71%
of Brazil's 21 requirements are already met by European Union (GDPR). Here is what LGPD adds, biggest gaps first.
Alcance extraterritorialAlcance y base jurídicaGap
GDPR2 Applies to non-EU controllers offering goods or services to, or monitoring the behavior of, people in the EU.
LGPD adds3 Applies regardless of location if processing occurs in Brazil, targets goods or services to people in Brazil, or data was collected in Brazil.
Art. 3 · source ↗
NiñosAlcance y base jurídicaGap
GDPR2 Parental consent required for information society services offered to children under 16; Member States may lower the age to no less than 13.
LGPD adds3 Under 12 needs specific parental consent; all minors under 18 must be processed in their best interest.
Art. 14 · source ↗
Plazo de solicitudesDerechos de las personasGap
GDPR2 Respond within one month, extendable by two further months for complex or numerous requests.
LGPD adds3 Full access response within 15 days of the request; simplified confirmation immediately.
Art. 19(II) · source ↗
DPO obligatorioGobernanzaGap
GDPR1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
LGPD adds2 Controllers must appoint an encarregado; ANPD may exempt small processing agents.
Art. 41; Res. CD/ANPD 18/2024 · source ↗
ConservaciónGobernanzaGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
LGPD adds2 Data must be deleted when processing ends, with listed exceptions such as legal obligations or research.
Art. 15, Art. 16 · source ↗
Informar a las personasViolaciones de datosGap
GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.
LGPD adds3 Notify affected data subjects within 3 business days when the incident may cause relevant risk or harm.
Art. 48; Res. CD/ANPD 15/2024 · source ↗
Already covered by GDPR: Lawful basis, Consent, Sensitive data, Rights, Marketing, DPO qualifications, Registration, DPIA, Records, Tell the regulator, Transfers abroad, Localization, Maximum fine, Criminal liability, Private action.
A gap means LGPD is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
