LGPD vs GDPR: 15 Differences Global Companies Need to Know in 2026

Article 3 can apply when processing occurs in Brazil, when the processing is aimed at offering/providing goods or services or processing data of individuals located in Brazil, or when personal data was collected in Brazil.

Article 3 applies to processing in the context of an EU establishment and can also reach non-EU organizations offering goods/services to people in the EU or monitoring their behavior there.

Article 7 lists ten bases, including consent, legal/regulatory obligation, public policy, research, contract, exercise of rights, protection of life, health protection, legitimate interest, and credit protection.

Article 6(1) lists six: consent, contract, legal obligation, vital interests, public task/official authority, and legitimate interests.

Article 5 defines “sensitive personal data,” and Article 11 sets the permitted situations for processing it. The list and statutory structure are Brazil-specific.

Article 9 begins from a prohibition on processing “special categories of personal data” and then provides exceptions. Criminal-conviction/offence data is addressed separately in Article 10.

Article 14 requires processing of children's and adolescents' data in their best interest. For children's personal data, the statute provides for specific and prominent consent from at least one parent or legal guardian, subject to the article's rules and exceptions.

Article 8 addresses consent for information-society services offered directly to a child. The default age is 16, but Member States may lower it to no less than 13.

Article 41 says the controller must appoint an encarregado and publish identity/contact information. ANPD rules define the role and provide exemptions, including for qualifying small processing agents.

Article 37 makes a DPO mandatory in specified situations, including certain public bodies, large-scale regular/systematic monitoring, and large-scale special-category/criminal-data processing.

Article 37 requires controllers and operators to maintain records of processing operations, especially when based on legitimate interest. ANPD allows qualifying small agents to use a simplified format.

Article 30 specifies the content of controller and processor records in detail and includes a conditional exemption for organizations with fewer than 250 employees.

Article 38 authorizes the ANPD to require a Data Protection Impact Report (RIPD), and the LGPD defines what such a report contains. ANPD guidance recommends impact assessment in risk-oriented contexts.

Article 35 directly requires a DPIA before processing that is likely to result in high risk and identifies examples such as certain systematic evaluation, large-scale special-category processing, and large-scale monitoring of public areas.

For confirmation of processing or access, Article 19 provides either a simplified response immediately or a clear and complete statement within up to 15 days. Other rights can be subject to applicable regulation.

Article 12 generally requires action on requests under Articles 15–22 within one month, with a possible two-month extension when necessary because of complexity or number of requests.

Article 18 gives a right to portability to another service or product provider, subject to ANPD regulation and commercial/industrial secrecy; anonymized data is excluded.

Article 20 links portability to processing based on consent or contract and carried out by automated means, and provides for a structured, commonly used, machine-readable format.

Article 20 gives the data subject the right to request review of decisions made solely on automated processing that affect their interests and to request clear information about the criteria and procedures used, subject to commercial and industrial secrecy.

Article 22 gives a right not to be subject to certain solely automated decisions producing legal or similarly significant effects, subject to exceptions. In specified exception cases, safeguards include human intervention, expressing a viewpoint, and contesting the decision.

Under ANPD Resolution 15/2024, when an incident can cause relevant risk or damage, the controller generally must communicate it to the ANPD and affected data subjects within three business days, subject to a specific deadline in another applicable law.

Article 33 generally requires notification of a reportable personal data breach to the supervisory authority, where feasible, within 72 hours after awareness. Article 34 requires notice to affected individuals without undue delay when the breach is likely to result in high risk.

The LGPD establishes controller/operator roles and requires the operator to process according to the controller's instructions. Contractual documentation is an important accountability mechanism, but the statute does not mirror GDPR Article 28 clause-for-clause.

Article 28 expressly requires a binding controller-processor arrangement with a detailed set of mandatory contractual terms and conditions.

Article 33 and ANPD Resolution 19/2024 govern international transfers using mechanisms including adequacy, Brazilian standard contractual clauses, approved equivalent clauses, specific clauses, and binding corporate rules.

Chapter V uses its own adequacy, appropriate safeguards, binding corporate rules, standard contractual clauses, and derogation framework.

Article 52 permits a simple fine of up to 2% of the private legal entity's, group or conglomerate's revenue in Brazil in the previous fiscal year, excluding taxes, capped at BRL 50 million per infraction. Other sanctions can include warning, publication, blocking/deletion of data, suspension, and prohibition of processing activities.

For specified serious infringements, Article 83 provides for fines up to EUR 20 million or, for an undertaking, 4% of total worldwide annual turnover of the preceding financial year, whichever is higher.

Brazil has a national data-protection regulator, the Agência Nacional de Proteção de Dados (ANPD), responsible for implementing and enforcing the LGPD across Brazil and issuing regulations within its authority.

The EU system involves independent national supervisory authorities, the European Data Protection Board, and cross-border cooperation mechanisms including the lead-supervisory-authority framework where applicable.