GDPR and LGPD are data protection regulations that Brazilian companies should understand to operate securely in a variety of business situations.
The GDPR — General Data Protection Regulation — is a set of information‑security rules adopted by the European Union in 2018 and served as a model for Brazil’s LGPD — Lei Geral de Proteção de Dados — which has been in force since 2020.
But why should Brazilian companies follow GDPR rules if they are not located in the EU?
Read on to find out.
Table of contents
Why should Brazilian companies comply with GDPR rules?
GDPR and LGPD are equally important for Brazilian companies for two main reasons:
- Exporting products and services.
- Handling data of companies based in the EU.
Here’s what each of these means:
As a rule, companies anywhere (including Brazilian ones) must respect GDPR rules when they interact with citizens of the European Union.
This includes activities such as exporting products or services, e‑commerce businesses that sell to European customers, or providing access to digital products located in Brazil (for example, an online course), among many other commercial relationships.
Another reason Brazilian companies must consider GDPR rules is when they collect and process the personal data of European citizens.
A company that operates digitally is responsible for protecting the personal data it holds, including information about customers and suppliers.
If personal data are stolen or leaked, the company may be held responsible for the security failure and face penalties and fines. That’s why Brazilian companies should understand the GDPR parameters.
The same applies to foreign companies operating in Brazil: organizations that deal with Brazilian citizens’ data are subject to the LGPD and may face penalties for non‑compliance.
Does your agency comply with the LGPD? Watch the webinar we created to find all the information you need on this topic!
GDPR and LGPD: similarities and differences
Fines and penalties
In cases of non‑compliance with the LGPD, LGPD companies can face sanctions and fines of up to 2% of a company’s revenue, capped at R$50 million per administrative proceeding. The full description is in Article 52 of the LGPD.
Under the GDPR, companies that fail to comply can be fined up to 4% of annual turnover or €20 million per proceeding. See Article 83 of the GDPR for details.
Supervisory authorities for GDPR and LGPD
In Brazil, the National Data Protection Authority — Autoridade Nacional de Proteção de Dados (ANPD) — is responsible for enforcing the LGPD.
In the EU, the European Data Protection Board — EDPB (Comitê Europeu de Proteção de Dados in Portuguese) — is the coordinating body for data protection supervision under the GDPR.
Personal data and sensitive personal data
Under the LGPD, personal data are any information that identifies or can identify an individual, such as full name, RG and CPF numbers, and can include email addresses and telephone numbers.
Sensitive personal data concern more intimate aspects of an individual, such as political opinions, sexual orientation, religious convictions, and similar information.
The GDPR and LGPD differ on some points concerning personal data, but they align closely on sensitive personal data: these types of data generally require the user’s explicit consent when collected.
That protects users at the point of collection, but protecting signup forms involves more than obtaining consent.
You should also guard against common typing errors that result in invalid email addresses — for example, mistyping “Gamil” instead of “Gmail.”
Protect your email lists with Real-time verification API SafetyMails.
GDPR and LGPD: data deletion
Both laws give users the right to have their personal data erased in whole or in part from online services. They also provide the right to correct inaccurate data at the data subject’s request.
In the GDPR, these rights are described in Articles 12–23; in the LGPD, see Article 18.
Data of children and adolescents
Both the GDPR and the LGPD require parental or guardian consent before collecting personal data from minors.
In Brazil, a minor is defined as someone under 18; see Article 14 of the LGPD.
In the EU, the GDPR sets the reference age for consent at 16 years; see Article 8 of the GDPR.
Specialized professional
The presence of a Data Protection Officer (DPO) is generally required for companies that collect and process personal data at scale.
In summary, this professional is responsible for overseeing the company’s information‑security and compliance efforts, both legal and technical (including cybersecurity).
Both laws provide for a DPO in certain circumstances; in Brazil, however, small companies and startups may be exempt or have different obligations.
Conclusion
Data protection is essential to prevent poor data management from harming individuals.
At the same time, citizens rely on legal protection to prevent their privacy from being invaded or commercialized.
And speaking of protection: digital marketers should use email validation.
Email validation helps protect lists from spamtraps, bounces, and other risky addresses that can severely damage email‑marketing performance.
Open your account for free and watch your email‑marketing results take off!
FAQ
Why is it important for Brazilian companies to know the GDPR?
Any company that deals with European citizens should be familiar with the GDPR, because e‑commerce, exports, and other commercial interactions involve EU residents. Brazilian companies that collect or process the personal data of EU citizens also need to comply with EU data‑protection rules.
What are the main fines of GDPR and LGPD?
Under the LGPD, infringements can lead to fines of up to 2% of a company’s revenue, limited to R$50 million per administrative proceeding. Under the GDPR, fines can reach up to 4% of annual turnover or €20 million per proceeding.
What are personal data and sensitive data?
Personal data are information that can identify an individual, such as name, RG and CPF. Sensitive personal data concern intimate aspects like religious convictions or sexual preferences.
What is DPO?
The Data Protection Officer is the professional responsible for monitoring whether a company complies with the GDPR or the LGPD. Both laws provide for a DPO in certain cases; in Brazil there can be exceptions for small companies and startups.
