LGPD vs GDPR: Key Differences That Change Compliance

Six concrete deltas: (1) re-map lawful bases to the ten LGPD grounds, moving credit, litigation, health, and research processing to their named bases; (2) shorten the DSR clock, full access responses in 15 days; (3) appoint and publish an encarregado (DPO) regardless of company size, per Resolution 18/2024; (4) execute Brazilian transfer instruments under Resolution 19/2024, EU SCCs alone do not work; (5) align breach response to the ANPD's 3-working-day notification; (6) translate notices into Portuguese where you address the Brazilian public. Everything else largely inherits.

The LGPD's Article 7 adds credit protection, health protection, research, and judicial/administrative/arbitral proceedings to the GDPR's six. Legitimate interest exists in both but Brazil bars it entirely for sensitive data (GDPR handles sensitive data through Article 9 conditions instead). Consent standards are near-identical (free, informed, unambiguous, specific), but the LGPD demands 'specific and highlighted' consent for sensitive data and voids generic authorizations explicitly. Brazil's Article 20 automated-decision right is a review right, weaker than GDPR Article 22's qualified prohibition.

GDPR: up to 4% of worldwide turnover, with cumulative fines against single companies exceeding EUR 2.7 billion (Meta alone), and 27+ national regulators enforcing. LGPD: up to 2% of Brazil revenue capped at R$50 million per infraction, one central regulator (ANPD) that started fining in 2023 and prefers preventive orders, the 2024 Meta AI-training suspension being the model. Brazil adds daily fines, mandatory publicization of the infraction, and data blocking or deletion, sanctions that can hurt more than the capped fine. Courts and consumer bodies (Procons, public prosecutors) provide a second enforcement track Brazil-side.

GDPR Article 33: notify the supervisory authority within 72 hours of awareness where there is risk, and data subjects without undue delay for high risk. LGPD Article 48 originally said 'reasonable time'; the ANPD's breach regulation (Resolution 15/2024) fixed it at 3 working days for incidents involving relevant risk or harm, with a prescribed content list, and communication to affected data subjects in the same window. The Brazilian form and risk analysis differ from EU templates, so incident-response runbooks need a Brazil branch, not just a CC to the DPO.

One pipeline, two configurations. The notice needs a Brazil layer: Portuguese language for the Brazilian public, the LGPD basis per purpose (naming credit protection or proceedings where used), the encarregado's published contact, and Brazilian transfer mechanisms. The DSAR pipeline needs a jurisdiction switch on the clock (15 days versus one month) and on scope (LGPD includes an explicit right to information about the consequences of denying consent, and anonymization as a remedy). Companies that run the strictest-common-denominator, 15-day responses everywhere, avoid the switch entirely.