A GDPR programme gets an organisation most of the way to LGPD compliance, but the gaps sit exactly where incidents and audits hurt: legal bases, the incident clock, the encarregado and transfer paperwork. Brazil's Lei Geral de Proteção de Dados (Lei 13.709/2018) was modelled closely on the GDPR, so teams often assume their European controls carry over unchanged. This guide is for privacy, security and GRC leads who already run a GDPR programme and need to decide what to reuse, what to adapt and what to build for Brazil. For the LGPD on its own, read the Brazil LGPD Guide. Status checked on 14 November 2026 against EUR-Lex, the Chamber of Deputies' text of Lei 13.709/2018 and the Agência Nacional de Proteção de Dados (ANPD).
Key takeaways
- Ten bases against six: the LGPD's Art. 7 lists ten legal bases, including credit protection and the exercise of rights in proceedings, where the GDPR's Art. 6(1) has six; map each GDPR basis rather than copying the label.
- Three working days, not 72 hours: ANPD Resolution CD/ANPD 15/2024 gives controllers three working days to notify both the ANPD and affected data subjects, so a GDPR runbook that only times the regulator notice is incomplete.
- Every controller appoints an encarregado: the GDPR only mandates a DPO in the Art. 37(1) cases, while LGPD Art. 41 starts from a general duty to appoint, with exemptions set by the ANPD.
- Adequacy now runs both ways: the European Commission and Brazil adopted mutual adequacy decisions in January 2026, so EU to Brazil flows no longer need SCCs, but transfers from Brazil to non-EU countries still need an LGPD Art. 33 mechanism.
- Fines are capped per infraction: the LGPD caps a simple fine at 2% of Brazilian revenue, up to R$50 million per infraction, against the GDPR's percentage of worldwide turnover, so the exposure model differs even when the conduct is the same.
Short answer: what carries over and what does not
Use the GDPR programme as the backbone and add a Brazilian layer for five things: the legal basis map, the incident clock and notice templates, the encarregado appointment and channel, transfer mechanisms out of Brazil, and the evidence the ANPD expects in Portuguese.
| GDPR artefact | Reuse for LGPD? | What to change |
|---|---|---|
| Art. 30 record of processing | Reuse with edits | Add the LGPD Art. 7 or Art. 11 basis per row; LGPD Art. 37 applies to controllers and operators with no 250 employee carve-out like GDPR Art. 30(5) |
| DPIA (Art. 35) | Reuse with edits | Keep it ready as a RIPD under LGPD Art. 38, which at minimum describes data types, collection and security methodology and mitigation measures |
| Art. 32 security programme | Reuse | LGPD Art. 46 requires technical and administrative measures from design to execution; the same control set evidences both |
| Art. 33 and 34 breach runbook | Adapt | Add the three working day clock for regulator and data subjects, the Resolution 15/2024 risk criteria and Portuguese templates |
| DPO appointment | Adapt | Formal encarregado appointment, published identity and contact, Portuguese channel |
| SCCs and transfer impact assessments | Partly obsolete for EU to Brazil | Mutual adequacy covers EU and Brazil flows; onward transfers from Brazil need ANPD standard clauses or another Art. 33 route |
| Art. 28 processor terms | Reuse with edits | Map "processor" to "operador"; reflect LGPD Art. 42 joint liability of operators that breach the law or ignore lawful instructions |
| Data subject request process | Adapt | LGPD Art. 19 sets 15 days for a full written response, against the GDPR's one month extendable by two |
Side-by-side comparison
| Topic | GDPR (Regulation (EU) 2016/679) | LGPD (Lei 13.709/2018) |
|---|---|---|
| Territorial reach | Art. 3(1) establishment in the EU; Art. 3(2) offering goods or services to, or monitoring, people in the Union | Art. 3: processing in Brazil, offering goods or services to people in Brazil, or data collected in Brazil (data subject present in Brazil at collection) |
| Who is protected | Natural persons (Art. 4(1)); Recital 14 excludes legal persons | Natural persons: the titular is the "pessoa natural" the data relates to (Art. 5, V) |
| Roles | Controller, processor | Controlador, operador; both are "agentes de tratamento" |
