Use this comparison to route EU and Brazil privacy work without treating similar concepts as identical legal requirements.
The regimes share principles, rights, security, accountability, and transfer controls, but differ in scope wording, legal bases, role terminology, response timing, incident rules, transfer mechanisms, and penalties.
EU GDPR and Brazil's Lei Geral de Proteção de Dados Pessoais () can apply to the same processing. Run separate territorial-scope, role, legal-basis, rights, incident, and transfer tests. Reuse the data map and operational controls where they fit, but keep each conclusion tied to its own law and regulator.
Side-by-side comparison
EU GDPR vs Brazil LGPD: separate decisions, shared operations
Use these rows to compare scope, roles, legal bases, rights, incidents, transfers, evidence, and enforcement under current EU and Brazilian sources.
Use the GDPR column to scope processing, assign controller and processor duties, select a lawful basis, handle rights, manage breaches and transfers, and retain accountability evidence.
Second framework
Brazil LGPD
Use the column for Brazil scope, controlador and operador roles, Articles 7 and 11 bases, rights, ANPD incident procedure, international transfers, sanctions, and evidence.
EU GDPR vs Brazil LGPD: separate decisions, shared operations
GDPR applies to processing of personal data and allocates duties to controllers, processors, and joint controllers. Scope analysis should identify the processing purpose, data categories, data subjects, recipients, territories, and whether the activity is tied to EU establishment, offering goods or services, or monitoring behavior.
Primary GDPR text for personal-data scope and regulated roles.
processing of personal data
applies when processing occurs in Brazil, the activity offers or supplies goods or services to individuals in Brazil or processes data of individuals located there, or the personal data was collected in Brazil, subject to Article 4 exclusions.
GDPR controllers must implement and be able to demonstrate compliant processing. Controllers using processors must use processors with sufficient guarantees and put the processing in a binding contract or legal act with required Article 28 terms.
Supports GDPR accountability and processor-contract duties.
sufficient guarantees
distinguishes controlador, which makes decisions about processing, from operador, which processes on the controlador's behalf. Both are agentes de tratamento; the encarregado is the communication channel described by the law and ANPD rules.
Article 5 defines controlador, operador, encarregado, and processing agents; Articles 37 to 41 address records, instructions, and the data protection officer.
Vendor records can share facts, but GDPR Article 28 terms, assistance duties, sub-processor controls, and audit evidence should remain labelled as GDPR evidence.
GDPR processing needs an Article 6 legal basis: consent, contract, legal obligation, vital interests, public task, or legitimate interests. The record should explain the selected basis and the obligation that follows from it.
Lists the six GDPR Article 6 legal bases and explains why controllers must identify the justification for processing.
consent; contract; legal obligation; vital interests; public task; or legitimate interests
Article 7 lists ten bases for personal data, while Article 11 sets the conditions for sensitive personal data. The list includes bases that do not have a one-to-one GDPR Article 6 equivalent, such as credit protection.
GDPR rights work should cover access, information about processing, rectification, erasure, restriction, portability, objection, automated-decision safeguards where relevant, identity checks, response handling, and a rights-request log.
Supports GDPR rights including access and information about third-country transfer safeguards.
right of access by the data subject
Article 18 provides rights including confirmation, access, correction, anonymization, blocking or deletion in specified cases, portability, deletion of consent-based data subject to exceptions, information, and consent revocation. Article 19 sets immediate simplified confirmation or access, or a clear and complete statement within 15 days.
GDPR evidence should include RoPA entries, lawful-basis rationale, notices, rights logs, processor contracts, security measures, DPIAs or DPIA screening, breach records, transfer safeguards, retention rules, and approvals for material changes.
Supports the GDPR RoPA and accountability evidence list.
purposes of processing
evidence can include processing-operation records, the legal basis, notices and consent records where relevant, operator instructions, rights logs, security controls, incident records, impact reports when required, transfer mechanism, and ANPD correspondence.
GDPR controllers notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after awareness unless the breach is unlikely to result in risk to rights and freedoms. They must document breach facts, effects, and remedial action.
Supports GDPR breach notification timing and breach documentation.
not later than 72 hours
For an incident that may cause relevant risk or damage, the controller must notify the ANPD and affected data subjects within three business days under Resolution No. 15/2024, unless specific legislation sets another period. The controller must retain incident records for at least five years.
Official ANPD source for the incident trigger, three-business-day period, and notification process.
