Does the LGPD apply to a company outside Brazil?

Yes, when data is handled in Brazil, when it is collected in Brazil, or when the company offers goods and services to people located in Brazil. Like the GDPR, the LGPD applies by where the person is and where the data is used, not by where the company sits.

What's the biggest practical difference?

Day to day, the breach-notice deadline and the size of the fine. The GDPR requires notifying the authority within 72 hours and penalises up to 4% of worldwide turnover; the LGPD allows up to 3 business days and caps the fine at 2% of Brazilian revenue, up to BRL 50 million. For big customers, the GDPR's stricter bar tends to pull the whole project's standard up.

Do I need a DPO under both laws?

Both ask for the role, under different conditions. The GDPR requires a DPO in defined cases, such as large-scale use of sensitive data. The LGPD requires appointing a DPO, and the ANPD waives small companies in certain situations. In practice, a company serving both countries usually keeps one DPO answering to both laws.

Do SOC 2 or ISO 27001 already cover the LGPD and GDPR?

They help, but don't replace them. SOC 2 and ISO 27001 handle information security, and much of the controls they ask for serve as proof for the LGPD and GDPR. But data laws require things security doesn't cover: recording which data you use, having a valid reason, answering people's requests and appointing the DPO. One completes the other.

Data protection

GDPR vs LGPD

Brazil's LGPD was inspired by Europe's GDPR, so if you comply with one you have already covered most of the path to the other. The principles, people's rights and the logic of when you may use a piece of data are nearly the same. The differences that matter live in the daily detail: how much the fine costs, how long you have to report a breach, how many reasons the law accepts for using data, and which body enforces.

See compliance and DPO Jump to the comparison

In short

Same family: principles, people's rights and reasons for using data are nearly identical.
The differences are practical: the fine, the notice deadline, how many legal bases there are, and which body enforces.
Both apply to companies outside the country when the data belongs to people located there.
If you serve both countries you don't run two projects: you run one and adjust the points where the laws differ.

Side by side

The differences that change operations

What to compare	GDPR	LGPD
Where it comes from	Regulation (EU) 2016/679, in force since 2018.	Law No. 13,709/2018, in force since 2020, with fines since 2021.
Who enforces	One data-protection authority per country, joined by a European board.	The ANPD, a single national authority for all of Brazil.
Fine	Up to €20 million or 4% of worldwide turnover, whichever is higher.	Up to 2% of Brazilian revenue, capped at BRL 50 million per infraction.
Reasons for using data	Six reasons set out in law.	Ten reasons, including protecting health and protecting credit.
Breach notice	Notify the authority within 72 hours of finding out.	Notify the ANPD within 3 business days (ANPD Resolution No. 15/2024).
Data protection officer (DPO)	Mandatory in cases defined by the law.	You must appoint one, and the ANPD waives small companies in certain cases.
Sending data abroad	Depends on a country deemed safe, on standard clauses, or on internal group rules.	Depends on a country deemed safe or on standard clauses approved by the ANPD.
When it applies	When you offer goods and services to people in Europe or track their behaviour.	When data is handled in Brazil, collected in Brazil, or you offer something to people in Brazil.

People's rights (access, correction, deletion, taking their data elsewhere, and objecting) are similar under both laws, with minor differences in name and response deadline.

The European law

GDPR

It has been the world reference for data protection since 2018, and inspired much of the law that came after it, including the LGPD. It carries the heaviest fine, the shortest notice deadline (72 hours) and a network of national authorities that work together. It applies to any company that offers goods or services to people in Europe, or tracks their behaviour, even without an office there.

Fines up to €20 million or 4% of worldwide turnover
Breach notice to the authority within 72 hours
Six set reasons for using data
One authority per country, joined by a European board

The Brazilian law

LGPD

It brought the same logic as GDPR to Brazil, with local adjustments: more reasons for using data, a single authority (the ANPD) and a fine ceiling in reais. The notice deadline was set by the ANPD in 2024. For a company already compliant with GDPR, the LGPD effort is smaller, but not zero: there are differences in reasons, in sending data abroad and in deadlines that need to be settled.

