What is the primary objective of DORA?

The primary objective of DORA (Regulation (EU) 2022/2554) is to strengthen the digital operational resilience of the EU financial sector against ICT disruptions, including cyberattacks, system failures, and third-party risks. It mandates ICT risk management frameworks, incident reporting, resilience testing, and third-party oversight for 20 types of financial entities and critical ICT third-party providers (CTPPs), applying fully since January 17, 2025.

Who is legally or professionally required to comply with DORA?

DORA applies legally to approximately 22,000 EU-regulated financial entities across 20 types, including credit institutions, insurance undertakings, investment firms, payment institutions, and crypto-asset service providers, plus critical ICT third-party providers (CTPPs). Critical third-parties like cloud and data analytics firms face direct ESA oversight, with designations established by end-2025.

Does DORA require an external audit or third-party certification?

DORA does not mandate external audits or third-party certification but requires independent digital operational resilience testing, including risk-based annual basic tests and triennial threat-led penetration testing (TLPT) for critical entities. Testing may involve external providers, with results reported to authorities and remediated promptly per 2024 RTS on TLPT.

How often should an assessment for DORA be performed?

DORA requires annual basic ICT resilience tests, such as vulnerability assessments, and triennial advanced threat-led penetration testing (TLPT) for designated critical entities. ICT risk management frameworks must undergo annual reviews, tailored proportionally to entity size, complexity, and risk exposure.

What are the consequences of non-compliance with DORA?

Non-compliance with DORA can result in administrative fines up to 2% of total global annual turnover for firms or €5 million (or 10% of annual salary) for individuals, imposed by ESAs or competent authorities. Additional measures include remedial orders, oversight fees up to €1 million annually for CTPPs, and reputational damage from public enforcement.

Can DORA be mapped to other international frameworks?

Yes, DORA's ICT risk management, incident reporting, testing, and third-party oversight elements can be mapped to other international frameworks, leveraging existing compliance for efficiency. Financial entities often align DORA's proportional controls and RTOs (e.g., <4 hours for critical services) with prior EBA guidelines during gap analyses.

What is the first step to begin implementing DORA?

The first step to implement DORA is to conduct a gap analysis against the ESAs' Regulatory Technical Standards (RTS) on ICT risk frameworks, published January 17, 2024. This identifies deficiencies in ICT strategies, incident classification (e.g., major incidents impacting >5% users or €100,000+ losses), and third-party dependencies to meet the January 17, 2025 compliance mandate.

What is the primary objective of LGPD?

The primary objective of LGPD is to protect the fundamental rights of privacy and freedom of natural persons by regulating the processing of personal data. Enacted as Law No. 13.709/2018, it unifies fragmented norms under 10 core principles (Art. 6), including purpose limitation, necessity, transparency, security, prevention, non-discrimination, and accountability, while granting data subjects rights to access, correction, deletion, portability, anonymization, and objection to automated decisions (Art. 18).

Who is legally or professionally required to comply with LGPD?

All controllers and operators processing personal data of Brazilian residents must comply with LGPD, regardless of company size or location. Its extraterritorial scope (Art. 3) applies to any processing in Brazil, targeting Brazilian residents for goods/services, or collecting data therein; no employee/revenue thresholds exempt entities, including multinationals in e-commerce, fintech, healthcare, and cloud services (Art. 5 defines personal/sensitive data).

Does LGPD require an external audit or third-party certification?

LGPD does not mandate external audits or third-party certification. The ANPD conducts audits (Art. 55), but controllers must maintain Records of Processing Activities (RoPAs, Art. 37), perform Data Protection Impact Assessments (DPIAs) for high-risk processing (Art. 38), and demonstrate compliance via internal governance, including a mandatory DPO for controllers (Art. 41, with public disclosure).

How often should an assessment for LGPD be performed?

LGPD assessments, including RoPAs and DPIAs, must be maintained continuously and updated for changes in processing activities. ANPD regulations (e.g., CD/ANPD No. 02/2022) require ongoing records; DPIAs are mandatory for high-risk operations like legitimate interests (Art. 38), with internal audits recommended quarterly/annually, plus ad-hoc reviews for incidents or new projects to ensure alignment with 10 principles (Art. 6).

