LGPD - the Brazilian GDPR

LGPD (Lei Geral de Proteção de Dados Pessoais) - is meant to replace this segmented legal landscape with a general regulatory framework that encompasses all others.

The role of the LGPD is to give people in Brazil a set of general rights, in a simplified manner that will replace the sectorally applied laws that are in force today. The set of laws is modeled according to the General Data Protection Regulation of the European Union, the similarities between these two being obvious and easy to observe.

This similarity led to the assignment of a new name to the LGPD, that of the "Brazilian GDPR". This resemblance is not exaggerated at all, because if you are following the provisions of the GDPR, you can almost breathe a sigh of relief, because most of them are also found in the LGPD. 

However, there are some differences. So it is important to study the provisions of the LGPD and the differences between this law and the GDPR. In this way, you will not be surprised when the provisions of the LGPD come into force.

To make this process easier for you, we will list below the significant differences between LGDP and GDPR. But first, we will present to you what LGPD is and in which cases it applies exactly.

LGPD brings much-needed clarifications to the Brazilian legal framework. LGPD aims to unify more than 40 different statutes that currently legislate personal data by replacing certain regulations and supplementing others. This unification of previously dispersed and often contradictory regulations is just a similarity it shares with the EU General Data Protection Regulation, the document from which it was inspired.

The LGPD focuses on the national specifics, illustrated by the fact that the legal basis of this data protection law are based on liability, limitation of purposes, minimization of data processing, security and privacy.

Article 18 explains the nine fundamental rights that data subjects have, namely:

• The right to consent to data processing;
• The right to access information;
• The right to correct inaccurate, outdated or incomplete data;
• The right to delete, anonymize or block unnecessary data that is not processed in accordance with the LGPD;
• The right to data portability to another service or product provider, by express request;
• The right to delete personal information processed with the agreement of the data subject;
• The right to information about public and private entities with which the controller shared personal data;
• The right to information about the possibility of refusing the agreement and the consequences of such denial;
• The right to revoke the data processing agreement.

 Although the GDPR is known for granting data subjects eight fundamental rights, they do not differ much from those mentioned by the LGPD. The main difference is that the LGPD explicitly mentions “The right to information about public and private entities with which the controller has shared data” while “GDPR” has formulated this right in a more general manner, namely “The right to be informed ”. 

LGPD law does not apply in the following cases:

• A person who processes data for personal purposes;
• Where the data are academic, journalistic and artistic;
• Whether information should be used for public safety, national security, criminal investigations, national defense.

There are many similarities between LGPD and GDPR. One of these is that LGPD, like GDPR, has global applicability, as any website that processes personal data from individuals in Brazil is required to comply with it. However, there are some differences as well.

LGPD vs GDPR - legal basis for processing data

Probably the most significant difference between LGPD and GDPR relates to what qualifies as a legal basis for data processing. The GDPR has six legal bases for processing, and a data controller must choose one of them as a justification for using a data subject's information. Unlike the GDPR, the LGPD mentions a list of 10 legal reasons for data processing:

• With the consent of the data subject;
• To follow a legal or administrative commitment of the controller;
• To execute public policies provided for in laws or regulations based on contracts, agreements or similar documents;
• For the performance of studies did by research entities that guarantee, whenever possible, the anonymization of personal information;
• To perform a contract or preliminary proceedings relating to a contract to which the data subject is a party, at the request of the data subject;
• Exercising rights in judicial, administrative or arbitration proceedings;
• To protect the life or physical security of the data subject or a third party;
• To protect health, in a procedure carried out by health professionals or healthcare entities;
• To fulfill the legitimate interests of the controller or a third party, unless the fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail;
• To protect credit (referring to a credit score).

Credit protection as a legal basis for data processing is a major difference from the GDPR.

It needs to be noted however that the legal decision against SCHUFA, Germany's largest credit agency, indicates that these agencies operate in violation of GDPR.

The LGPD imposes an obligation on companies to have a Data Protection Officer (DPO), while this is only required in certain circumstances in the GDPR.

The time limits for notifying data breaches are clearly defined in the GDPR as 72 hours, while the LGPD freely provides for data breaches to be reported to the authorities in a "reasonable time".

LGPD vs GDPR - territorial applications

The LGPD treats the international transfer of personal data similarly to the General Data Protection Law, assessing whether the foreign country has an adequate level of data security laws. And, of course, based on the prior, explicit and express consent of the data subject.

However, the LGPD (unlike the GDPR) does not apply to the transmission of data through Brazil without further processing.

In this global context in which personal data becomes an essential aspect of internet privacy, it is very important that your website and your analytics tool comply with all these provisions.

TWIPLA is 100% GDPR & CCPA & LGPD compliant. We use an independent cookieless tracking system that has received various awards. The website owner is the sole owner of the information and is in absolute control of it. There is no cross-tracking and we do not sell data to third parties. 

You can read more about our data privacy policy in the Legal, Data Privacy and Certificates section.