EU GDPR EU GDPR vs Brazil LGPD

GDPR applies to processing of personal data and allocates duties to controllers, processors, and joint controllers. Scope analysis should identify the processing purpose, data categories, data subjects, recipients, territories, and whether the activity is tied to EU establishment, offering goods or services, or monitoring behavior.

The available GDPR folder does not include a grounded LGPD scope source. Record Brazil scope as source pending unless the issue is limited to the Commission's Brazil transfer and adequacy context.

Do not treat a GDPR scope finding as an LGPD scope finding. Keep one GDPR record and one Brazil source-validation record.

GDPR controllers must implement and be able to demonstrate compliant processing. Controllers using processors must use processors with sufficient guarantees and put the processing in a binding contract or legal act with required Article 28 terms.

The folder does not ground LGPD controller, operator, DPO, or ANPD accountability procedures. Keep Brazil role mapping separate until a Brazil source is added.

Vendor records can share facts, but GDPR Article 28 terms, assistance duties, sub-processor controls, and audit evidence should remain labelled as GDPR evidence.

GDPR processing needs an Article 6 legal basis: consent, contract, legal obligation, vital interests, public task, or legitimate interests. The record should explain the selected basis and the obligation that follows from it.

No Brazil LGPD lawful-basis list is grounded in this folder. Do not copy the GDPR Article 6 basis list into the LGPD workstream without a separate LGPD source.

A shared product feature may use the same facts, but the lawful-basis memo should have separate EU and Brazil source citations.

GDPR rights work should cover access, information about processing, rectification, erasure, restriction, portability, objection, automated-decision safeguards where relevant, identity checks, response handling, and a rights-request log.

No grounded LGPD rights catalogue or response clock is available in this folder. Brazil-side rights handling should be marked source pending rather than inferred from GDPR.

Reuse intake tooling only after each request type, deadline, exception, and evidence field is mapped to its own jurisdictional source.

GDPR evidence should include RoPA entries, lawful-basis rationale, notices, rights logs, processor contracts, security measures, DPIAs or DPIA screening, breach records, transfer safeguards, retention rules, and approvals for material changes.

Brazil evidence should be a separate workstream with source citations added before claims are published. The available folder does not ground LGPD record fields.

A shared privacy inventory is useful only if every field shows whether it supports GDPR, Brazil LGPD, or both with separate source citations.

GDPR controllers notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after awareness unless the breach is unlikely to result in risk to rights and freedoms. They must document breach facts, effects, and remedial action.

No Brazil LGPD breach-notification deadline or ANPD procedure is grounded in this folder. Do not publish a Brazil breach clock from this comparison.

Incident response can use one technical investigation, but the legal clock, notification decision, delay reason, and regulator communication must be recorded by jurisdiction.

GDPR supervisory authorities have corrective powers, and the GDPR sets administrative-fine tiers including up to EUR 20,000,000 or 4 percent of total worldwide annual turnover for listed infringements, whichever is higher.

No Brazil LGPD penalty variants, ANPD sanction procedure, or national enforcement detail is grounded in this folder. Leave Brazil enforcement as source pending.

Do not merge risk scoring. EU enforcement exposure can be quantified from GDPR; Brazil enforcement exposure needs a separate Brazil source before publication.

GDPR Chapter V requires a transfer basis: an adequacy decision where available, Article 46 safeguards such as SCCs where needed, or a limited derogation where the GDPR conditions are met.

Brazil is grounded here only through the Commission adequacy source, which states that the Commission and Brazil adopted mutual adequacy decisions and that their levels of data protection are comparable.

For EU-to-Brazil transfer planning, cite the current adequacy analysis or fallback SCC analysis. Do not use this page to state broader LGPD transfer mechanics.

If the processing is carried out in the context of an EU establishment, or targets people in the Union through goods, services, or monitoring, treat the GDPR analysis as the controlling rule-set. Use the Article 3 scope test first, then map lawful basis, rights, breach, transfers, and records under the GDPR.

If the processing is carried out in Brazil, targets individuals in Brazil, or is based on data collected in Brazil, treat LGPD as the likely Brazil-side rule-set. The cited LGPD text applies to processing on Brazilian territory, to offers or services aimed at people in Brazil, and to data collected in Brazil.

Pick the jurisdiction from the facts before comparing obligations. This row is a routing rule, not a duplicate scope summary.