The General Data Protection Regulation (GDPR) and Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD) are two major privacy frameworks governing the collection, use, storage and sharing of personal data. Both regulations are built around principles such as transparency, purpose limitation, security, accountability and individual rights. However, GDPR and LGPD differ in their legal bases, regulatory structure, data subject rights, breach notification requirements, international data transfers, children's data and enforcement mechanisms. For organisations operating in Europe and Brazil, understanding these differences is essential to building a privacy programme that can satisfy both frameworks without unnecessarily duplicating compliance efforts.
Side-by-side: GDPR vs LGPD
| Dimension | 🇪🇺 GDPR | 🇧🇷 LGPD |
|---|---|---|
| Primary law | Regulation (EU) 2016/679 | Law No. 13,709/2018 |
| Effective date | 25 May 2018 | Main provisions effective from August 2020; administrative sanctions from August 2021 |
| Regulator | EU/EEA supervisory authorities coordinated through EDPB | Autoridade Nacional de Proteção de Dados (ANPD) |
| Regulated entity | Controller | Controller |
| Processor | Processor | Operator |
| Individual | Data Subject | Data Subject / Titular |
| Lawful bases | Six Article 6 bases + Article 9 conditions for special categories | Multiple legal bases under Article 7, plus specific rules for sensitive personal data under Article 11 |
| Legitimate interests | Expressly recognised under Article 6(1)(f) | Recognised as one of LGPD's legal bases under Article 7 |
| DPO | Required in defined circumstances | Encarregado framework applies, subject to LGPD and ANPD rules, including rules for small processing agents |
| Sensitive data | Special categories under Article 9 | Sensitive personal data under Article 5 and Article 11 |
| Children's data | Specific safeguards; Article 8 concerns certain consent-based information society services | Specific protections under Article 14 |
| Right to portability | Yes | Yes |
| Automated decision-making | Specific rights under Article 22 | Right to request review of decisions based solely on automated processing under Article 20 |
| International transfers | Adequacy, SCCs, BCRs and other Chapter V mechanisms | Adequacy decisions, contractual mechanisms and other Article 33 mechanisms under ANPD rules |
| Breach notification | Generally within 72 hours to supervisory authority where required | ANPD and affected individuals generally within 3 business days for qualifying incidents under Resolution No. 15/2024 |
| Maximum administrative fine | Up to €20 million or 4% of worldwide annual turnover for specified infringements | Up to 2% of revenue in Brazil for the preceding fiscal year, capped at R$50 million per infraction |
| Local representative | Article 27 may require an EU representative for certain non-EU organisations | No direct equivalent to GDPR Article 27 |
What Is the GDPR?
The General Data Protection Regulation (GDPR) is the European Union's comprehensive data protection framework.
It regulates the processing of personal data by controllers and processors and establishes requirements covering:
- Lawfulness and fairness
- Transparency
- Purpose limitation
- Data minimisation
- Accuracy
- Storage limitation
- Security
- Accountability
- Individual rights
- International data transfers
The GDPR may also apply to organisations outside the EU when the requirements of its territorial scope are met.
What Is the LGPD?
Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD), established by Law No. 13,709/2018, regulates the processing of personal data by public and private organisations.
The LGPD establishes obligations for:
- Controllers
- Operators
- Data Protection Officers / Encarregados
- Organisations processing personal data
- Organisations processing sensitive personal data
The Autoridade Nacional de Proteção de Dados (ANPD) is Brazil's national data protection authority. The ANPD has issued regulations covering areas including the Encarregado, security-incident notification, international data transfers, sanctions and rules for small processing agents.
GDPR vs LGPD: Key Differences
1. Territorial Scope
GDPR
The GDPR can apply to organisations established inside or outside the EU when the requirements of Article 3 are satisfied.
This can include certain organisations outside the EU that:
- Offer goods or services to individuals in the EU
- Monitor behaviour of individuals in the EU
- Operate through an establishment in the EU
LGPD
The LGPD can apply where:
- Processing is carried out in Brazil
- Processing is intended to offer or provide goods or services to individuals located in Brazil
- Personal data was collected in Brazil
The application of Brazilian data-protection law to international transfers is also addressed in ANPD's international-transfer framework.
