Artifact GuideBrazil and European UnionLGPD vs GDPR
LGPD vs GDPR What privacy teams must separate
and share many privacy concepts, but their territorial tests, legal grounds, roles, deadlines, impact-assessment triggers, incident rules, transfer mechanisms, and sanctions are not interchangeable.
Use one processing inventory, then record a separate Brazil and EU conclusion for every rule that changes the owner, deadline, evidence, or outcome.
and programmes can share inventories, privacy notices, rights tooling, vendor governance, security controls, and assessment methods. They cannot share legal conclusions by default. LGPD applies through its Brazil-focused Article 3 tests; GDPR applies through EU establishment, offering, or monitoring tests. Each law also has its own legal grounds, role definitions, request periods, incident thresholds, transfer mechanisms, and enforcement system.
Side-by-side comparison
LGPD vs GDPR: practical compliance comparison
Read each row against the same processing activity. The implication column states what the implementation record should decide or preserve.
Brazil's law applies through Article 3 connections to Brazil and regulates processing through principles, legal bases, rights, controller and operator duties, security, and transfer rules.
Second framework
GDPR
The EU regulation applies through establishment, offering, or monitoring tests and imposes its own controller, processor, accountability, rights, security, transfer, and supervisory-authority rules.
applies when processing takes place in Brazil, targets the offer or supply of goods or services to people in Brazil or processes data of people located there, or concerns data collected while the person was in Brazil. Article 4 then excludes specified activities.
Articles 3 and 4 establish the LGPD application tests and exclusions.
aplica-se a qualquer operação de tratamento realizada por pessoa natural ou por pessoa jurídica
applies to processing in the context of an EU establishment. It can also apply to an organization outside the EU when processing relates to offering goods or services to or monitoring people in the Union. Article 2 contains material-scope exclusions.
Articles 2 and 3 establish GDPR material and territorial scope.
This Regulation applies to the processing of personal data
Write separate territorial and material-scope findings. A Brazil collection or location link is not the same as an EU establishment, offering, or monitoring link.
The controller makes decisions about personal-data processing; the operator processes according to the controller's instructions. Article 41 addresses the encarregado, while ANPD rules can provide exemptions or further conditions.
Articles 5, 39, and 41 define controller, operator, and encarregado responsibilities.
controlador: pessoa natural ou jurídica, de direito público ou privado, a quem competem as decisões referentes ao tratamento de dados pessoais
distinguishes controller, joint controllers, processor, and, where required, an EU representative. Articles 37-39 require a DPO only for the stated public-authority, regular-and-systematic-monitoring, or large-scale special-category or criminal-data triggers, subject to other Union or Member State law.
Articles 4, 26-28, and 37-39 define GDPR roles, contracts, and DPO triggers.
‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means
Classify roles from actual decisions, instructions, establishment, and statutory triggers. Operador is not automatically identical to processor, and encarregado and DPO appointment rules differ.
Each purpose needs an Article 7 basis for personal data or an Article 11 condition for sensitive personal data. The lists are not identical to , and LGPD legitimate interest applies only to non-sensitive personal data under Article 7.
Articles 7 and 11 list the LGPD grounds for personal and sensitive personal data.
O tratamento de dados pessoais somente poderá ser realizado nas seguintes hipóteses
requires an Article 6 basis and, when Article 9 special-category data is processed, an Article 9 exception as well. Criminal-conviction and offense data follows Article 10. Consent is one possible route, not a universal default.
Articles 6, 9, and 10 establish GDPR lawful bases and additional conditions for special-category and criminal-offense data.
Processing shall be lawful only if and to the extent that at least one of the following applies
Keep a purpose-by-purpose basis record for each law. Do not map basis labels by name alone; compare the conditions, balancing, documentation, and withdrawal consequences.
Article 18 includes confirmation, access, correction, anonymization, blocking or deletion in specified circumstances, portability subject to regulation, sharing information, consent information and withdrawal. Article 20 separately covers review of qualifying solely automated decisions. Article 19 requires simplified confirmation or access immediately, or a complete declaration within 15 days; other rights do not all share that period.
Articles 18 and 19 define LGPD rights and the immediate or 15-day access formats.
