Use this comparison to route EU and Brazil privacy work without treating similar concepts as identical legal requirements.
The regimes share principles, rights, security, accountability, and transfer controls, but differ in scope wording, legal bases, role terminology, response timing, incident rules, transfer mechanisms, and penalties.
EU GDPR and Brazil's Lei Geral de Proteção de Dados Pessoais () can apply to the same processing. Run separate territorial-scope, role, legal-basis, rights, incident, and transfer tests. Reuse the data map and operational controls where they fit, but keep each conclusion tied to its own law and regulator.
Side-by-side comparison
EU GDPR vs Brazil LGPD: separate decisions, shared operations
Use these rows to compare scope, roles, legal bases, rights, incidents, transfers, evidence, and enforcement under current EU and Brazilian sources.
Treat the GDPR column to scope processing, assign controller and processor duties, select a lawful basis, handle rights, manage breaches and transfers, and retain accountability evidence.
Second framework
Brazil LGPD
Use the column for Brazil scope, controlador and operador roles, Articles 7 and 11 bases, rights, ANPD incident procedure, international transfers, sanctions, and evidence.
EU GDPR vs Brazil LGPD: separate decisions, shared operations
GDPR applies to processing of personal data and allocates duties to controllers, processors, and joint controllers. Scope analysis should identify the processing purpose, data categories, data subjects, recipients, territories, and whether the activity is tied to EU establishment, offering goods or services, or monitoring behavior.
applies when processing occurs in Brazil, the activity offers or supplies goods or services to individuals in Brazil or processes data of individuals located there, or the personal data was collected in Brazil, subject to Article 4 exclusions.
GDPR controllers must implement and be able to demonstrate compliant processing. Controllers using processors must use processors with sufficient guarantees and put the processing in a binding contract or legal act with required Article 28 terms.
distinguishes controlador, which makes decisions about processing, from operador, which processes on the controlador's behalf. Both are agentes de tratamento; the encarregado is the communication channel described by the law and ANPD rules.
Vendor records can share facts, but GDPR Article 28 terms, assistance duties, sub-processor controls, and audit evidence should remain labelled as GDPR evidence.
GDPR processing needs an Article 6 legal basis: consent, contract, legal obligation, vital interests, public task, or legitimate interests. The record should explain the selected basis and the obligation that follows from it.
Article 7 lists ten bases for personal data, while Article 11 sets the conditions for sensitive personal data. The list includes bases that do not have a one-to-one GDPR Article 6 equivalent, such as credit protection.
GDPR rights work should cover access, information about processing, rectification, erasure, restriction, portability, objection, automated-decision safeguards where relevant, identity checks, response handling, and a rights-request log.
Article 18 provides rights including confirmation, access, correction, anonymization, blocking or deletion in specified cases, portability, deletion of consent-based data subject to exceptions, information, and consent revocation. Article 19 sets immediate simplified confirmation or access, or a clear and complete statement within 15 days.
GDPR evidence should include RoPA entries, lawful-basis rationale, notices, rights logs, processor contracts, security measures, DPIAs or DPIA screening, breach records, transfer safeguards, retention rules, and approvals for material changes.
evidence can include processing-operation records, the legal basis, notices and consent records where relevant, operator instructions, rights logs, security controls, incident records, impact reports when required, transfer mechanism, and ANPD correspondence.
GDPR controllers notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after awareness unless the breach is unlikely to result in risk to rights and freedoms. They must document breach facts, effects, and remedial action.
For an incident that may cause relevant risk or damage, the controller must notify the ANPD and affected data subjects within three business days under Resolution No. 15/2024, unless specific legislation sets another period. The controller must retain incident records for at least five years.
Incident response can use one technical investigation, but the legal clock, notification decision, delay reason, and regulator communication must be recorded by jurisdiction.
GDPR supervisory authorities have corrective powers, and the GDPR sets administrative-fine tiers including up to EUR 20,000,000 or 4 percent of total worldwide annual turnover for listed infringements, whichever is higher.
ANPD enforces administrative sanctions. Article 52 includes warnings, public disclosure, blocking or deletion in specified cases, and a fine of up to 2 percent of Brazilian revenue, excluding taxes, capped at BRL 50 million per infringement, among other sanctions and conditions.
Do not merge risk scoring. Calculate and describe EU and Brazil enforcement exposure from the applicable regime, infringement, facts, procedure, and current authority rules.
GDPR Chapter V requires a transfer basis: an adequacy decision where available, Article 46 safeguards such as SCCs where needed, or a limited derogation where the GDPR conditions are met.
The EU and Brazil adopted reciprocal adequacy decisions in January 2026. Adequacy simplifies covered transfers between the two jurisdictions, but it does not replace the duties that apply to the processing itself.
For each EU-Brazil transfer, record the direction and the adequacy decision used. If the flow falls outside an adequacy decision, select and document a valid mechanism under the exporting jurisdiction's rules.
If processing occurs in the context of an EU establishment, or an out-of-EU controller or processor offers goods or services to people in the Union or monitors their behavior there, apply the GDPR Article 3 test and then map lawful basis, rights, breaches, transfers, and records.