Key difference: Both GDPR and LGPD can apply to organisations outside their respective territories, but the statutory tests are not identical.
2. Controller vs Controller
GDPR
The GDPR uses the term Controller for an organisation that determines the purposes and means of processing personal data.
GDPR uses:
- Processor
LGPD
The LGPD similarly defines a Controller (Controlador) as the entity responsible for decisions concerning the processing of personal data.
LGPD uses:
- Operator
The terminology is therefore relatively close, although the rights, obligations and regulatory framework differ. Both processor concepts generally concern entities that process personal data on behalf of another organisation, but contractual and statutory responsibilities should be assessed under the applicable law.
3. Legal Bases for Processing
This is an important area of similarity and difference.
GDPR
GDPR Article 6 provides six principal legal bases:
- Consent
- Contract
- Legal obligation
- Vital interests
- Public task
- Legitimate interests
Additional conditions apply to special-category personal data under Article 9.
LGPD
LGPD Article 7 provides multiple legal bases for ordinary personal data, including:
- Consent
- Compliance with legal or regulatory obligations
- Public administration
- Research
- Contract performance
- Exercise of rights
- Protection of life
- Protection of health
- Legitimate interests
- Credit protection
Additional legal bases apply to sensitive personal data under Article 11.
Key difference: Both frameworks recognise legitimate interests, but their legal structures and detailed requirements differ.
4. Consent
GDPR
Where consent is used as a legal basis, it must be:
- Freely given
- Specific
- Informed
- Unambiguous
Organisations must be able to demonstrate consent and provide an effective mechanism for withdrawal.
LGPD
LGPD also places significant importance on consent.
Consent must be provided under the conditions established by the law and may be revoked by the data subject.
Organisations should maintain evidence showing:
- What was communicated
- What the individual agreed to
- When consent was obtained
- The purpose of processing
- How consent can be withdrawn
Practical takeaway: A common consent-management platform can support both GDPR and LGPD, but the legal basis and notice requirements should still be assessed separately.
5. Legitimate Interests
The two frameworks are more similar here than many comparison pages suggest.
GDPR
Legitimate interests under Article 6(1)(f) can provide a lawful basis where the controller's legitimate interests are not overridden by the interests or fundamental rights and freedoms of the data subject.
Organisations should assess and document the basis appropriately.
LGPD
Legitimate interests are also expressly recognised as a legal basis under Article 7.
The controller must consider the legitimate interests of the controller or third party, while respecting fundamental rights and freedoms and applying the safeguards required by the LGPD.
Key difference: Both frameworks recognise legitimate interests, but the legal tests, documentation expectations and regulatory interpretations are not identical.
6. Data Subject Rights
GDPR
GDPR rights can include:
- Right of access
- Right to rectification
- Right to erasure
- Right to restriction
- Right to data portability
- Right to object
- Right to withdraw consent
- Rights relating to automated decision-making and profiling
LGPD
LGPD provides rights including:
- Confirmation of processing
- Access to personal data
- Correction
- Anonymisation, blocking or deletion of unnecessary or excessive data
- Data portability
- Deletion of personal data processed on the basis of consent, subject to legal exceptions
- Information about public and private entities with which data has been shared
- Information about the possibility of refusing consent
- Withdrawal of consent
- Review of certain automated decisions
Key difference: The rights overlap considerably, but their legal wording, scope and implementation mechanisms differ.
7. Automated Decision-Making
GDPR
Article 22 provides specific protections concerning decisions based solely on automated processing that produce legal effects or similarly significant effects.
Individuals may have rights concerning such decisions, subject to the conditions and exceptions in the GDPR.
LGPD
Article 20 provides individuals with the right to request a review of decisions made solely on the basis of automated processing that affect their interests, including decisions intended to define personal, professional, consumer and credit profiles.