O titular dos dados pessoais tem direito a obter do controlador
Articles 15-22 cover access, rectification, erasure, restriction, portability, objection, and automated-decision rights, subject to their conditions and exceptions. Article 12 generally requires action within one month, extendable by two further months when necessary if the controller gives notice and reasons within the first month.
Articles 12 and 15-22 establish GDPR rights, conditions, response timing, and extension rules.
The controller shall provide information on action taken on a request under Articles 15 to 22
A shared request portal needs law-specific request types, identity checks, exceptions, extensions, response content, and clocks. Do not apply 15 days to every right or one month to every privacy-law interaction.
controllers and operators must keep processing records, especially for legitimate-interest processing. The ANPD may require a data-protection impact report in the circumstances stated by Articles 10(3), 32, or 38; the statute does not create a blanket automatic report for every activity labeled high risk.
Articles 10(3), 32, 37, and 38 address processing records and circumstances in which the ANPD may request an impact report.
O controlador e o operador devem manter registro das operações de tratamento de dados pessoais que realizarem
Article 30 requires records of processing subject to its limited exemption. Article 35 requires a before processing likely to result in high risk, including the listed examples, and Article 36 requires prior consultation when unmitigated high risk remains.
Articles 30, 35, and 36 establish GDPR records, DPIA triggers, content, and prior consultation.
Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility
A shared inventory can feed both regimes, but keep the law-specific record fields, exemption conclusion, assessment trigger, approval, residual-risk decision, and regulator interaction.
requires technical and administrative security measures. A controller must notify the ANPD and affected data subjects when an incident may cause relevant risk or damage. Resolution 15/2024 sets a three-business-day period, subject to a shorter period in specific legislation, and permits staged communication when information is incomplete.
Official ANPD guidance states the three-business-day notification period under Resolution 15/2024 and explains staged reporting.
requires risk-appropriate security. A controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of awareness unless the breach is unlikely to create risk. It must notify affected people without undue delay when high risk is likely, subject to Article 34 exceptions.
Articles 32-34 establish GDPR security, supervisory notification, and data-subject communication rules.
without undue delay and, where feasible, not later than 72 hours after having become aware of it
Use separate documented risk tests and clocks. One law's decision not to notify does not settle the other law, and sectoral or national rules may add duties.
An international transfer needs an Article 33 mechanism and an Article 7 or 11 basis for the underlying processing. Resolution 19/2024 governs adequacy and contractual mechanisms; when using ANPD standard clauses, the approved text must be adopted integrally and without alteration for the mechanism to be valid.
The official regulation governs adequacy and contractual transfer mechanisms and requires integral, unaltered adoption of the ANPD standard clauses when that mechanism is used.
A transfer to a third country or international organization must satisfy Chapter V, such as an adequacy decision, appropriate safeguards under Article 46, binding corporate rules, or a narrowly interpreted Article 49 derogation. EU standard contractual clauses do not remove the need to assess the transfer circumstances.
Articles 44-49 establish GDPR international-transfer routes and conditions.
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country
Identify exporter, importer, destination, onward transfers, processing basis, transfer mechanism, supplementary measures where required, and contract version under each law. One regime's clauses do not automatically satisfy the other.
The ANPD may apply Article 52 administrative sanctions through the applicable administrative process. also preserves judicial, consumer-law, sector-regulator, contractual, and civil-liability routes; an ANPD outcome does not resolve every other route.
Articles 42-45 and 52 address civil responsibility, consumer-law preservation, and administrative sanctions.
ficam sujeitos às seguintes sanções administrativas aplicáveis pela autoridade nacional
Independent EU supervisory authorities have investigative and corrective powers. Depending on the infringement, Article 83 provides upper tiers of EUR 10 million or 2% of worldwide annual turnover, and EUR 20 million or 4%, whichever applicable amount is higher; remedies and Member State law also matter.
Articles 58, 79, 82, 83, and 84 establish supervisory powers, judicial remedies, compensation, administrative-fine tiers, and other penalties.
be subject to administrative fines up to 20 000 000 EUR
Do not compare maximum figures as predicted penalties. Record the competent authority, infringement, affected processing, procedure, aggravating and mitigating facts, possible remedy, and applicable national law.
Run the workstream when Article 3 applies: document the purpose, Article 7 or 11 basis, controller and operator roles, rights, records, security, incident assessment, and any Article 33 transfer mechanism.
