidance on consent, DPIA, and sectoral applications. Institution counts sourced to e-MEC. Employment and criminal record data sourced to government publications. TAT ranges and red flag detection rates are first-party data from OutsourceVerify Brazil programmes, presented as observed ranges.
References
- Lei Geral de Protecao de Dados Pessoais (Lei 13.709/2018). Brazil's data protection statute. gov.br/LGPD
- ANPD (Agencia Nacional de Protecao de Dados). Data protection authority. gov.br/ANPD
- eSocial (Sistema de Escrituracao Digital das Obrigacoes Fiscais, Previdenciarias e Trabalhistas). Federal employment registry. gov.br/esocial
- e-MEC (Sistema de Regulacao, Supervisao e Avaliacao). Higher education database. emec.mec.gov.br
- CAPES (Coordenacao de Aperfeicoamento de Pessoal de Nivel Superior). Post-graduate education accreditation. gov.br/CAPES
- Policia Federal, Certidao de Antecedentes Criminais. Federal criminal records. pf.gov.br
- Secretarias de Seguranca Publica (SSP). State-level criminal records. Varies by state. state SSP websites
- Serasa Experian, SPC Brasil, Boa Vista. Consumer credit bureaus regulated by Banco Central. serasaexperian.com.br
- CPF (Cadastro de Pessoas Fisicas). Federal tax ID system administered by Receita Federal. receita federal.gov.br
- RG (Registro Geral). State-issued photo ID; unified ID system phasing out RG in some states. state SSP
- DENATRAN / CNH (Carteira Nacional de Habilitacao). Driver licence system. denatran.gov.br
- Carteira de Trabalho Digital (CTPS). Digital worker record linked to eSocial. gov.br/trabalho
- INSS (Instituto Nacional do Seguro Social). Social security administration. gov.br/INSS
- MEC (Ministerio da Educacao). Education regulator. gov.br/MEC
- ANPD enforcement actions and compliance guidance. Enforcement reports and regulatory guidance. gov.br/anpd/noticias
- CLT (Consolidacao das Leis do Trabalho). Brazil's labour code, particularly provisions on worker dignity and privacy. planalto.gov.br/CLT
- Constituicao Federal, Article 5, X. Constitutional guarantee of privacy, private life, honour, and image. planalto.gov.br/constituicao
- FGTS Digital. Centralised platform for FGTS contributions and employment data. gov.br/esocial/fgts-digital
- CTPS Digital (Carteira de Trabalho e Previdencia Social Digital). Digital work card auto-populated from eSocial. gov.br/trabalho/ctps-digital
- TST (Tribunal Superior do Trabalho) jurisprudence on criminal checks. Labour court precedent restricting criminal checks to specific role categories. tst.jus.br