If processing occurs in Brazil, concerns an offer or service to individuals in Brazil or data of individuals located there, or uses personal data collected in Brazil, apply the Article 3 test and then check its Article 4 exclusions.
GDPR applies to processing of personal data and allocates duties to controllers, processors, and joint controllers. Scope analysis should identify the processing purpose, data categories, data subjects, recipients, territories, and whether the activity is tied to EU establishment, offering goods or services, or monitoring behavior.
applies when processing occurs in Brazil, the activity offers or supplies goods or services to individuals in Brazil or processes data of individuals located there, or the personal data was collected in Brazil, subject to Article 4 exclusions.
GDPR controllers must implement and be able to demonstrate compliant processing. Controllers using processors must use processors with sufficient guarantees and put the processing in a binding contract or legal act with required Article 28 terms.
distinguishes controlador, which makes decisions about processing, from operador, which processes on the controlador's behalf. Both are agentes de tratamento; the encarregado is the communication channel described by the law and ANPD rules.
Vendor records can share facts, but GDPR Article 28 terms, assistance duties, sub-processor controls, and audit evidence should remain labelled as GDPR evidence.
GDPR processing needs an Article 6 legal basis: consent, contract, legal obligation, vital interests, public task, or legitimate interests. The record should explain the selected basis and the obligation that follows from it.
Article 7 lists ten bases for personal data, while Article 11 sets the conditions for sensitive personal data. The list includes bases that do not have a one-to-one GDPR Article 6 equivalent, such as credit protection.
GDPR rights work should cover access, information about processing, rectification, erasure, restriction, portability, objection, automated-decision safeguards where relevant, identity checks, response handling, and a rights-request log.
Article 18 provides rights including confirmation, access, correction, anonymization, blocking or deletion in specified cases, portability, deletion of consent-based data subject to exceptions, information, and consent revocation. Article 19 sets immediate simplified confirmation or access, or a clear and complete statement within 15 days.
GDPR evidence should include RoPA entries, lawful-basis rationale, notices, rights logs, processor contracts, security measures, DPIAs or DPIA screening, breach records, transfer safeguards, retention rules, and approvals for material changes.
evidence can include processing-operation records, the legal basis, notices and consent records where relevant, operator instructions, rights logs, security controls, incident records, impact reports when required, transfer mechanism, and ANPD correspondence.
GDPR controllers notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after awareness unless the breach is unlikely to result in risk to rights and freedoms. They must document breach facts, effects, and remedial action.
For an incident that may cause relevant risk or damage, the controller must notify the ANPD and affected data subjects within three business days under Resolution No. 15/2024, unless specific legislation sets another period. The controller must retain incident records for at least five years.
Incident response can use one technical investigation, but the legal clock, notification decision, delay reason, and regulator communication must be recorded by jurisdiction.
GDPR supervisory authorities have corrective powers, and the GDPR sets administrative-fine tiers including up to EUR 20,000,000 or 4 percent of total worldwide annual turnover for listed infringements, whichever is higher.
ANPD enforces administrative sanctions. Article 52 includes warnings, public disclosure, blocking or deletion in specified cases, and a fine of up to 2 percent of Brazilian revenue, excluding taxes, capped at BRL 50 million per infringement, among other sanctions and conditions.
Do not merge risk scoring. Calculate and describe EU and Brazil enforcement exposure from the applicable regime, infringement, facts, procedure, and current authority rules.
GDPR Chapter V requires a transfer basis: an adequacy decision where available, Article 46 safeguards such as SCCs where needed, or a limited derogation where the GDPR conditions are met.
The EU and Brazil adopted reciprocal adequacy decisions in January 2026. Adequacy simplifies covered transfers between the two jurisdictions, but it does not replace the duties that apply to the processing itself.
For each EU-Brazil transfer, record the direction and the adequacy decision used. If the flow falls outside an adequacy decision, select and document a valid mechanism under the exporting jurisdiction's rules.
If processing occurs in the context of an EU establishment, or an out-of-EU controller or processor offers goods or services to people in the Union or monitors their behavior there, apply the GDPR Article 3 test and then map lawful basis, rights, breaches, transfers, and records.
If processing occurs in Brazil, concerns an offer or service to individuals in Brazil or data of individuals located there, or uses personal data collected in Brazil, apply the Article 3 test and then check its Article 4 exclusions.
How should teams decide between EU GDPR and Brazil LGPD for compliance planning?
Make the GDPR decision first: scope, role, Article 6 basis, rights workflow, processor contract, breach route, transfer mechanism, and records.
Make a separate decision for scope, controlador or operador role, Article 7 or 11 basis, rights workflow, incident route, transfer mechanism, and evidence.
For EU-Brazil transfers, record the direction of transfer and the adequacy decision used; apply another valid mechanism where the transfer falls outside its scope.
Calendar GDPR and rights and incident clocks separately even when one operational team handles both.