What are the consequences of non-compliance with LGPD?

Non-compliance with LGPD incurs graduated sanctions by ANPD, including fines up to 2% of Brazilian revenue (capped at R$50 million per infraction), data processing suspension, and deletion orders. Nine sanctions (Art. 52) factor gravity, cooperation, and safeguards; additional civil liabilities for damages (Art. 42), reputational harm, and operational disruptions apply to controllers/operators, with B2B/employee data fully scoped.

Can LGPD be mapped to other international frameworks?

Yes, LGPD can be mapped to other international frameworks due to shared principles like purpose limitation, minimization, and accountability. Its 10 principles, data subject rights, and legal bases (Art. 7) align closely with global regimes, enabling hybrid programs; however, nuances like Brazil revenue-based fines (vs. global) and 10 bases require tailored gap analyses for cross-jurisdictional compliance.

What is the first step to begin implementing LGPD?

The first step to implement LGPD is appointing a Data Protection Officer (DPO) and conducting data mapping to create a Record of Processing Activities (RoPA). Per Art. 41, publish DPO details; inventory data flows, purposes, legal bases (Art. 7), sensitive data, and transfers (Phase 1 guidance), prioritizing high-risk areas to enforce principles (Art. 6) and secure executive sponsorship.

Standards Comparison

DORA vs LGPD

DORA

Mandatory

2023

EU regulation for digital operational resilience in financial sector

LGPD

Mandatory

2020

Brazil's comprehensive personal data protection regulation

Quick Verdict

DORA mandates ICT resilience for EU financial entities against disruptions, while LGPD enforces personal data protection for Brazilian residents across sectors. Companies adopt DORA for regulatory compliance and cyber defense, LGPD to avoid fines and build trust in Brazil's digital economy.

Digital Operational Resilience

DORA

Regulation (EU) 2022/2554 Digital Operational Resilience Act

Cost

€€€€

Complexity

Medium

Implementation Time

18-24 months

Key Features

Mandates comprehensive ICT risk management frameworks
Enforces 4-hour incident reporting for major events
Requires triennial threat-led penetration testing (TLPT)
Implements oversight of critical third-party providers
Promotes standardized ICT incident information sharing

Data Privacy

LGPD

Lei Geral de Proteção de Dados Pessoais (LGPD)

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Extraterritorial scope targeting Brazilian residents' data
10 core principles including prevention and non-discrimination
Fines up to 2% Brazilian revenue per infraction
Mandatory DPO appointment for controllers
3-business-day breach notifications to ANPD

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

DORA Details

What It Is

Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, is an EU regulation bolstering financial sector resilience against ICT disruptions like cyberattacks. Applies to 20 financial entity types and critical third-party providers (CTPPs). Uses risk-based, proportional approach focusing on prevention and response.

Key Components

**ICT Risk ManagementStrategies for identification, mitigation, annual reviews.
**Incident Reporting4-hour initial, 72-hour updates, 1-month analysis.
**Resilience TestingAnnual basic tests, triennial TLPT.
**Third-Party OversightDue diligence, monitoring, ESAs supervision. Enforced via penalties up to 2% global turnover; information sharing included.

Why Organizations Use It

Ensures mandatory compliance since January 2025, avoids fines.
Mitigates systemic risks (74% ransomware exposure).
Enhances resilience, trust, harmonizes EU rules.
Drives cybersecurity innovation and investments.

Implementation Overview

Gap analyses, framework builds, testing programs, vendor contracts.
Targets EU financial entities; proportional by size/risk.
Regulatory reporting, no certification; ESAs audits CTPPs via JETs.

LGPD Details

What It Is

LGPD (Lei Geral de Proteção de Dados Pessoais, Law No. 13.709/2018) is Brazil's comprehensive data protection regulation. It safeguards personal data of natural persons, with extraterritorial scope applying to processing targeting Brazilian residents. Adopting a risk-based approach, it mirrors GDPR but adds Brazil-specific elements like 10 principles.

