Loading…
The General Data Protection Regulation (GDPR) and Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD) are two major privacy frameworks governing the collection, use, storage and sharing of personal data. Both regulations are built around principles such as transparency, purpose limitation, security, accountability and individual rights. However, GDPR and LGPD differ in their legal bases, regulatory structure, data subject rights, breach notification requirements, international data transfers, children's data and enforcement mechanisms. For organisations operating in Europe and Brazil, understanding these differences is essential to building a privacy programme that can satisfy both frameworks without unnecessarily duplicating compliance efforts.
| Параметр | 🇪🇺 GDPR | 🇧🇷 LGPD |
|---|---|---|
| Primary law | Regulation (EU) 2016/679 | Law No. 13,709/2018 |
| Effective date | 25 May 2018 | Main provisions effective from August 2020; administrative sanctions from August 2021 |
| Regulator | EU/EEA supervisory authorities coordinated through EDPB | Autoridade Nacional de Proteção de Dados (ANPD) |
| Regulated entity | Controller | Controller |
| Processor | Processor | Operator |
| Individual | Data Subject | Data Subject / Titular |
| Lawful bases | Six Article 6 bases + Article 9 conditions for special categories | Multiple legal bases under Article 7, plus specific rules for sensitive personal data under Article 11 |
| Legitimate interests | Expressly recognised under Article 6(1)(f) | Recognised as one of LGPD's legal bases under Article 7 |
| DPO | Required in defined circumstances | Encarregado framework applies, subject to LGPD and ANPD rules, including rules for small processing agents |
| Sensitive data | Special categories under Article 9 | Sensitive personal data under Article 5 and Article 11 |
| Children's data | Specific safeguards; Article 8 concerns certain consent-based information society services | Specific protections under Article 14 |
| Right to portability | Yes | Yes |
| Automated decision-making | Specific rights under Article 22 | Right to request review of decisions based solely on automated processing under Article 20 |
| International transfers | Adequacy, SCCs, BCRs and other Chapter V mechanisms | Adequacy decisions, contractual mechanisms and other Article 33 mechanisms under ANPD rules |
| Breach notification | Generally within 72 hours to supervisory authority where required | ANPD and affected individuals generally within 3 business days for qualifying incidents under Resolution No. 15/2024 |
| Maximum administrative fine | Up to €20 million or 4% of worldwide annual turnover for specified infringements | Up to 2% of revenue in Brazil for the preceding fiscal year, capped at R$50 million per infraction |
| Local representative | Article 27 may require an EU representative for certain non-EU organisations | No direct equivalent to GDPR Article 27 |
The General Data Protection Regulation (GDPR) is the European Union's comprehensive data protection framework.
It regulates the processing of personal data by controllers and processors and establishes requirements covering:
The GDPR may also apply to organisations outside the EU when the requirements of its territorial scope are met.
Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD), established by Law No. 13,709/2018, regulates the processing of personal data by public and private organisations.
The LGPD establishes obligations for:
The Autoridade Nacional de Proteção de Dados (ANPD) is Brazil's national data protection authority. The ANPD has issued regulations covering areas including the Encarregado, security-incident notification, international data transfers, sanctions and rules for small processing agents.
GDPR
The GDPR can apply to organisations established inside or outside the EU when the requirements of Article 3 are satisfied.
This can include certain organisations outside the EU that:
LGPD
The LGPD can apply where:
The application of Brazilian data-protection law to international transfers is also addressed in ANPD's international-transfer framework.
Key difference: Both GDPR and LGPD can apply to organisations outside their respective territories, but the statutory tests are not identical.
GDPR
The GDPR uses the term Controller for an organisation that determines the purposes and means of processing personal data.
GDPR uses:
LGPD
The LGPD similarly defines a Controller (Controlador) as the entity responsible for decisions concerning the processing of personal data.
LGPD uses:
The terminology is therefore relatively close, although the rights, obligations and regulatory framework differ. Both processor concepts generally concern entities that process personal data on behalf of another organisation, but contractual and statutory responsibilities should be assessed under the applicable law.
This is an important area of similarity and difference.
GDPR
GDPR Article 6 provides six principal legal bases:
Additional conditions apply to special-category personal data under Article 9.
LGPD
LGPD Article 7 provides multiple legal bases for ordinary personal data, including:
Additional legal bases apply to sensitive personal data under Article 11.
Key difference: Both frameworks recognise legitimate interests, but their legal structures and detailed requirements differ.
GDPR
Where consent is used as a legal basis, it must be:
Organisations must be able to demonstrate consent and provide an effective mechanism for withdrawal.
