71%
of Brazil's 21 requirements are already met by European Union (GDPR). Here is what LGPD adds, biggest gaps first.
Reach abroadReach and lawful basisGap
GDPR2 Applies to non-EU controllers offering goods or services to, or monitoring the behavior of, people in the EU.
LGPD adds3 Applies regardless of location if processing occurs in Brazil, targets goods or services to people in Brazil, or data was collected in Brazil.
Art. 3 · source ↗
ChildrenReach and lawful basisGap
GDPR2 Parental consent required for information society services offered to children under 16; Member States may lower the age to no less than 13.
LGPD adds3 Under 12 needs specific parental consent; all minors under 18 must be processed in their best interest.
Art. 14 · source ↗
Request deadlinePeople's rightsGap
GDPR2 Respond within one month, extendable by two further months for complex or numerous requests.
LGPD adds3 Full access response within 15 days of the request; simplified confirmation immediately.
Art. 19(II) · source ↗
DPO requiredGovernanceGap
GDPR1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
LGPD adds2 Controllers must appoint an encarregado; ANPD may exempt small processing agents.
Art. 41; Res. CD/ANPD 18/2024 · source ↗
RetentionGovernanceGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
LGPD adds2 Data must be deleted when processing ends, with listed exceptions such as legal obligations or research.
Art. 15, Art. 16 · source ↗
Tell peopleBreachesGap
GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.
LGPD adds3 Notify affected data subjects within 3 business days when the incident may cause relevant risk or harm.
Art. 48; Res. CD/ANPD 15/2024 · source ↗
Already covered by GDPR: Lawful basis, Consent, Sensitive data, Rights, Marketing, DPO qualifications, Registration, DPIA, Records, Tell the regulator, Transfers abroad, Localization, Maximum fine, Criminal liability, Private action.
A gap means LGPD is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