Key Components

**10 core principlespurpose limitation, necessity, transparency, security, prevention, non-discrimination, accountability.
**Data subject rightsaccess, correction, deletion, portability, objection to automated decisions.
10 legal bases for processing, stricter for sensitive data.
Governance via DPO, DPIAs for high-risk activities, processing records. Compliance enforced by ANPD, no formal certification.

Why Organizations Use It

Mandatory compliance avoids fines up to 2% Brazilian revenue (R$50M cap).
Enhances trust, reputation in Brazil's digital economy.
Risk mitigation for breaches, competitive edge via privacy-by-design.

Implementation Overview

**Phased approachgovernance, data mapping, policies, controls, DSRs, monitoring.
Applies to all sizes/industries processing Brazilian data globally. ANPD audits/sanctions drive self-assessed compliance. (178 words)

Key Differences

Aspect	DORA	LGPD
Scope	Digital operational resilience in finance vs ICT risks	Personal data protection across all sectors
Industry	EU financial entities and CTPPs	All industries targeting Brazilian residents
Nature	Mandatory EU regulation with ESAs enforcement	Mandatory Brazilian law with ANPD sanctions
Testing	Annual basic tests, triennial TLPT	DPIAs for high-risk processing
Penalties	Up to 2% global turnover fines	Up to 2% Brazilian revenue, R$50M cap

Scope

DORA

Digital operational resilience in finance vs ICT risks

LGPD

Personal data protection across all sectors

Industry

DORA

EU financial entities and CTPPs

LGPD

All industries targeting Brazilian residents

Nature

DORA

Mandatory EU regulation with ESAs enforcement

LGPD

Mandatory Brazilian law with ANPD sanctions

Testing

DORA

Annual basic tests, triennial TLPT

LGPD

DPIAs for high-risk processing

Penalties

DORA

Up to 2% global turnover fines

LGPD

Up to 2% Brazilian revenue, R$50M cap

Frequently Asked Questions

Common questions about DORA and LGPD

DORA FAQ

LGPD FAQ

You Might also be Interested in These Articles...

Evidential Readiness Blueprint: Mapping Multi-Cloud Access Controls to Cyber Essentials Audit Requirements

Step-by-step blueprint for IT managers to document and verify access control plus patch management evidence across Microsoft 365, AWS, and Azure for first-time

Beyond Reactive: Transforming Compliance into Real-Time Threat Prevention

Discover how modern compliance monitoring tools leverage continuous, real-time oversight and automated alerts to shift organizations from reactive problem-solving to proactive threat detection and prevention, safeguarding against emerging risks before they escalate.

Breaking Down NIST CSF 2.0 Structure: Core, Tiers, Profiles, and Real-World Application

Master NIST CSF 2.0 structure: Govern + 5 Core functions, Tiers (Partial-Adaptive), Profiles for gaps, and real-world apps. Build effective cyber risk strategie

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how DORA and LGPD compare against other standards

Other DORA Comparisons

Other LGPD Comparisons

What It Is

Key Components

**ICT Risk ManagementStrategies for identification, mitigation, annual reviews.

**Incident Reporting4-hour initial, 72-hour updates, 1-month analysis.

**Resilience TestingAnnual basic tests, triennial TLPT.

**Third-Party OversightDue diligence, monitoring, ESAs supervision. Enforced via penalties up to 2% global turnover; information sharing included.

What It Is

Key Components

**10 core principlespurpose limitation, necessity, transparency, security, prevention, non-discrimination, accountability.

**Data subject rightsaccess, correction, deletion, portability, objection to automated decisions.

10 legal bases for processing, stricter for sensitive data.

Governance via DPO, DPIAs for high-risk activities, processing records. Compliance enforced by ANPD, no formal certification.

Aspect

DORA

LGPD

Scope

Digital operational resilience in finance vs ICT risks

Personal data protection across all sectors

Industry

EU financial entities and CTPPs

All industries targeting Brazilian residents

Nature

Mandatory EU regulation with ESAs enforcement

Mandatory Brazilian law with ANPD sanctions

Testing

Annual basic tests, triennial TLPT

DPIAs for high-risk processing

Penalties

Up to 2% global turnover fines

Up to 2% Brazilian revenue, R$50M cap