| Legal bases | Six (Art. 6(1)(a) to (f)) | Ten (Art. 7, I to X); separate list for sensitive data (Art. 11) |
| Sensitive data | Art. 9(1) special categories, including sexual orientation and philosophical beliefs | Art. 5, II: racial or ethnic origin, religious conviction, political opinion, union membership, health, sex life, genetic and biometric data |
| Request deadline | One month, extendable by two further months (Art. 12(3)) | Simplified reply immediately; full written declaration within 15 days (Art. 19) |
| Security duty | Art. 32(1) risk-based measures, naming pseudonymisation, encryption, resilience, restore and testing | Art. 46 technical and administrative measures; Art. 46, §2 security from design to execution |
| Maximum fine | EUR 20 million or 4% of worldwide annual turnover, whichever is higher (Art. 83(5)); EUR 10 million or 2% for Art. 83(4) breaches | 2% of revenue in Brazil in the last financial year, excluding taxes, capped at R$50 million per infraction (Art. 52, II) |
| Civil liability | Art. 82 compensation, each responsible party liable for the entire damage | Art. 42 compensation; operators jointly liable when they breach the law or ignore lawful instructions; burden of proof may be reversed |
Legal bases: mapping six onto ten
Five GDPR bases have a clear LGPD counterpart: consent (Art. 7, I), legal obligation (II), contract (V), protection of life or physical safety, which corresponds to vital interests (VII), and legitimate interests (IX). The public task basis splits into public administration executing public policies (III) and, for research bodies, studies with anonymisation where possible (IV). Two LGPD bases have no direct GDPR counterpart, and health protection by health professionals (VIII) is narrower:
- Exercise of rights in proceedings (VI): processing for judicial, administrative or arbitral proceedings. Under the GDPR the same forensic or litigation-hold processing usually rests on legitimate interests. In Brazil it can rest on VI, which avoids a balancing test, but the hold must be scoped to the proceedings.
- Credit protection (X): credit scoring and bureau checks. It does not stretch to general fraud analytics, which still needs IX or another basis.
Security monitoring: both laws normally rely on legitimate interests for logging, SIEM, fraud detection and insider risk monitoring. LGPD Art. 37 asks for records of processing especially where legitimate interest is the basis, so the legitimate interest assessment you keep for the GDPR should be attached to the Brazilian record entry. See the Data Mapping and ROPA Guide.
Sensitive data: biometric authentication is sensitive under both laws. LGPD Art. 11 has its own list, separate from Art. 7, so a GDPR Art. 9(2) justification needs to be re-mapped to an Art. 11 ground, not assumed. For the cross-regime view of sensitive categories, see Personal Data vs Sensitive Personal Data.
Incident reporting: the part most likely to break
Threat model
The incidents that trigger both laws look the same: credential theft, ransomware, misconfigured storage, vendor compromise. The difference is the clock and the audience. Under the GDPR the regulator notice comes first and data subjects are told only where high risk is likely. Under Resolution 15/2024 the ANPD notice and the data subject communication share the same three working day window, counted from when the controller learns that the incident affected personal data, unless specific legislation sets another period.
Architecture in words
A workable design runs one triage step with two parallel tracks. Triage confirms the incident, decides whether personal data of people in the EU, in Brazil or both is involved, and applies both thresholds. The GDPR track clocks 72 hours from awareness for the supervisory authority and assesses high risk for Art. 34. The Brazil track clocks three working days for the ANPD and for data subjects, using Portuguese templates already approved by legal. The ANPD allows a preliminary notice followed by a complementary one within 20 working days, with justification, when information is incomplete. Filing goes through the SEI!ANPD portal and only the encarregado or a legally authorised representative may file, so the representative's proof of authority should already be on file before an incident.