Articles 3-11 and 18-52 establish the LGPD workstream summarized here.
aplica-se a qualquer operação de tratamento realizada por pessoa natural ou por pessoa jurídica
Run the workstream when Article 3 applies: document the Article 6 basis and any Article 9 condition, controller and processor roles, rights, accountability records, , incident analysis, and Chapter V transfer route.
GDPR Articles 2-49 establish the scope, processing, rights, accountability, security, and transfer workstream summarized here.
This Regulation applies to the processing of personal data
Proceed under one law, both in parallel, or neither, based on written scope findings. Shared controls can reduce duplicate work but cannot merge the legal tests.
aplica-se a qualquer operação de tratamento realizada por pessoa natural ou por pessoa jurídica
Scope and covered activity
LGPD
applies when processing takes place in Brazil, targets the offer or supply of goods or services to people in Brazil or processes data of people located there, or concerns data collected while the person was in Brazil. Article 4 then excludes specified activities.
Articles 3 and 4 establish the LGPD application tests and exclusions.
aplica-se a qualquer operação de tratamento realizada por pessoa natural ou por pessoa jurídica
GDPR
applies to processing in the context of an EU establishment. It can also apply to an organization outside the EU when processing relates to offering goods or services to or monitoring people in the Union. Article 2 contains material-scope exclusions.
Articles 2 and 3 establish GDPR material and territorial scope.
This Regulation applies to the processing of personal data
Operational implication
Write separate territorial and material-scope findings. A Brazil collection or location link is not the same as an EU establishment, offering, or monitoring link.
aplica-se a qualquer operação de tratamento realizada por pessoa natural ou por pessoa jurídica
Who must act
LGPD
The controller makes decisions about personal-data processing; the operator processes according to the controller's instructions. Article 41 addresses the encarregado, while ANPD rules can provide exemptions or further conditions.
Articles 5, 39, and 41 define controller, operator, and encarregado responsibilities.
controlador: pessoa natural ou jurídica, de direito público ou privado, a quem competem as decisões referentes ao tratamento de dados pessoais
GDPR
distinguishes controller, joint controllers, processor, and, where required, an EU representative. Articles 37-39 require a DPO only for the stated public-authority, regular-and-systematic-monitoring, or large-scale special-category or criminal-data triggers, subject to other Union or Member State law.
Articles 4, 26-28, and 37-39 define GDPR roles, contracts, and DPO triggers.
‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means
Operational implication
Classify roles from actual decisions, instructions, establishment, and statutory triggers. Operador is not automatically identical to processor, and encarregado and DPO appointment rules differ.
aplica-se a qualquer operação de tratamento realizada por pessoa natural ou por pessoa jurídica
Legal grounds and sensitive data
LGPD
Each purpose needs an Article 7 basis for personal data or an Article 11 condition for sensitive personal data. The lists are not identical to , and LGPD legitimate interest applies only to non-sensitive personal data under Article 7.
Articles 7 and 11 list the LGPD grounds for personal and sensitive personal data.
O tratamento de dados pessoais somente poderá ser realizado nas seguintes hipóteses
GDPR
requires an Article 6 basis and, when Article 9 special-category data is processed, an Article 9 exception as well. Criminal-conviction and offense data follows Article 10. Consent is one possible route, not a universal default.
Articles 6, 9, and 10 establish GDPR lawful bases and additional conditions for special-category and criminal-offense data.
Processing shall be lawful only if and to the extent that at least one of the following applies
Operational implication
Keep a purpose-by-purpose basis record for each law. Do not map basis labels by name alone; compare the conditions, balancing, documentation, and withdrawal consequences.
aplica-se a qualquer operação de tratamento realizada por pessoa natural ou por pessoa jurídica
Individual rights and response periods
LGPD
Article 18 includes confirmation, access, correction, anonymization, blocking or deletion in specified circumstances, portability subject to regulation, sharing information, consent information and withdrawal. Article 20 separately covers review of qualifying solely automated decisions. Article 19 requires simplified confirmation or access immediately, or a complete declaration within 15 days; other rights do not all share that period.
Articles 18 and 19 define LGPD rights and the immediate or 15-day access formats.