Organisations using AI or automated decision systems should therefore evaluate both frameworks when operating in Brazil and the EU.
8. Sensitive Personal Data
GDPR
The GDPR identifies special categories of personal data, including:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade-union membership
- Genetic data
- Biometric data used for identification
- Health data
- Sex life or sexual orientation
Article 9 establishes enhanced conditions for processing these categories.
LGPD
The LGPD defines sensitive personal data separately. This includes information relating to:
- Racial or ethnic origin
- Religious beliefs
- Political opinions
- Trade-union or religious, philosophical or political organisation membership
- Health
- Sex life
- Genetic data
- Biometric data
Sensitive-data processing is subject to the specific legal bases and safeguards established under LGPD Article 11.
9. Children's Data
GDPR
The GDPR provides specific protections for children.
Article 8 establishes a default age of 16 for certain consent-based information society services, although EU Member States may lower the age to no less than 13.
The GDPR also requires organisations to consider children's specific vulnerabilities and interests.
LGPD
LGPD Article 14 establishes specific requirements for processing children's and adolescents' personal data.
The processing must be carried out in their best interests.
For children's data, the LGPD establishes specific consent requirements involving a parent or legal guardian, subject to the statutory framework.
Important: The LGPD should not be simplified as requiring parental consent only for children "under 12." The statute protects both children and adolescents, and the exact requirements depend on the processing context.
10. Data Protection Officer / Encarregado
GDPR
A Data Protection Officer is mandatory only in circumstances specified by GDPR Article 37. These include certain:
- Large-scale monitoring activities
- Large-scale processing of special categories of data
- Public-authority processing activities
LGPD
The LGPD establishes the role of the Encarregado pelo tratamento de dados pessoais.
The Encarregado serves as an important communication channel between:
- Data subjects
- The organisation
- ANPD
ANPD Resolution No. 18/2024 provides additional rules concerning the appointment, responsibilities and operation of the Encarregado.
Rules for small processing agents also provide specific simplifications and exemptions, meaning it is inaccurate to state that every LGPD-covered controller has exactly the same DPO requirement.
11. Local Representative
GDPR
Certain organisations outside the EU may be required to appoint an EU Representative under Article 27.
The representative can act as a contact point for individuals and supervisory authorities.
LGPD
The LGPD does not create a direct equivalent of GDPR Article 27.
International organisations may nevertheless require appropriate Brazilian privacy governance, regulatory-contact arrangements and an Encarregado where applicable.
Important: A commercial "Brazil representative" service should not be described as a statutory equivalent of the GDPR Article 27 representative.
12. Breach Notification
GDPR
Under Article 33, a controller generally must notify the competent supervisory authority of a qualifying personal-data breach without undue delay and, where feasible, within 72 hours after becoming aware of it.
Where the breach is likely to result in a high risk to individuals, affected data subjects may also need to be notified.
LGPD
ANPD Resolution No. 15/2024 establishes the rules for communicating qualifying security incidents.
Where a security incident may cause relevant risk or damage to data subjects, the controller must notify ANPD and affected data subjects within three business days, subject to the applicable rules and exceptions.
Small processing agents may benefit from differentiated deadlines under ANPD's small-agent framework.
Key difference: GDPR uses a 72-hour supervisory-authority framework, while LGPD uses a three-business-day framework under ANPD Resolution No. 15/2024 for qualifying incidents.
13. International Data Transfers
This area has evolved significantly under the LGPD.
GDPR
GDPR Chapter V provides mechanisms including:
- Adequacy decisions
- Standard Contractual Clauses
- Binding Corporate Rules
- Specific derogations
Organisations may also need supplementary safeguards and transfer-risk assessments depending on the transfer mechanism.
LGPD
ANPD Resolution No. 19/2024 establishes the Brazilian framework for international data transfers. Mechanisms can include:
- ANPD adequacy decisions
- Standard contractual clauses
- Specific contractual clauses
- Global corporate rules
- Other mechanisms provided by Article 33 of the LGPD
The regulation also establishes requirements concerning the purposes, safeguards and documentation of international transfers.
