The LGPD compliance software to future-proof your business

There are some exceptions to the applicability of LGPD. It does not apply if:

• Processing of personal data is carried out by a natural person for private and non-commercial purposes or
• Personal data is processed exclusively for one of the following purposes:
  • Journalistic or artistic expression,
  • Academic research,
  • Public safety,
  • National defence and security,
  • Investigation and prosecution of criminal offences

LGPD limits the transfer of personal data outside Brazilia unless the countries or organizations data is transferred to can provide an adequate level of protection of personal data. Data transfer is also permitted when it occurs within the means of Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs) or by global corporate norms.

The law also recognises other grounds for transferring personal data outside Brazil, for international legal cooperation between government agencies or if the transfer is carried out with the consent of the data subject.

Brazilian Data Protection Authority (ANPD) is the supervisory authority for the interpretation, application and enforcement of LGPD. Under the LGPD, ANPD has the authority to issue guidance and procedures concerning data protection and has investigatory powers to monitor data processing activities and issue sanctions in case of non-compliance.

The ANPD also has corrective powers such as issuing warnings and fines, publicising the violation and blocking the processing of personal data relating to the violation.

The LGPD was influenced by the European Union’s General Data Protection Regulation (GDPR) and has borrowed key concepts from European law. But LGPD has expanded its coverage in some areas, for instance, LGPD established four additional legal bases for processing personal data than the GDPR.

LGDP differs from GDPR in the details. Although both regulations require data breach notifications, GDPR has a stricter timeline of 72 hours for reporting while LGPD does not provide a definite timeline for breach notifications. Under the LGPD, controllers must appoint a DPO, but it is not an explicit requirement for data processors, while in GDPR, both controllers and processors must appoint a data protection officer (‘DPO’) in specific circumstances.

Here are some links you can refer to for additional reading:

• Official Text of LGPD (in Portuguese)
• Simplified Guide on Brazil’s LGPD