Incident response can use one technical investigation, but the legal clock, notification decision, delay reason, and regulator communication must be recorded by jurisdiction.
GDPR supervisory authorities have corrective powers, and the GDPR sets administrative-fine tiers including up to EUR 20,000,000 or 4 percent of total worldwide annual turnover for listed infringements, whichever is higher.
Supports GDPR administrative-fine exposure and supervisory authority powers.
up to 20 000 000 EUR
ANPD enforces administrative sanctions. Article 52 includes warnings, public disclosure, blocking or deletion in specified cases, and a fine of up to 2 percent of Brazilian revenue, excluding taxes, capped at BRL 50 million per infringement, among other sanctions and conditions.
Articles 52 to 55-K establish sanctions and ANPD enforcement powers.
Do not merge risk scoring. Calculate and describe EU and Brazil enforcement exposure from the applicable regime, infringement, facts, procedure, and current authority rules.
GDPR Chapter V requires a transfer basis: an adequacy decision where available, Article 46 safeguards such as SCCs where needed, or a limited derogation where the GDPR conditions are met.
Supports SCCs as pre-approved GDPR transfer clauses.
pre-approved
The EU and Brazil adopted reciprocal adequacy decisions in January 2026. Adequacy simplifies covered transfers between the two jurisdictions, but it does not replace the duties that apply to the processing itself.
Supports the Brazil adequacy statement used in this row.
mutual adequacy decisions
For each EU-Brazil transfer, record the direction and the adequacy decision used. If the flow falls outside an adequacy decision, select and document a valid mechanism under the exporting jurisdiction's rules.
If processing occurs in the context of an EU establishment, or an out-of-EU controller or processor offers goods or services to people in the Union or monitors their behavior there, apply the GDPR Article 3 test and then map lawful basis, rights, breaches, transfers, and records.
This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union
If processing occurs in Brazil, concerns an offer or service to individuals in Brazil or data of individuals located there, or uses personal data collected in Brazil, apply the Article 3 test and then check its Article 4 exclusions.
Supports using territorial scope as the first routing step.
territorial scope
Scope boundary
EU GDPR
GDPR applies to processing of personal data and allocates duties to controllers, processors, and joint controllers. Scope analysis should identify the processing purpose, data categories, data subjects, recipients, territories, and whether the activity is tied to EU establishment, offering goods or services, or monitoring behavior.
Primary GDPR text for personal-data scope and regulated roles.
processing of personal data
Brazil LGPD
applies when processing occurs in Brazil, the activity offers or supplies goods or services to individuals in Brazil or processes data of individuals located there, or the personal data was collected in Brazil, subject to Article 4 exclusions.
GDPR controllers must implement and be able to demonstrate compliant processing. Controllers using processors must use processors with sufficient guarantees and put the processing in a binding contract or legal act with required Article 28 terms.
Supports GDPR accountability and processor-contract duties.
sufficient guarantees
Brazil LGPD
distinguishes controlador, which makes decisions about processing, from operador, which processes on the controlador's behalf. Both are agentes de tratamento; the encarregado is the communication channel described by the law and ANPD rules.
Article 5 defines controlador, operador, encarregado, and processing agents; Articles 37 to 41 address records, instructions, and the data protection officer.
Operational implication
Vendor records can share facts, but GDPR Article 28 terms, assistance duties, sub-processor controls, and audit evidence should remain labelled as GDPR evidence.
Supports maintaining GDPR accountability records that can be retrieved for supervisory review.
demonstrate accountability
Legal bases
EU GDPR
GDPR processing needs an Article 6 legal basis: consent, contract, legal obligation, vital interests, public task, or legitimate interests. The record should explain the selected basis and the obligation that follows from it.
Lists the six GDPR Article 6 legal bases and explains why controllers must identify the justification for processing.
consent; contract; legal obligation; vital interests; public task; or legitimate interests
Brazil LGPD
Article 7 lists ten bases for personal data, while Article 11 sets the conditions for sensitive personal data. The list includes bases that do not have a one-to-one GDPR Article 6 equivalent, such as credit protection.
Supports a separate cited lawful-basis decision for GDPR.
reason or justification
Core obligations
EU GDPR
GDPR rights work should cover access, information about processing, rectification, erasure, restriction, portability, objection, automated-decision safeguards where relevant, identity checks, response handling, and a rights-request log.