O titular dos dados pessoais tem direito a obter do controlador
GDPR
Articles 15-22 cover access, rectification, erasure, restriction, portability, objection, and automated-decision rights, subject to their conditions and exceptions. Article 12 generally requires action within one month, extendable by two further months when necessary if the controller gives notice and reasons within the first month.
Articles 12 and 15-22 establish GDPR rights, conditions, response timing, and extension rules.
The controller shall provide information on action taken on a request under Articles 15 to 22
Operational implication
A shared request portal needs law-specific request types, identity checks, exceptions, extensions, response content, and clocks. Do not apply 15 days to every right or one month to every privacy-law interaction.
aplica-se a qualquer operação de tratamento realizada por pessoa natural ou por pessoa jurídica
Evidence and records
LGPD
controllers and operators must keep processing records, especially for legitimate-interest processing. The ANPD may require a data-protection impact report in the circumstances stated by Articles 10(3), 32, or 38; the statute does not create a blanket automatic report for every activity labeled high risk.
Articles 10(3), 32, 37, and 38 address processing records and circumstances in which the ANPD may request an impact report.
O controlador e o operador devem manter registro das operações de tratamento de dados pessoais que realizarem
GDPR
Article 30 requires records of processing subject to its limited exemption. Article 35 requires a before processing likely to result in high risk, including the listed examples, and Article 36 requires prior consultation when unmitigated high risk remains.
Articles 30, 35, and 36 establish GDPR records, DPIA triggers, content, and prior consultation.
Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility
Operational implication
A shared inventory can feed both regimes, but keep the law-specific record fields, exemption conclusion, assessment trigger, approval, residual-risk decision, and regulator interaction.
aplica-se a qualquer operação de tratamento realizada por pessoa natural ou por pessoa jurídica
Security incidents
LGPD
requires technical and administrative security measures. A controller must notify the ANPD and affected data subjects when an incident may cause relevant risk or damage. Resolution 15/2024 sets a three-business-day period, subject to a shorter period in specific legislation, and permits staged communication when information is incomplete.
Official ANPD guidance states the three-business-day notification period under Resolution 15/2024 and explains staged reporting.
GDPR
requires risk-appropriate security. A controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of awareness unless the breach is unlikely to create risk. It must notify affected people without undue delay when high risk is likely, subject to Article 34 exceptions.
Articles 32-34 establish GDPR security, supervisory notification, and data-subject communication rules.
without undue delay and, where feasible, not later than 72 hours after having become aware of it
Operational implication
Use separate documented risk tests and clocks. One law's decision not to notify does not settle the other law, and sectoral or national rules may add duties.
aplica-se a qualquer operação de tratamento realizada por pessoa natural ou por pessoa jurídica
International transfers
LGPD
An international transfer needs an Article 33 mechanism and an Article 7 or 11 basis for the underlying processing. Resolution 19/2024 governs adequacy and contractual mechanisms; when using ANPD standard clauses, the approved text must be adopted integrally and without alteration for the mechanism to be valid.
The official regulation governs adequacy and contractual transfer mechanisms and requires integral, unaltered adoption of the ANPD standard clauses when that mechanism is used.
GDPR
A transfer to a third country or international organization must satisfy Chapter V, such as an adequacy decision, appropriate safeguards under Article 46, binding corporate rules, or a narrowly interpreted Article 49 derogation. EU standard contractual clauses do not remove the need to assess the transfer circumstances.
Articles 44-49 establish GDPR international-transfer routes and conditions.
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country
Operational implication
Identify exporter, importer, destination, onward transfers, processing basis, transfer mechanism, supplementary measures where required, and contract version under each law. One regime's clauses do not automatically satisfy the other.
aplica-se a qualquer operação de tratamento realizada por pessoa natural ou por pessoa jurídica
Enforcement and sanctions
LGPD
The ANPD may apply Article 52 administrative sanctions through the applicable administrative process. also preserves judicial, consumer-law, sector-regulator, contractual, and civil-liability routes; an ANPD outcome does not resolve every other route.
Articles 42-45 and 52 address civil responsibility, consumer-law preservation, and administrative sanctions.
ficam sujeitos às seguintes sanções administrativas aplicáveis pela autoridade nacional
GDPR
Independent EU supervisory authorities have investigative and corrective powers. Depending on the infringement, Article 83 provides upper tiers of EUR 10 million or 2% of worldwide annual turnover, and EUR 20 million or 4%, whichever applicable amount is higher; remedies and Member State law also matter.