Key difference: LGPD now has a formal international-transfer framework administered by ANPD, rather than simply relying on a general contractual approach.
14. Data Portability
GDPR
GDPR Article 20 provides a right to data portability in specified circumstances.
This generally involves receiving certain personal data in a structured, commonly used and machine-readable format and, where technically feasible, transmitting it to another controller.
LGPD
LGPD Article 18 also recognises a right to data portability, subject to the applicable regulatory framework and requirements.
Key correction: It is inaccurate to state that LGPD has no portability right.
15. Anonymisation
GDPR
Information that is genuinely anonymous and cannot reasonably be linked to an identifiable person falls outside the GDPR's definition of personal data.
LGPD
The LGPD also distinguishes anonymised data from personal data, while establishing its own criteria and treatment of anonymisation.
Organisations should therefore document the anonymisation methodology and assess whether data can reasonably be re-associated with an individual.
16. Data Protection Impact Assessments
GDPR
A Data Protection Impact Assessment (DPIA) is required when processing is likely to result in a high risk to individuals' rights and freedoms. Typical examples can include:
- Large-scale monitoring
- Large-scale processing of sensitive data
- Certain AI or profiling activities
- Systematic evaluation of individuals
LGPD
The LGPD provides for a Relatório de Impacto à Proteção de Dados Pessoais (RIPD).
ANPD may require controllers to prepare and provide an RIPD in circumstances established by the applicable regulatory framework.
Organisations operating in both jurisdictions should therefore avoid assuming that one DPIA/RIPD automatically satisfies both regimes.
17. Penalties
GDPR
For specified serious infringements, GDPR administrative fines can reach €20 million or 4% of worldwide annual turnover of the preceding financial year, whichever is higher.
LGPD
LGPD administrative sanctions can include:
- Warning
- Fine of up to 2% of revenue in Brazil for the preceding fiscal year
- Fine capped at R$50 million per infraction
- Daily fines, subject to statutory limits
- Public disclosure of the infraction
- Blocking of personal data
- Deletion of personal data
- Partial suspension of the database
- Suspension of processing activities
- Partial or total prohibition of activities related to processing
The applicable sanction depends on the nature and circumstances of the violation.
Key difference: GDPR's headline fine is based on global annual turnover, while LGPD's principal administrative fine is linked to revenue in Brazil and subject to a statutory monetary cap.
GDPR vs LGPD: Which Is More Strict?
It is difficult to identify one framework as universally stricter.
The GDPR is particularly detailed in areas such as:
- Six legal bases
- Special-category data
- Data portability
- Automated decision-making
- International transfers
- Controller/processor accountability
- EU Representative requirements
LGPD has strong requirements around:
- Data subject rights
- Consent
- Sensitive personal data
- Children's data
- Encarregado governance
- International transfers
- Security
- Accountability
The correct approach for international businesses is therefore to identify the common controls and then implement jurisdiction-specific requirements.
Can GDPR Compliance Help With LGPD Compliance?
Yes.
An established GDPR programme can provide a strong foundation for LGPD compliance because both frameworks include requirements around:
- Data inventories
- Privacy notices
- Consent
- Individual rights
- Security
- Vendor management
- International transfers
- Incident response
- Accountability
However, GDPR compliance does not automatically mean LGPD compliance. Brazil-specific controls should be assessed, particularly around:
- LGPD legal bases
- Encarregado requirements
- ANPD regulatory requirements
- Brazilian data-subject rights
- Incident notification
- International transfer mechanisms
- LGPD sanctions
- Brazilian privacy notices and governance
Building One GDPR & LGPD Compliance Programme
Organisations operating in both jurisdictions can reduce duplication by establishing a common privacy-management framework.