Supports GDPR rights including access and information about third-country transfer safeguards.
right of access by the data subject
Brazil LGPD
Article 18 provides rights including confirmation, access, correction, anonymization, blocking or deletion in specified cases, portability, deletion of consent-based data subject to exceptions, information, and consent revocation. Article 19 sets immediate simplified confirmation or access, or a clear and complete statement within 15 days.
Supports keeping GDPR rights handling distinct from the LGPD response analysis.
right to obtain
Evidence record
EU GDPR
GDPR evidence should include RoPA entries, lawful-basis rationale, notices, rights logs, processor contracts, security measures, DPIAs or DPIA screening, breach records, transfer safeguards, retention rules, and approvals for material changes.
Supports the GDPR RoPA and accountability evidence list.
purposes of processing
Brazil LGPD
evidence can include processing-operation records, the legal basis, notices and consent records where relevant, operator instructions, rights logs, security controls, incident records, impact reports when required, transfer mechanism, and ANPD correspondence.
Supports using records to demonstrate GDPR accountability while keeping source labels clear.
accountability
Timing and deadlines
EU GDPR
GDPR controllers notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after awareness unless the breach is unlikely to result in risk to rights and freedoms. They must document breach facts, effects, and remedial action.
Supports GDPR breach notification timing and breach documentation.
not later than 72 hours
Brazil LGPD
For an incident that may cause relevant risk or damage, the controller must notify the ANPD and affected data subjects within three business days under Resolution No. 15/2024, unless specific legislation sets another period. The controller must retain incident records for at least five years.
Official ANPD source for the incident trigger, three-business-day period, and notification process.
Operational implication
Incident response can use one technical investigation, but the legal clock, notification decision, delay reason, and regulator communication must be recorded by jurisdiction.
Supports documenting breach facts, effects, and remedial action.
remedial action taken
Enforcement
EU GDPR
GDPR supervisory authorities have corrective powers, and the GDPR sets administrative-fine tiers including up to EUR 20,000,000 or 4 percent of total worldwide annual turnover for listed infringements, whichever is higher.
Supports GDPR administrative-fine exposure and supervisory authority powers.
up to 20 000 000 EUR
Brazil LGPD
ANPD enforces administrative sanctions. Article 52 includes warnings, public disclosure, blocking or deletion in specified cases, and a fine of up to 2 percent of Brazilian revenue, excluding taxes, capped at BRL 50 million per infringement, among other sanctions and conditions.
Articles 52 to 55-K establish sanctions and ANPD enforcement powers.
Operational implication
Do not merge risk scoring. Calculate and describe EU and Brazil enforcement exposure from the applicable regime, infringement, facts, procedure, and current authority rules.
Supports keeping GDPR fine calculations separate from LGPD sanctions.
4 %
Overlap and reuse
EU GDPR
GDPR Chapter V requires a transfer basis: an adequacy decision where available, Article 46 safeguards such as SCCs where needed, or a limited derogation where the GDPR conditions are met.
Supports SCCs as pre-approved GDPR transfer clauses.
pre-approved
Brazil LGPD
The EU and Brazil adopted reciprocal adequacy decisions in January 2026. Adequacy simplifies covered transfers between the two jurisdictions, but it does not replace the duties that apply to the processing itself.
Supports the Brazil adequacy statement used in this row.
mutual adequacy decisions
Operational implication
For each EU-Brazil transfer, record the direction and the adequacy decision used. If the flow falls outside an adequacy decision, select and document a valid mechanism under the exporting jurisdiction's rules.
Supports using adequacy context for Brazil-specific transfer planning.
Brazil
Practical decision rule
EU GDPR
If processing occurs in the context of an EU establishment, or an out-of-EU controller or processor offers goods or services to people in the Union or monitors their behavior there, apply the GDPR Article 3 test and then map lawful basis, rights, breaches, transfers, and records.
This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union
Brazil LGPD
If processing occurs in Brazil, concerns an offer or service to individuals in Brazil or data of individuals located there, or uses personal data collected in Brazil, apply the Article 3 test and then check its Article 4 exclusions.
Supports using territorial scope as the first routing step.
territorial scope
Practical decision rule
How should teams decide between EU GDPR and Brazil LGPD for compliance planning?
Make the GDPR decision first: scope, role, Article 6 basis, rights workflow, processor contract, breach route, transfer mechanism, and records.
Make a separate decision for scope, controlador or operador role, Article 7 or 11 basis, rights workflow, incident route, transfer mechanism, and evidence.