Articles 58, 79, 82, 83, and 84 establish supervisory powers, judicial remedies, compensation, administrative-fine tiers, and other penalties.
be subject to administrative fines up to 20 000 000 EUR
Operational implication
Do not compare maximum figures as predicted penalties. Record the competent authority, infringement, affected processing, procedure, aggravating and mitigating facts, possible remedy, and applicable national law.
aplica-se a qualquer operação de tratamento realizada por pessoa natural ou por pessoa jurídica
Practical decision rule
LGPD
Run the workstream when Article 3 applies: document the purpose, Article 7 or 11 basis, controller and operator roles, rights, records, security, incident assessment, and any Article 33 transfer mechanism.
Articles 3-11 and 18-52 establish the LGPD workstream summarized here.
aplica-se a qualquer operação de tratamento realizada por pessoa natural ou por pessoa jurídica
GDPR
Run the workstream when Article 3 applies: document the Article 6 basis and any Article 9 condition, controller and processor roles, rights, accountability records, , incident analysis, and Chapter V transfer route.
GDPR Articles 2-49 establish the scope, processing, rights, accountability, security, and transfer workstream summarized here.
This Regulation applies to the processing of personal data
Operational implication
Proceed under one law, both in parallel, or neither, based on written scope findings. Shared controls can reduce duplicate work but cannot merge the legal tests.
aplica-se a qualquer operação de tratamento realizada por pessoa natural ou por pessoa jurídica
Practical decision rule
How to use this comparison
Decide scope first for each legal entity and processing activity; save the facts and cited conclusion.
Map purposes, roles, data categories, rights, assessments, incidents, recipients, and transfers to the relevant row.
Reuse shared systems only after documenting the law-specific branch for legal grounds, request timing, DPIAs or impact reports, incidents, transfers, and regulator interactions.
Escalate case-specific questions about establishment, targeting, monitoring, joint control, special-category data, children, transfers, or remedies to qualified counsel.
The cited GDPR provisions establish the EU-specific tests summarized in the comparison.
This Regulation applies to the processing of personal data
1
Section 1
Compare the same processing under both laws
For , test whether processing occurs in Brazil, aims to offer or supply goods or services to people in Brazil or processes data of people located there, or concerns data collected while the person was in Brazil. Then check Article 4 exclusions. For , test processing in the context of an EU establishment or, for an organization outside the EU, whether it offers goods or services to or monitors people in the Union. Then check Article 2 exclusions.
If both laws apply, document the purpose, Article 7 or 11 basis, Article 6 basis and any Article 9 condition, roles, rights, security, incident analysis, transfer mechanism, and regulator-facing evidence separately.
The commencement dates also differ. has applied since 25 May 2018; most operational provisions have applied since 18 September 2020, and LGPD administrative-sanction provisions since 1 August 2021. These are historical start dates, not grace periods for current processing.
For example, an EU establishment processing customer data in its local activities may trigger even without targeting people abroad. A service offered to people located in Brazil may trigger without a Brazilian establishment. When both facts exist, neither regulator-facing record substitutes for the other.
Write a territorial and material-scope conclusion for each entity and processing activity.
Classify controller, operator or processor, joint-controller, representative, encarregado, and DPO roles under the law that defines them.
Record each rights request, incident, or transfer under both sets of triggers and deadlines when both laws apply.
Escalate establishment, targeting, monitoring, joint-control, special-category, transfer, and exemption questions that depend on case-specific facts.
Articles 2 and 3 establish GDPR material and territorial scope.
This Regulation applies to the processing of personal data
2
Section 2
Use shared systems without merging the legal tests
Privacy or legal should own the comparison, while product, data, security, procurement, HR, marketing, and customer-support owners supply facts and operate controls. A shared request portal or processing inventory is useful only if it preserves each law's role, exception, deadline, response content, and escalation path.
For every row, retain the source provision, facts, conclusion, owner, evidence, and review trigger. Reassess when the purpose, data category, technology, market, vendor, transfer destination, or incident facts change.