GDPR applies to processing in the context of an EU establishment and can reach non-EU controllers or processors that offer goods or services to people in the Union or monitor their behavior there. applies regardless of headquarters or data location when processing occurs in Brazil, the activity offers or supplies goods or services to individuals in Brazil or processes data of individuals located there, or the personal data was collected in Brazil, subject to its exclusions.
Article 4 excludes processing by a natural person for exclusively private, non-economic purposes; processing for exclusively journalistic or artistic purposes; and specified processing for academic purposes, although Articles 7 and 11 still apply to the academic case. It also excludes processing exclusively for public security, national defence, State security, or criminal investigation and prosecution, which is assigned to specific legislation, and narrowly defined foreign-origin data that is not communicated or shared with Brazilian processing agents or transferred onward outside its country of origin when that country provides adequate protection. These exclusions depend on the purpose and facts, not the organisation's label.
Both laws regulate personal-data processing, but their terms must stay separate. GDPR uses controller and processor. uses controlador and operador, with agentes de tratamento covering both. The factual allocation may align, but the contract, instruction, responsibility, and regulator-facing records must cite the applicable regime. This page supports planning; a fact-specific scope or exclusion conclusion may need advice in the relevant jurisdiction.
Write separate GDPR Article 3 and Article 3 scope findings.
Map GDPR controller or processor roles and controlador or operador roles from the actual decisions and instructions.
Apply the exclusions in each law rather than assuming that an exclusion in one regime carries across; keep the purpose, actor, territory, data origin, sharing, and onward-transfer facts that support the conclusion.
Keep one processing inventory only if every legal field is labelled EU, Brazil, or shared fact, with an owner and approval date.
Reassess scope when an establishment, target population, monitoring activity, processing location, data-collection location, purpose, role, or onward transfer changes.
GDPR Article 6 provides six lawful bases for ordinary personal data, with separate Article 9 conditions for special categories. Article 7 provides ten bases for personal data, including consent, legal or regulatory obligation, public policy, research, contract-related necessity, exercise of rights, protection of life, health protection, legitimate interests, and credit protection; sensitive personal data follows Article 11.
Sensitive personal data under includes data about racial or ethnic origin, religious conviction, political opinion, trade-union or religious, philosophical, or political-organisation membership, health or sex life, and genetic or biometric data linked to a natural person. GDPR special-category data is similar but not identical, and each law has its own permitted conditions. Do not carry an Article 9 GDPR conclusion into an Article 11 LGPD record without a separate test.
Rights also differ. GDPR generally requires action within one month, subject to its extension rules. Under Article 19, confirmation of processing or access must be provided immediately in simplified form or by a clear and complete statement within 15 days. The request type, identity checks, exceptions, response form, and regulator route must remain jurisdiction-specific.
Controller or controlador: approve and retain the separate GDPR and scope, role, purpose, data-category, legal-basis, rights, retention, security, and transfer decisions.
Processor or operador: retain the applicable instructions, contract, sub-processing approvals, security evidence, assistance record, and any issue escalated to the deciding party.
Rights team: use one intake queue only if it preserves the applicable right, identity check, receipt time, deadline, response form, exception, action taken, and delivery evidence.
Privacy owner: keep GDPR RoPA, DPIA, and Article 28 evidence distinct from processing records, impact reports, and operador instructions where the required legal content differs.
GDPR transfer work starts with Chapter V. international transfers follow Articles 33 to 36 and ANPD Resolution No. 19/2024, which includes adequacy and contractual mechanisms. Commission Implementing Decision (EU) 2026/179 permits covered transfers from EU controllers and processors to controllers and processors in Brazil without further authorization. ANPD Resolution No. 32/2026 recognizes EU Member States, the EEA EFTA states, and EU institutions, bodies, and agencies for covered transfers from Brazil.
The two adequacy decisions have limits. The ANPD decision excludes transfers exclusively for public security, national defence, State security, or criminal investigation and prosecution and requires reassessment within four years. Both authorities monitor continued protection and can revise the decisions. Record the transfer direction, exporter and importer, covered data and purpose, decision relied on, excluded activity check, and monitoring owner; re-check the record if the flow, purpose, recipient, law, or adequacy status changes.
Incident clocks differ. GDPR controllers notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after awareness unless the breach is unlikely to risk individuals. Under ANPD Resolution No. 15/2024, the controlador must notify the ANPD and affected data subjects within three business days when the incident may cause relevant risk or damage, unless specific legislation sets another period. A shared technical investigation does not merge the thresholds or clocks.
Keep the GDPR breach awareness time, risk assessment, notification decision, delay reason, and remedial action in the breach file.
For EU-Brazil transfers, record which adequacy decision covers the direction of transfer and re-check its scope before relying on it.
For other transfers, select the applicable Article 33 mechanism and follow current ANPD transfer rules.
For Brazil incidents, record awareness, the relevant-risk-or-damage assessment, three-business-day notifications, any staged submission, and the five-year incident record.
Sorena can help separate GDPR and LGPD conclusions, assign owners, and maintain evidence records for lawful basis, rights, transfers, breach handling, and operator accountability.
Official EU decision permitting covered transfers from EU controllers and processors to controllers and processors in Brazil without further authorization and establishing ongoing monitoring and review.