The thresholds compared
| Question | GDPR | LGPD and Resolution 15/2024 |
|---|---|---|
| When is the regulator told? | Unless the breach is unlikely to result in a risk to rights and freedoms (Art. 33(1)) | When the incident may cause relevant risk or damage to data subjects (Art. 48) |
| What makes it reportable? | Risk assessment; EDPB guidance gives examples | Significant effect on data subjects' interests or rights plus at least one listed criterion: sensitive data, data of children or adolescents, financial data, authentication data, data protected by secrecy, or large-scale data |
| When are individuals told? | Without undue delay when high risk is likely; not if data was unintelligible, risk was removed or effort is disproportionate (Art. 34(3)) | Three working days, alongside the ANPD notice |
| Minimum contents | Nature, approximate numbers, contact point, likely consequences, measures (Art. 33(3)) | Nature of data, data subjects affected, security measures used, risks, reasons for any delay, mitigation measures (Art. 48, §1) |
Failure modes
- Clock mismatch: 72 hours is calendar time; three working days excludes weekends and Brazilian public holidays. An incident found on a Friday can leave the GDPR deadline earlier than the ANPD one, and one found on a Monday can do the reverse. Calculate both, every time.
- Treating authentication data as harmless: a leaked token or password file with no names in it can still meet the "authentication data" criterion. Under the GDPR the same file would be assessed on risk, so teams trained only on the GDPR can under-call it for Brazil. The credential itself may hold no personal data while opening systems full of it.
Worked scenario
A SaaS company with customers in Germany and São Paulo finds on Thursday afternoon that an API key for its support platform leaked in a public repository and was used to export tickets containing names, emails and some card-last-four data. Triage on Thursday confirms personal data of both populations. The GDPR track notifies the lead supervisory authority by Sunday afternoon and decides high risk is unlikely for most German users. The Brazil track counts Friday, Monday and Tuesday as the three working days, assuming no public holiday, applies the authentication data and financial data criteria, files a preliminary notice in SEI!ANPD and sends Portuguese notices to the affected Brazilian users by Tuesday, then completes the record within the 20 working day window.
For a multi-country notification workflow, see the Breach Notification Laws by Country Guide and the Data Breach Notification Checklist.
DPO versus encarregado
| Aspect | GDPR DPO | LGPD encarregado |
|---|---|---|
| When required | Public bodies; core activities of large-scale regular and systematic monitoring; core activities of large-scale special category or criminal data (Art. 37(1)) | Controllers appoint one (Art. 41); the ANPD may set exemptions based on the nature, size or volume of processing (Art. 41, §3) |
| Published details | Contact details published and communicated to the authority (Art. 37(7)) | Identity and contact details published clearly and objectively, preferably on the website (Art. 41, §1) |
| Core tasks | Inform and advise, monitor compliance, advise on DPIAs, cooperate with the authority (Art. 39) | Accept complaints from data subjects, receive ANPD communications, guide staff, other tasks set by the controller (Art. 41, §2) |
| Independence | No instructions on tasks, no dismissal for performing them, reports to highest management (Art. 38(3)) | Conflict of interest rules set by ANPD regulation (Resolution CD/ANPD 18/2024) |
Decision: one person can hold both roles if they can work with the ANPD and data subjects in Portuguese and the appointment is formalised for Brazil. See DPO vs CPO for how the role sits beside a chief privacy officer.
Cross-border transfers after mutual adequacy
On 26 January 2026 the ANPD adopted Resolution CD/ANPD 32/2026, recognising that the EU, the EEA-EFTA states and EU institutions offer protection compatible with the LGPD, so covered transfers need no additional Art. 33 mechanism. The Commission adopted its adequacy decision for Brazil on 26 January 2026 and both decisions were announced on 27 January 2026, so transfers from the EU to Brazil can proceed without further safeguards. Both decisions exclude processing solely for public security, national defence, state security or criminal investigation, within the limits of the LGPD.
