Home › Compare laws side by side › LGPD vs EU GDPR

LGPD vs EU GDPR

Lei Geral de Proteção de Dados Pessoais (Law No. 13,709/2018) (Brazil) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.

Topic	LGPD Brazil 13/14 facts confirmed by two sources	EU GDPR European Union (EEA) ✓ Confirmed by two sources
Status	In force. ANPD became a regulatory agency under Law 15,352/2026 (signed 25 Feb 2026).✓	In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓
Who it applies to	Any public or private processing, wherever the company is based, if processing happens in Brazil, aims to offer goods or services to or process data of people in Brazil, or the data was collected in Brazil.✓	Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓
Size thresholds	No size or revenue thresholds. Small processing agents (micro/small businesses, startups) get a simplified regime under ANPD Resolution 2/2022, unless they do high-risk processing.✓	None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓
Regulator	Agência Nacional de Proteção de Dados (ANPD)✓	National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓
Breach or incident reporting	Notify the ANPD (via its electronic form) and affected data subjects within 3 business days of learning of an incident that may cause relevant risk or damage (Resolution CD/ANPD 15/2024). Keep records of all incidents for at least 5 years. Deadlines doubled for small agents.✓	Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓
Deadline to answer personal data requests	Confirmation/access in simplified form immediately; complete declaration within 15 days of the request (Art. 19).✓	1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓
Data protection officer	Controllers must appoint a DPO (encarregado) and publish their identity and contact details, preferably on the website (Art. 41). Small processing agents without high-risk processing are exempt but must provide a contact channel.✓	DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓
Local representative	No requirement for foreign companies to appoint a local representative in Brazil.✓	Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓
Sending data abroad	Allowed only on Art. 33 grounds: adequacy, ANPD standard contractual clauses (adopted verbatim; 12-month adoption deadline from 23 Aug 2024), specific clauses, global corporate rules, specific consent, etc. EU and Brazil granted mutual adequacy in Jan 2026.	Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓
Cookies and consent	Needs a legal basis (consent or legitimate interest). ANPD cookie guide (Oct 2022): no pre-ticked non-essential cookies, offer an easy 'reject all' on the first banner layer, and keep consent-based cookies off by default.✓	Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓
Maximum penalty	Up to 2% of the company's (or group's) revenue in Brazil in the prior fiscal year, net of taxes, capped at R$50 million per infraction.✓	Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓

= confirmed by two independent sources, at least one official.

Facts marked “Being verified” are still being confirmed and are not given as answers.

Who each law applies to

LGPD: Any public or private processing, wherever the company is based, if processing happens in Brazil, aims to offer goods or services to or process data of people in Brazil, or the data was collected in Brazil.
EU GDPR: Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.

What you must do under LGPD

Identify a legal basis for each processing activity and record it.
Appoint and publish a DPO (encarregado), unless exempt as a low-risk small agent.
Answer access requests immediately (simplified) or within 15 days (complete).
Report risky security incidents to the ANPD and affected people within 3 business days.
Use ANPD standard contractual clauses or another Art. 33 mechanism for transfers abroad.
Keep a record of all security incidents for at least 5 years.

Full LGPD page, sources and checklist

What you must do under EU GDPR

Identify a lawful basis for every processing purpose and record it.
Publish a clear privacy notice covering purposes, recipients, retention and rights.
Keep a record of processing activities and sign Art 28 contracts with processors.
Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
Answer access, erasure and other rights requests within one month.

Full EU GDPR page, sources and checklist

Partner

Termly

Create and maintain a privacy policy, cookie banner and request forms.

Create your privacy policy with Termly

Partner link: we may earn a commission if you buy, at no extra cost to you. It never affects our legal content. Affiliate disclosure

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.