1. Data Mapping
Map:
- Personal data
- Processing purposes
- Data subjects
- Controllers
- Processors/operators
- Recipients
- Storage locations
- Retention periods
- International transfers
2. Legal-Basis Management
Create a jurisdiction-specific legal-basis matrix covering:
- GDPR Article 6
- GDPR Article 9
- LGPD Article 7
- LGPD Article 11
3. Privacy Rights Management
Create a unified workflow for:
- GDPR Data Subject Requests
- LGPD data-subject requests
- Identity verification
- Request tracking
- Response deadlines
- Evidence and audit trails
4. Consent Management
Manage:
- Consent collection
- Consent records
- Withdrawal
- Cookie preferences
- Marketing preferences
- Children's consent where applicable
5. Vendor Management
Assess:
- GDPR processors
- LGPD operators
- Sub-processors
- Cloud providers
- Analytics providers
- Advertising platforms
- International vendors
6. Breach Response
Maintain a unified incident-response process with jurisdiction-specific escalation paths.
The workflow should identify:
- Applicable jurisdiction
- Risk level
- Notification threshold
- Regulatory deadline
- Individual notification requirements
- Evidence requirements
7. International Transfer Management
Maintain a transfer inventory covering:
- Data exporter
- Data importer
- Destination country
- Transfer mechanism
- Contractual safeguards
- Security measures
- Transfer assessments
Frequently asked questions
Is LGPD the Brazilian version of GDPR?
Not exactly. LGPD was influenced by global data-protection principles and shares many concepts with GDPR, but it is an independent Brazilian law with its own legal bases, rights, regulatory framework and enforcement mechanisms.
If we comply with GDPR, are we automatically LGPD compliant?
No. GDPR compliance provides a strong foundation, but organisations must assess LGPD-specific requirements and ANPD regulations.
Does LGPD have six legal bases like GDPR?
No. LGPD provides a broader list of legal bases under Article 7, with separate rules for sensitive personal data under Article 11.
Does LGPD recognise legitimate interests?
Yes. Legitimate interests are one of the legal bases under LGPD Article 7. However, the requirements are not identical to GDPR Article 6(1)(f).
Does LGPD require a DPO?
LGPD establishes the Encarregado role, with detailed requirements under ANPD Resolution No. 18/2024. The exact obligations can vary depending on the organisation and applicable ANPD rules, including rules for small processing agents.
Does LGPD have a 72-hour breach notification rule?
No. LGPD's qualifying security-incident notification framework uses a three-business-day deadline under ANPD Resolution No. 15/2024, rather than GDPR's 72-hour rule.
Does LGPD require a Brazil representative?
There is no direct equivalent to the GDPR Article 27 EU Representative requirement. Organisations should instead assess their Encarregado, governance and regulatory-contact requirements.
Does LGPD have a right to data portability?
Yes. LGPD Article 18 includes data portability among the rights of data subjects, subject to the applicable regulatory framework.
Does LGPD regulate international data transfers?
Yes. ANPD Resolution No. 19/2024 establishes a detailed regulatory framework for international transfers, including adequacy decisions and contractual mechanisms.
Which companies should consider a GDPR and LGPD compliance assessment?
A combined assessment is particularly relevant for SaaS companies, technology businesses, e-commerce companies, global retailers, AI companies, advertising and marketing platforms, healthcare organisations, financial technology companies, cloud service providers, and organisations processing EU and Brazilian customer data.
GDPR & LGPD Compliance with RegulatoryBridge
Managing GDPR and LGPD through completely separate processes can create unnecessary duplication and inconsistent privacy controls.
RegulatoryBridge helps organisations build coordinated privacy compliance programmes across Europe, Brazil and other global jurisdictions.
Our support can include:
- GDPR compliance assessments
- LGPD compliance assessments
- Data mapping and inventory
- Privacy notice reviews
- Legal-basis assessments
- Consent management
- Data-subject rights workflows
- Encarregado support
- Vendor and processor/operator assessments
- International transfer assessments
- DPIA and RIPD support
- Security and breach-response planning
- Regulatory monitoring
- Cross-border privacy representation
- Ongoing privacy compliance management
Cover GDPR and LGPD under one programme.
Map controls once, comply twice. RegulatoryBridge gives you a single DSAR pipeline, single DPO, single breach runbook - covering both frameworks.