Fines up to 2% of Brazilian revenue, capped at BRL 50 million
Notice to the ANPD within 3 business days
Ten set reasons for using data
A single national authority (the ANPD)

How they relate

One project, two framings

A company handling the data of people in Europe and in Brazil doesn't need two privacy projects. The base is the same: knowing which data you use and why, answering people's requests, handling breaches, keeping security and having a DPO. What changes is the top layer: the deadlines, the fine ceilings, the way you send data abroad and the body that enforces. The smart move is to build one project and note each law's differences, rather than repeating everything twice.

The data map, the reasons for use and people's rights serve both laws
Notice deadlines and fine ceilings are specific to each one
Sending data between Brazil and Europe needs attention in both directions

Which is your case

What to prioritise

You serve customers or users in Brazil

LGPD is your floor

Start by noting which data you use and why, and by appointing the DPO. It is what the ANPD looks at first, and the base for everything else.

You offer services to people in Europe

GDPR comes into play

Even without an office there. Set the notice deadline to 72 hours and review how you send data outside the country.

You serve both countries

One project, with the differences noted

Build the common base once and note what each law asks on top. It is cheaper and avoids the confusion of keeping two separate projects.

Numbers that matter

€20M / 4%

GDPR fine ceiling (the higher of the two)

BRL 50M

LGPD fine ceiling, per infraction

72h vs 3 days

notice deadline: GDPR vs LGPD

How DM11 helps

LGPD and GDPR compliance, with DM11's DPO as a service

We build the privacy project that serves both countries: the data map, the reasons for use, handling people's requests, care with breaches and the DPO. Where the laws differ, we note it and adjust, so you don't keep two projects.

One project covers Brazil and Europe, so you don't build or pay for two teams
We take on the DPO role, freeing your team for the business
You cut the risk of a fine and answer regulators with the paperwork ready
Closing deals gets easier: the customer sees their data is in good hands

Explore IT GRC

Frequently asked

What people ask before deciding

Answers anchored in Brazil's Law 13,709/2018 and Regulation (EU) 2016/679.

Largely, yes, but not fully. The base is the same, so the data map, the reasons for use, people's rights and the DPO will already be in place. What's left are the adjustments: the LGPD accepts ten reasons for using data instead of six, the notice deadline is different, sending data abroad goes through the ANPD, and the fine ceiling is in reais. It is a tune-up, not a new project.

Build a privacy project that serves both countries

A short conversation shows your standing under both laws and how far the path runs. No commitment.

Talk to a specialist Explore IT GRC

GDPR vs LGPD

What to compare

GDPR

LGPD

Where it comes from

Regulation (EU) 2016/679, in force since 2018.

Law No. 13,709/2018, in force since 2020, with fines since 2021.

Who enforces

One data-protection authority per country, joined by a European board.

The ANPD, a single national authority for all of Brazil.

Fine

Up to €20 million or 4% of worldwide turnover, whichever is higher.

Up to 2% of Brazilian revenue, capped at BRL 50 million per infraction.

Reasons for using data

Six reasons set out in law.

Ten reasons, including protecting health and protecting credit.

Breach notice

Notify the authority within 72 hours of finding out.

Notify the ANPD within 3 business days (ANPD Resolution No. 15/2024).

Data protection officer (DPO)

Mandatory in cases defined by the law.

You must appoint one, and the ANPD waives small companies in certain cases.

Sending data abroad

Depends on a country deemed safe, on standard clauses, or on internal group rules.

Depends on a country deemed safe or on standard clauses approved by the ANPD.

When it applies

When you offer goods and services to people in Europe or track their behaviour.

When data is handled in Brazil, collected in Brazil, or you offer something to people in Brazil.

GDPR

Fines up to €20 million or 4% of worldwide turnover

Breach notice to the authority within 72 hours

Six set reasons for using data

One authority per country, joined by a European board

LGPD

Fines up to 2% of Brazilian revenue, capped at BRL 50 million

Notice to the ANPD within 3 business days

Ten set reasons for using data

A single national authority (the ANPD)

One project, two framings

The data map, the reasons for use and people's rights serve both laws

Notice deadlines and fine ceilings are specific to each one

Sending data between Brazil and Europe needs attention in both directions

LGPD and GDPR compliance, with DM11's DPO as a service

One project covers Brazil and Europe, so you don't build or pay for two teams

We take on the DPO role, freeing your team for the business

You cut the risk of a fine and answer regulators with the paperwork ready

Closing deals gets easier: the customer sees their data is in good hands