Take-Aways (AI)
- LGPD came into force on September 18, 2020; enforcement provisions expected from August 1, 2021
- LGPD is similar to GDPR, but is not a direct adoption and contains several specific deviations.
- Territorial scope also includes processing without a Brazilian branch under certain conditions.
- Key differences: exemptions, missing clauses (e.g. contractual obligations, impact assessment thresholds), DPO obligation and fines.
Brazil enacted its new data protection law – Law No. 13,709 of August 14, 2018, General Law on Personal Data Protection (“Lei Geral de Proteção de Dados”, “LGPD”) today, September 18, 2020. Enforcement provisions are expected to enter into force on August 1, 2021.
- LGPD in Portuguese
- English translation (for members of IAPP)
- German translation (via DeepL)
- LGPD official website
The LGPD is similar to the GDPR in many respects, but is not a direct adoption.
Processing by companies without an establishment in Brazil are spatially subordinate to the LGPDwhen they:
- exported on the territory of Brazil;
- its purpose is to offer goods or services to natural persons in Brazil;
- personal data that has been obtained in Brazil. This applies if the data subject was in Brazil at the time of the acquisition – the facts therefore overlap with those of behavioral observation pursuant to Art. 3(2)(b) GDPR.
However, the LGPD contains a notable exception to the scope, which is without precedent in the GDPR: it does not apply to the processing of personal data that is
- were procured outside Brazil,
- not be transmitted across borders,
- are not the subject of communication (?), and
- not be shared with a Brazilian controller or processor; if
- the state of processing has an adequate level of protection.
Some more Differences to the GDPR, based on data from dataguidance.com:
- Anonymous data may exceptionally be considered personal data if they are used to create or enrich a personality profile (but this also applies under the GDPR, because by linking them to a person, factual data are likely to become personal data);
- concrete specifications for contracts between controllers and processors are missing;
- the LGPD contains a specific legal basis for the processing of (i) sensitive personal data by research institutions for research purposes and (ii) ordinary personal data for credit assessment purposes;
- an SME exemption from the obligation to keep a processing register is missing;
- Threshold criteria for conducting a data protection impact assessment are missing, and the supervisory authority may order that one be conducted. Provisions for consulting the supervisory authority are missing;
- the obligation to appoint a DPO applies only to responsible persons, but here without exception (although the supervisory authority may issue implementing regulations);
- the supervisory authority may issue minimum data security requirements;
- a maximum time limit for reporting data security breaches is missing;
- Requests from the persons concerned must be answered without delay; if this is not possible, reasons must be given. Requests for information must generally be answered within 15 days;
- the information obligation is somewhat broader than under the GDPR;
- Fines can be imposed simply or per day of violation (e.g. in case of disregard of an injunction), in each case up to the amount of approximately CHF 8.5 million.