| Flow | Mechanism | Evidence to keep |
|---|---|---|
| EU or EEA to Brazil | Commission adequacy decision for Brazil | Record of the flow; confirm the recipient is subject to the LGPD |
| Brazil to EU or EEA | Resolution CD/ANPD 32/2026 recognition | Record of the flow under Art. 33, I |
| Brazil to a third country (for example the United States or India) | Resolution 19/2024 standard clauses adopted in full and unaltered, global corporate rules, specific clauses approved by the ANPD, or another Art. 33 ground | Signed clauses; Portuguese transparency page; clauses supplied to data subjects on request within 15 days |
| EU to a third country, then onward to Brazil | GDPR Chapter V for the first leg; LGPD Art. 33 for any export from Brazil | Both sets of evidence |
Trade-off: retiring EU SCCs for EU and Brazil flows saves paperwork, but many vendor contracts bundle several destinations. Keep the SCC module where a vendor also exports from the EU to non-adequate countries, and add the ANPD clauses where it exports from Brazil. See the Standard Contractual Clauses (SCCs) Guide and the International Data Transfers Map.
Enforcement and exposure
The GDPR is enforced by national supervisory authorities with cooperation through the one-stop-shop. The LGPD is enforced by a single national regulator. Lei 15.352/2026, published on 25 February 2026, turned the ANPD into the Agência Nacional de Proteção de Dados, attached to the Ministry of Justice and Public Security with functional, technical, decision-making, administrative and financial autonomy, and gave it the job of regulating the ECA Digital children's statute.
- Fine model: GDPR fines scale with worldwide turnover and Art. 83(2) lists factors such as cooperation, mitigation and measures under Arts. 25 and 32. LGPD fines scale with Brazilian revenue and stop at R$50 million per infraction, but several infractions can be fined separately and daily fines apply within the cap.
- Non-monetary sanctions: LGPD Art. 52 also allows publicity of the infraction, blocking or deletion of the data concerned, suspension of a database or processing activity for up to six months (extendable) and a partial or total ban. For a data-dependent business these can outweigh the fine.
When to lead with which law
- Lead with the GDPR when most data subjects are in Europe and Brazil is a sales or support market: build the global programme on the GDPR and bolt on the Brazilian layer.
- Lead with the LGPD when you are a Brazilian group expanding to Europe: your Portuguese records, encarregado and incident process already exist; add GDPR-specific items such as the Art. 27 representative, Art. 34 high-risk tests and lead authority mapping.
Small versus large organisations: a small business selling into Brazil should first fix the incident clock and Portuguese notice templates, publish an encarregado contact unless an ANPD exemption clearly applies, and record legal bases. A multinational should keep one control set but separate Brazilian artefacts so the ANPD can be given Portuguese evidence without exposing the whole group programme.
Where identity fits
Machine identities matter more under the LGPD threshold than teams expect. Authentication data is a listed criterion for relevant risk, so an exposed service account password, API key or OAuth token that reaches personal data can move an incident into the three working day track. The controls serve both laws: inventory, ownership, scoping and rotation. AI agents that read CRM or ticket data are processing operations and belong in both the Art. 30 and Art. 37 records. See the Service Account Security Guide and the AI and Privacy Guide.
Implementing a dual programme
- Scope: tag every system, vendor and agent in the record of processing by population (EU, Brazil, both) and by Art. 3 trigger under each law.
- Map bases: add the LGPD Art. 7 or Art. 11 basis to every row that touches Brazilian data, and attach the legitimate interest assessment where IX applies.
- Appoint and publish: formalise the encarregado, publish identity and a Portuguese contact channel, and register proof of authority for SEI!ANPD filing.
- Rebuild the runbook: add the Resolution 15/2024 criteria to triage, a working-day calculator with Brazilian holidays, and pre-approved Portuguese notices to the ANPD and data subjects.
- Test: run a tabletop that starts on a Friday before a Brazilian public holiday and involves a leaked credential, then measure both clocks.
- Fix transfers: rely on mutual adequacy for EU and Brazil flows, put Resolution 19/2024 clauses in contracts for exports from Brazil, and publish the Portuguese transparency page.