For EU-Brazil transfers, record the direction of transfer and the adequacy decision used; apply another valid mechanism where the transfer falls outside its scope.
Calendar GDPR and rights and incident clocks separately even when one operational team handles both.
Source for the Brazil transfer and adequacy context used in the comparison.
Brazil
1
Section 1
Choose the jurisdiction from the processing facts
GDPR applies to processing in the context of an EU establishment and can reach non-EU controllers or processors that offer goods or services to people in the Union or monitor their behavior there. applies regardless of headquarters or data location when processing occurs in Brazil, the activity offers or supplies goods or services to individuals in Brazil or processes data of individuals located there, or the personal data was collected in Brazil, subject to its exclusions.
Article 4 excludes processing by a natural person for exclusively private, non-economic purposes; processing for exclusively journalistic or artistic purposes; and specified processing for academic purposes, although Articles 7 and 11 still apply to the academic case. It also excludes processing exclusively for public security, national defence, State security, or criminal investigation and prosecution, which is assigned to specific legislation, and narrowly defined foreign-origin data that is not communicated or shared with Brazilian processing agents or transferred onward outside its country of origin when that country provides adequate protection. These exclusions depend on the purpose and facts, not the organisation's label.
Both laws regulate personal-data processing, but their terms must stay separate. GDPR uses controller and processor. uses controlador and operador, with agentes de tratamento covering both. The factual allocation may align, but the contract, instruction, responsibility, and regulator-facing records must cite the applicable regime. This page supports planning; a fact-specific scope or exclusion conclusion may need advice in the relevant jurisdiction.
Write separate GDPR Article 3 and Article 3 scope findings.
Map GDPR controller or processor roles and controlador or operador roles from the actual decisions and instructions.
Apply the exclusions in each law rather than assuming that an exclusion in one regime carries across; keep the purpose, actor, territory, data origin, sharing, and onward-transfer facts that support the conclusion.
Keep one processing inventory only if every legal field is labelled EU, Brazil, or shared fact, with an owner and approval date.
Reassess scope when an establishment, target population, monitoring activity, processing location, data-collection location, purpose, role, or onward transfer changes.
Supports the GDPR obligations used in the comparison, including lawful basis, rights, processor duties, breach notification, transfers, records, and fines.
protection of natural persons with regard to the processing of personal data
Primary Brazilian legal text for LGPD scope, definitions, legal bases, rights, actors, security, transfers, sanctions, and ANPD powers.
2
Section 2
Map legal bases, rights, and evidence separately
GDPR Article 6 provides six lawful bases for ordinary personal data, with separate Article 9 conditions for special categories. Article 7 provides ten bases for personal data, including consent, legal or regulatory obligation, public policy, research, contract-related necessity, exercise of rights, protection of life, health protection, legitimate interests, and credit protection; sensitive personal data follows Article 11.
Sensitive personal data under includes data about racial or ethnic origin, religious conviction, political opinion, trade-union or religious, philosophical, or political-organisation membership, health or sex life, and genetic or biometric data linked to a natural person. GDPR special-category data is similar but not identical, and each law has its own permitted conditions. Do not carry an Article 9 GDPR conclusion into an Article 11 LGPD record without a separate test.
Rights also differ. GDPR generally requires action within one month, subject to its extension rules. Under Article 19, confirmation of processing or access must be provided immediately in simplified form or by a clear and complete statement within 15 days. The request type, identity checks, exceptions, response form, and regulator route must remain jurisdiction-specific.
Controller or controlador: approve and retain the separate GDPR and scope, role, purpose, data-category, legal-basis, rights, retention, security, and transfer decisions.
Processor or operador: retain the applicable instructions, contract, sub-processing approvals, security evidence, assistance record, and any issue escalated to the deciding party.
Rights team: use one intake queue only if it preserves the applicable right, identity check, receipt time, deadline, response form, exception, action taken, and delivery evidence.
Privacy owner: keep GDPR RoPA, DPIA, and Article 28 evidence distinct from processing records, impact reports, and operador instructions where the required legal content differs.
Articles 7, 11, 18, and 19 establish LGPD legal bases, sensitive-data conditions, data-subject rights, and access or confirmation timing.