LGPD
LGPD also places significant importance on consent.
Consent must be provided under the conditions established by the law and may be revoked by the data subject.
Organisations should maintain evidence showing:
Practical takeaway: A common consent-management platform can support both GDPR and LGPD, but the legal basis and notice requirements should still be assessed separately.
The two frameworks are more similar here than many comparison pages suggest.
GDPR
Legitimate interests under Article 6(1)(f) can provide a lawful basis where the controller's legitimate interests are not overridden by the interests or fundamental rights and freedoms of the data subject.
Organisations should assess and document the basis appropriately.
LGPD
Legitimate interests are also expressly recognised as a legal basis under Article 7.
The controller must consider the legitimate interests of the controller or third party, while respecting fundamental rights and freedoms and applying the safeguards required by the LGPD.
Key difference: Both frameworks recognise legitimate interests, but the legal tests, documentation expectations and regulatory interpretations are not identical.
GDPR
GDPR rights can include:
LGPD
LGPD provides rights including:
Key difference: The rights overlap considerably, but their legal wording, scope and implementation mechanisms differ.
GDPR
Article 22 provides specific protections concerning decisions based solely on automated processing that produce legal effects or similarly significant effects.
Individuals may have rights concerning such decisions, subject to the conditions and exceptions in the GDPR.
LGPD
Article 20 provides individuals with the right to request a review of decisions made solely on the basis of automated processing that affect their interests, including decisions intended to define personal, professional, consumer and credit profiles.
Organisations using AI or automated decision systems should therefore evaluate both frameworks when operating in Brazil and the EU.
GDPR
The GDPR identifies special categories of personal data, including:
Article 9 establishes enhanced conditions for processing these categories.
LGPD
The LGPD defines sensitive personal data separately. This includes information relating to:
Sensitive-data processing is subject to the specific legal bases and safeguards established under LGPD Article 11.
GDPR
The GDPR provides specific protections for children.
Article 8 establishes a default age of 16 for certain consent-based information society services, although EU Member States may lower the age to no less than 13.
The GDPR also requires organisations to consider children's specific vulnerabilities and interests.
LGPD
LGPD Article 14 establishes specific requirements for processing children's and adolescents' personal data.
The processing must be carried out in their best interests.
For children's data, the LGPD establishes specific consent requirements involving a parent or legal guardian, subject to the statutory framework.
Important: The LGPD should not be simplified as requiring parental consent only for children "under 12." The statute protects both children and adolescents, and the exact requirements depend on the processing context.
GDPR
A Data Protection Officer is mandatory only in circumstances specified by GDPR Article 37. These include certain:
LGPD
The LGPD establishes the role of the Encarregado pelo tratamento de dados pessoais.
The Encarregado serves as an important communication channel between:
ANPD Resolution No. 18/2024 provides additional rules concerning the appointment, responsibilities and operation of the Encarregado.
Rules for small processing agents also provide specific simplifications and exemptions, meaning it is inaccurate to state that every LGPD-covered controller has exactly the same DPO requirement.
GDPR
Certain organisations outside the EU may be required to appoint an EU Representative under Article 27.
The representative can act as a contact point for individuals and supervisory authorities.
LGPD
The LGPD does not create a direct equivalent of GDPR Article 27.
International organisations may nevertheless require appropriate Brazilian privacy governance, regulatory-contact arrangements and an Encarregado where applicable.
Important: A commercial "Brazil representative" service should not be described as a statutory equivalent of the GDPR Article 27 representative.
GDPR
Under Article 33, a controller generally must notify the competent supervisory authority of a qualifying personal-data breach without undue delay and, where feasible, within 72 hours after becoming aware of it.
Where the breach is likely to result in a high risk to individuals, affected data subjects may also need to be notified.
LGPD
ANPD Resolution No. 15/2024 establishes the rules for communicating qualifying security incidents.
Where a security incident may cause relevant risk or damage to data subjects, the controller must notify ANPD and affected data subjects within three business days, subject to the applicable rules and exceptions.
Small processing agents may benefit from differentiated deadlines under ANPD's small-agent framework.
Key difference: GDPR uses a 72-hour supervisory-authority framework, while LGPD uses a three-business-day framework under ANPD Resolution No. 15/2024 for qualifying incidents.
This area has evolved significantly under the LGPD.
GDPR
GDPR Chapter V provides mechanisms including:
Organisations may also need supplementary safeguards and transfer-risk assessments depending on the transfer mechanism.
LGPD
ANPD Resolution No. 19/2024 establishes the Brazilian framework for international data transfers. Mechanisms can include:
The regulation also establishes requirements concerning the purposes, safeguards and documentation of international transfers.