Keep a separate lawful-basis record for each law; similar labels do not guarantee identical conditions.
Route requests through law-specific identity, exception, extension, and response rules.
Use distinct incident assessments: the ANPD relevant-risk-or-damage test and three-business-day period differ from 's risk and high-risk thresholds and 72-hour rule.
Identify the transfer mechanism under each law rather than assuming EU standard contractual clauses satisfy or Brazilian clauses satisfy .
The LGPD source supports the Brazil side of this comparison by defining territorial reach, processing roles, lawful bases, rights, transfers, security, and ANPD enforcement.
Articles 3 and 4 establish the LGPD territorial tests and principal exclusions.
Articles 5, 7, 11, 18, 33-41, and 46-48 support the LGPD roles, bases, rights, transfers, records, and incident analysis.
Show 11 more
Articles 3 and 4 establish the LGPD application tests and exclusions.
Supports the operational implication.
Articles 5, 39, and 41 define controller, operator, and encarregado responsibilities.
Articles 7 and 11 list the LGPD grounds for personal and sensitive personal data.
Articles 18 and 19 define LGPD rights and the immediate or 15-day access formats.
Articles 10(3), 32, 37, and 38 address processing records and circumstances in which the ANPD may request an impact report.
Articles 46-48 establish LGPD security and qualifying incident duties.
Articles 33-36 establish LGPD transfer mechanisms; Resolution 19/2024 supplies the current contractual framework.
Articles 42-45 and 52 address civil responsibility, consumer-law preservation, and administrative sanctions.
Articles 3-11 and 18-52 establish the LGPD workstream summarized here.
Supports the comparison decision rule.
"aplica-se a qualquer operação de tratamento realizada por pessoa natural ou por pessoa jurídica"
More quoted passages
"O controlador e o operador devem manter registro das operações de tratamento de dados pessoais que realizarem"
"controlador: pessoa natural ou jurídica, de direito público ou privado, a quem competem as decisões referentes ao tratamento de dados pessoais"
"O tratamento de dados pessoais somente poderá ser realizado nas seguintes hipóteses"
"O titular dos dados pessoais tem direito a obter do controlador"
"Os agentes de tratamento devem adotar medidas de segurança, técnicas e administrativas aptas a proteger os dados pessoais"
"A transferência internacional de dados pessoais somente é permitida nos seguintes casos"
"ficam sujeitos às seguintes sanções administrativas aplicáveis pela autoridade nacional"
Primary source for GDPR scope, legal grounds, roles, rights, accountability, security incidents, international transfers, remedies, and fine tiers.
Articles 2 and 3 establish GDPR material and territorial scope.
Articles 4-6, 9, 12-22, 24-39, and 44-49 support the GDPR roles, bases, rights, accountability, incident, and transfer analysis.
Show 9 more
Articles 4, 26-28, and 37-39 define GDPR roles, contracts, and DPO triggers.
Articles 6, 9, and 10 establish GDPR lawful bases and additional conditions for special-category and criminal-offense data.
Articles 12 and 15-22 establish GDPR rights, conditions, response timing, and extension rules.
Articles 30, 35, and 36 establish GDPR records, DPIA triggers, content, and prior consultation.
Articles 32-34 establish GDPR security, supervisory notification, and data-subject communication rules.
Articles 44-49 establish GDPR international-transfer routes and conditions.
Articles 58, 79, 82, 83, and 84 establish supervisory powers, judicial remedies, compensation, administrative-fine tiers, and other penalties.
GDPR Articles 2-49 establish the scope, processing, rights, accountability, security, and transfer workstream summarized here.
The cited GDPR provisions establish the EU-specific tests summarized in the comparison.
"This Regulation applies to the processing of personal data"
More quoted passages
"The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1"
"‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means"
"Processing shall be lawful only if and to the extent that at least one of the following applies"
"The controller shall provide information on action taken on a request under Articles 15 to 22"
"Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility"
"without undue delay and, where feasible, not later than 72 hours after having become aware of it"
"Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country"
"be subject to administrative fines up to 20 000 000 EUR"
Official text of the Brazilian international-transfer regulation and standard contractual clauses.
The official regulation governs adequacy and contractual transfer mechanisms and requires integral, unaltered adoption of the ANPD standard clauses when that mechanism is used.