LGPD vs GDPR — three differences
(1) LGPD has ten legal bases (Article 7) — including "credit protection" relevant for fintechs and "study or research by research bodies". GDPR has six. (2) The encarregado (DPO) is mandatory for more controllers under LGPD. (3) International transfers operate under ANPD's Resolution CD/ANPD No. 4/2023, which closely mirrors the EU SCCs but with Brazilian-specific clauses.
Data subject rights (Article 18)
- Confirmation that processing exists
- Access to the data
- Correction of data
- Anonymisation, blocking or deletion
- Portability
- Deletion of data processed with consent
- Information about data sharing
- Information about the consequences of refusing consent
- Revocation of consent
ANPD enforcement timeline
ANPD published its first sanction regulation in 2023 and issued its first fines in 2023–2024. Most enforcement to date has targeted unauthorised data sharing and missing legal basis documentation rather than missing privacy policies.