Key difference: LGPD now has a formal international-transfer framework administered by ANPD, rather than simply relying on a general contractual approach.
GDPR
GDPR Article 20 provides a right to data portability in specified circumstances.
This generally involves receiving certain personal data in a structured, commonly used and machine-readable format and, where technically feasible, transmitting it to another controller.
LGPD
LGPD Article 18 also recognises a right to data portability, subject to the applicable regulatory framework and requirements.
Key correction: It is inaccurate to state that LGPD has no portability right.
GDPR
Information that is genuinely anonymous and cannot reasonably be linked to an identifiable person falls outside the GDPR's definition of personal data.
LGPD
The LGPD also distinguishes anonymised data from personal data, while establishing its own criteria and treatment of anonymisation.
Organisations should therefore document the anonymisation methodology and assess whether data can reasonably be re-associated with an individual.
GDPR
A Data Protection Impact Assessment (DPIA) is required when processing is likely to result in a high risk to individuals' rights and freedoms. Typical examples can include:
LGPD
The LGPD provides for a Relatório de Impacto à Proteção de Dados Pessoais (RIPD).
ANPD may require controllers to prepare and provide an RIPD in circumstances established by the applicable regulatory framework.
Organisations operating in both jurisdictions should therefore avoid assuming that one DPIA/RIPD automatically satisfies both regimes.
GDPR
For specified serious infringements, GDPR administrative fines can reach €20 million or 4% of worldwide annual turnover of the preceding financial year, whichever is higher.
LGPD
LGPD administrative sanctions can include:
The applicable sanction depends on the nature and circumstances of the violation.
Key difference: GDPR's headline fine is based on global annual turnover, while LGPD's principal administrative fine is linked to revenue in Brazil and subject to a statutory monetary cap.
It is difficult to identify one framework as universally stricter.
The GDPR is particularly detailed in areas such as:
LGPD has strong requirements around:
The correct approach for international businesses is therefore to identify the common controls and then implement jurisdiction-specific requirements.
Yes.
An established GDPR programme can provide a strong foundation for LGPD compliance because both frameworks include requirements around:
However, GDPR compliance does not automatically mean LGPD compliance. Brazil-specific controls should be assessed, particularly around:
Organisations operating in both jurisdictions can reduce duplication by establishing a common privacy-management framework.
Map:
Create a jurisdiction-specific legal-basis matrix covering:
Create a unified workflow for:
Manage:
Assess:
Maintain a unified incident-response process with jurisdiction-specific escalation paths.
The workflow should identify:
Maintain a transfer inventory covering:
Not exactly. LGPD was influenced by global data-protection principles and shares many concepts with GDPR, but it is an independent Brazilian law with its own legal bases, rights, regulatory framework and enforcement mechanisms.
No. GDPR compliance provides a strong foundation, but organisations must assess LGPD-specific requirements and ANPD regulations.
No. LGPD provides a broader list of legal bases under Article 7, with separate rules for sensitive personal data under Article 11.
Yes. Legitimate interests are one of the legal bases under LGPD Article 7. However, the requirements are not identical to GDPR Article 6(1)(f).
LGPD establishes the Encarregado role, with detailed requirements under ANPD Resolution No. 18/2024. The exact obligations can vary depending on the organisation and applicable ANPD rules, including rules for small processing agents.
No. LGPD's qualifying security-incident notification framework uses a three-business-day deadline under ANPD Resolution No. 15/2024, rather than GDPR's 72-hour rule.
There is no direct equivalent to the GDPR Article 27 EU Representative requirement. Organisations should instead assess their Encarregado, governance and regulatory-contact requirements.
Yes. LGPD Article 18 includes data portability among the rights of data subjects, subject to the applicable regulatory framework.
Yes. ANPD Resolution No. 19/2024 establishes a detailed regulatory framework for international transfers, including adequacy decisions and contractual mechanisms.
A combined assessment is particularly relevant for SaaS companies, technology businesses, e-commerce companies, global retailers, AI companies, advertising and marketing platforms, healthcare organisations, financial technology companies, cloud service providers, and organisations processing EU and Brazilian customer data.
Managing GDPR and LGPD through completely separate processes can create unnecessary duplication and inconsistent privacy controls.
RegulatoryBridge helps organisations build coordinated privacy compliance programmes across Europe, Brazil and other global jurisdictions.
Our support can include:
Сопоставьте средства контроля один раз, соответствуйте дважды. RegulatoryBridge предоставляет вам единый конвейер DSAR, единого DPO, единый план реагирования на нарушения - охватывающий обе системы.