- Keep records: one incident register meeting GDPR Art. 33(5) and the ANPD five-year retention, including decisions not to notify.
Detection and measurement
- Clock performance: hours to GDPR notice and working days to ANPD notice per incident and per exercise (targets: within 72 hours and within three working days).
- Basis coverage: percentage of Brazilian processing rows with an LGPD basis recorded (target: 100%).
- Transfer coverage: percentage of exports from Brazil to non-EU destinations under signed ANPD standard clauses or another documented Art. 33 route.
- Credential hygiene: machine credentials reaching personal data with a named owner and rotation date, and secrets found by scanning per month.
Framework mapping
| Requirement (GDPR / LGPD) | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Legal bases (Art. 6 / Art. 7, 11) | GV.OC-03 | PT-2, PT-3 | A.5.34 |
| Records of processing (Art. 30 / Art. 37) | ID.AM-07 | PT-3 | A.5.9, A.5.34 |
| Impact assessment (Art. 35 / Art. 38) | GV.OC-03 | RA-8 | A.5.34 |
| Security of processing (Art. 32 / Art. 46) | PR.DS-01, PR.AA-05 | AC-6, IA-5 | A.8.2, A.8.24 |
| Incident notice (Arts. 33, 34 / Art. 48) | RS.CO-02, RS.CO-03 | IR-6, IR-8 | A.5.24, A.5.26 |
| Processors and transfers (Arts. 28, 44 to 49 / Arts. 33, 42) | GV.SC-05 | SA-9 | A.5.19, A.5.20 |
| Incident records (Art. 33(5) / five years) | RS.CO-02 | AU-11 | A.5.28 |
Common failure patterns
- Copying the basis label: writing "Art. 6(1)(f)" into the Brazilian record instead of the LGPD basis, which leaves Art. 37 records incomplete.
- One clock for all: a runbook built around 72 hours for the regulator with individual notice later, which misses the parallel three working day data subject deadline.
- English-only channels: an encarregado contact or incident notice that is not usable in Portuguese.
- Over-reading adequacy: assuming mutual adequacy covers exports from Brazil to US or Asian vendors; it covers EU and Brazil flows only.
- Missing "no notify" decisions: not recording incidents judged below threshold, when both the GDPR and the ANPD expect them documented.
Practitioner checklist
- Tag every processing row by EU, Brazil or both, and record the LGPD basis beside the GDPR basis.
- Appoint and publish an encarregado with a Portuguese channel, and file proof of authority for SEI!ANPD.
- Add the Resolution 15/2024 criteria, including authentication data, to incident triage.
- Run both clocks in every incident: 72 hours and three working days, with Brazilian holidays.
- Pre-approve Portuguese notices to the ANPD and to data subjects.
- Rely on mutual adequacy for EU and Brazil flows; use ANPD standard clauses for other exports from Brazil.
- Keep one incident register for at least five years, including decisions not to notify.
- Scope and rotate machine credentials that reach personal data in either region.
Standards and references
- EUR-Lex: Regulation (EU) 2016/679, General Data Protection Regulation
- Câmara dos Deputados: Lei nº 13.709, de 14 de agosto de 2018 (publicação original)
- ANPD: Comunicado de incidente de segurança
- ANPD: ANPD aprova o regulamento de comunicação de incidente de segurança
- CNIL: Le Brésil bénéficie d'une décision d'adéquation de la Commission européenne
- Câmara dos Deputados: Entra em vigor lei que cria a Agência Nacional de Proteção de Dados
- Baker McKenzie: Brazil and European Union mutual data protection adequacy decision
- Demarest: ANPD aprova o regulamento de transferência internacional de dados
This guide compares the GDPR and Brazil's LGPD as of 14 November 2026 and is not legal advice. Related NHI Mgmt Group resources: Brazil LGPD Guide · GDPR Compliance Guide for Security Teams · GDPR vs CCPA/CPRA · Global Privacy Regulatory Map