3
Section 3
Transfer and breach checks
GDPR transfer work starts with Chapter V. international transfers follow Articles 33 to 36 and ANPD Resolution No. 19/2024, which includes adequacy and contractual mechanisms. Commission Implementing Decision (EU) 2026/179 permits covered transfers from EU controllers and processors to controllers and processors in Brazil without further authorization. ANPD Resolution No. 32/2026 recognizes EU Member States, the EEA EFTA states, and EU institutions, bodies, and agencies for covered transfers from Brazil.
The two adequacy decisions have limits. The ANPD decision excludes transfers exclusively for public security, national defence, State security, or criminal investigation and prosecution and requires reassessment within four years. Both authorities monitor continued protection and can revise the decisions. Record the transfer direction, exporter and importer, covered data and purpose, decision relied on, excluded activity check, and monitoring owner; re-check the record if the flow, purpose, recipient, law, or adequacy status changes.
Incident clocks differ. GDPR controllers notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after awareness unless the breach is unlikely to risk individuals. Under ANPD Resolution No. 15/2024, the controlador must notify the ANPD and affected data subjects within three business days when the incident may cause relevant risk or damage, unless specific legislation sets another period. A shared technical investigation does not merge the thresholds or clocks.
Keep the GDPR breach awareness time, risk assessment, notification decision, delay reason, and remedial action in the breach file.
For EU-Brazil transfers, record which adequacy decision covers the direction of transfer and re-check its scope before relying on it.
For other transfers, select the applicable Article 33 mechanism and follow current ANPD transfer rules.
For Brazil incidents, record awareness, the relevant-risk-or-damage assessment, three-business-day notifications, any staged submission, and the five-year incident record.
Official EU decision permitting covered transfers from EU controllers and processors to controllers and processors in Brazil without further authorization and establishing ongoing monitoring and review.
Recommended next step
Build a cited EU and Brazil comparison workflow
Sorena can help separate GDPR and LGPD conclusions, assign owners, and maintain evidence records for lawful basis, rights, transfers, breach handling, and operator accountability.
Primary GDPR legal text for scope, lawful basis, rights, controller and processor duties, records, security, breaches, transfers, and fines.
Supports the GDPR obligations used in the comparison, including lawful basis, rights, processor duties, breach notification, transfers, records, and fines.
Supports GDPR breach notification, transfer safeguards, adequacy decisions, derogations, and administrative-fine exposure.
Show 13 more
Primary GDPR text for personal-data scope and regulated roles.
Supports keeping a distinct GDPR scope finding.
Supports GDPR accountability and processor-contract duties.
Supports GDPR rights including access and information about third-country transfer safeguards.
Supports keeping GDPR rights handling distinct from the LGPD response analysis.
Supports GDPR breach notification timing and breach documentation.
Supports documenting breach facts, effects, and remedial action.
Supports GDPR administrative-fine exposure and supervisory authority powers.
Supports keeping GDPR fine calculations separate from LGPD sanctions.
Supports GDPR Chapter V transfer bases and safeguards.
Primary GDPR text for territorial scope.
Supports using territorial scope as the first routing step.
Primary source for the GDPR-side decision checklist.
"protection of natural persons with regard to the processing of personal data"
More quoted passages
"not later than 72 hours"
"processing of personal data"
"protection of natural persons"
"sufficient guarantees"
"right of access by the data subject"
"right to obtain"
"remedial action taken"
"up to 20 000 000 EUR"
"4 %"
"appropriate safeguards"
"This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union"
Primary Brazilian legal text for LGPD scope, legal bases, rights, actors, security, transfers, sanctions, and regulator powers.
Primary Brazilian legal text for LGPD scope, definitions, legal bases, rights, actors, security, transfers, sanctions, and ANPD powers.
Articles 7, 11, 18, and 19 establish LGPD legal bases, sensitive-data conditions, data-subject rights, and access or confirmation timing.
Show 6 more
Articles 3 and 4 establish territorial scope and exclusions.
Article 5 defines controlador, operador, encarregado, and processing agents; Articles 37 to 41 address records, instructions, and the data protection officer.
Articles 7 and 11 establish legal bases for personal and sensitive personal data.
Articles 18 and 19 establish LGPD rights and confirmation or access response forms and timing.
Articles 37 to 41 and 46 to 50 support processing records, instructions, impact reports, security, incidents, and governance evidence.
Articles 52 to 55-K establish sanctions and ANPD enforcement powers.
Official EU decision permitting covered transfers from EU controllers and processors to controllers and processors in Brazil without further authorization and establishing ongoing monitoring and review.