What is the primary objective of LGPD?

The primary objective of LGPD (Lei Geral de Proteção de Dados Pessoais, Law No. 13.709/2018) is to protect the fundamental rights of privacy and freedom of natural persons by regulating the processing of personal data. Enacted August 14, 2018, with full enforcement from September 2020 and sanctions from August 1, 2021, it mandates 10 core principles (Art. 6)—including purpose limitation, necessity, transparency, security, prevention, non-discrimination, and accountability—for controllers and processors handling data of identified or identifiable individuals, including sensitive data like health or biometrics (Art. 5).

Who is legally or professionally required to comply with LGPD?

LGPD applies to any controller or processor conducting data processing in Brazil, targeting Brazilian residents, or collecting data therein, with extraterritorial scope regardless of headquarters. No size thresholds exempt organizations; public and private entities must comply, including multinationals in e-commerce, finance, healthcare, and cloud services processing personal data (Art. 3). Exemptions (Art. 4) cover non-economic private uses, journalism, and public security, but principles partially apply.

Does LGPD require an external audit or third-party certification?

LGPD does not mandate external audits or third-party certification. The Autoridade Nacional de Proteção de Dados (ANPD) conducts audits and enforces via its powers (Art. 55), but organizations must maintain internal records of processing activities (RoPAs, Art. 37), conduct Data Protection Impact Assessments (DPIAs) for high-risk activities (Art. 38), and demonstrate accountability through self-governed measures like security protocols and DPO oversight.

How often should an assessment for LGPD be performed?

LGPD requires ongoing assessments, with Records of Processing Activities (RoPAs) and DPIAs updated continuously for new or high-risk processing, and full internal reviews at least annually. ANPD may demand ad-hoc DPIAs or records; security incident logs must be retained for 5 years, breach notifications occur within 3 business days (Resolution CD/ANPD No. 15/2024), and governance programs include regular risk scoring, vendor audits, and principle-aligned monitoring.

What are the consequences of non-compliance with LGPD?

Non-compliance with LGPD incurs graduated ANPD sanctions, including fines up to 2% of Brazilian revenue (capped at R$50 million per infraction), data processing suspension up to 6 months (extendable), deletion orders, and public disclosure. Factors like gravity, cooperation, and prior safeguards influence penalties (Art. 52-53); civil claims for damages (Art. 42) and operational disruptions apply to B2B and employee data.

Can LGPD be mapped to other international frameworks?

Yes, LGPD maps closely to international frameworks due to shared principles like purpose limitation, minimization, transparency, and data subject rights. Its 10 principles, 10 legal bases (Art. 7), extraterritoriality, DPIAs, and breach rules align with global regimes, facilitating hybrid programs; however, nuances like revenue-based fines (vs. global turnover) and ANPD-approved SCCs for transfers (Resolution No. 19/2024) require tailored adaptations.

What is the first step to begin implementing LGPD?

The first step to implement LGPD is appointing a Data Protection Officer (DPO) and conducting a comprehensive data mapping to create a Record of Processing Activities (RoPA). Per Art. 41, the DPO (mandatory for controllers, publicly disclosed) oversees governance; mapping inventories data flows, purposes, legal bases, sensitive data, and transfers, enabling risk prioritization, DPIA identification, and principle compliance (Art. 6, 37).

What is the primary objective of AS9120B?

AS9120B establishes a quality management system for organizations that procure, store, split, and resell aerospace parts without altering product characteristics. Built on ISO 9001:2015’s 10-clause structure, it adds over 100 aerospace-specific requirements addressing distribution risks like loss of traceability, counterfeit parts, documentation errors, and external provider controls to ensure chain-of-custody integrity.

Who is legally or professionally required to comply with AS9120B?

AS9120B applies to stockist distributors, pass-through distributors, and those performing batch splitting in aviation, space, and defense supply chains. It targets organizations without manufacturing or repair activities; certification is not legally mandatory but is a commercial requirement from OEMs and primes for market access, with over 2,400 global certifications as of 2026.

Does AS9120B require an external audit or third-party certification?

Yes, AS9120B requires third-party certification through accredited bodies following a two-stage audit process. Stage 1 reviews documentation and scope; Stage 2 verifies implementation via on-site audits per AS9101G, leading to OASIS listing for visibility in IAQG ecosystems.

How often should an assessment for AS9120B be performed?

AS9120B requires internal audits at planned intervals to cover all processes annually, plus annual surveillance audits post-certification. Management reviews occur at planned intervals, typically quarterly, with full recertification audits every three years to evaluate QMS effectiveness, risks, and continual improvement.

What are the consequences of non-compliance with AS9120B?

Non-compliance with AS9120B results in audit nonconformities, certification denial or suspension, and exclusion from OEM supply chains. It risks contract penalties, loss of OASIS listing, supply chain expulsion, and liabilities from counterfeit parts or traceability failures affecting product safety.

Can AS9120B be mapped to other international frameworks?

AS9120B aligns directly with ISO 9001:2015’s high-level structure, enabling seamless mapping of its 10 clauses. It shares core PDCA logic, risk-based thinking, and documented information controls, facilitating integration while adding aerospace distribution specifics like counterfeit prevention and traceability.

What is the first step to begin implementing AS9120B?

The first step is conducting a gap analysis against AS9120B clauses using a certified checklist to identify deficiencies in context, scope, and processes. Form a cross-functional team, justify “not applicable” clauses (e.g., 8.3 Design), and prioritize high-risk areas like supplier controls and traceability.

Standards Comparison

LGPD vs AS9120B

LGPD

Mandatory

2020

Brazil's comprehensive regulation for personal data protection

AS9120B

Mandatory

2016

Aerospace QMS standard for distributors ensuring traceability and counterfeit prevention.

Quick Verdict

LGPD mandates data protection for Brazilian residents across industries, enforcing privacy rights with fines. AS9120B certifies aerospace distributors' quality systems for traceability and counterfeit prevention. Companies adopt LGPD for legal compliance, AS9120B for supply chain access.

Data Privacy

LGPD

Lei Geral de Proteção de Dados Pessoais (Law No. 13.709/2018)

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Extraterritorial scope targeting Brazilian residents' data
10 core principles including prevention and non-discrimination
Fines up to 2% Brazilian revenue (R$50M cap)
Mandatory DPO for controllers with public disclosure
SCCs mandatory for cross-border transfers (enforced since 2025)

Quality Management

AS9120B

AS9120B Quality Management Systems for Distributors

Cost

€€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Counterfeit and suspected unapproved parts prevention processes
Robust product traceability and chain-of-custody controls
Enhanced external provider evaluation and flowdown requirements
Configuration management for sales orders and documentation
Risk-based operational planning and preservation controls

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

LGPD Details

What It Is

LGPD (Lei Geral de Proteção de Dados Pessoais), Law No. 13.709/2018, is Brazil's comprehensive data protection regulation enacted in 2018, fully enforced since 2021. It protects personal data of natural persons with extraterritorial scope, applying to processing in Brazil, targeting residents, or collected there. Employs a risk-based approach with 10 principles like purpose limitation, necessity, and accountability.

Key Components

**10 principlesPurpose limitation, adequacy, necessity, transparency, security, prevention, non-discrimination, accountability.
**10 legal basesConsent, contracts, legitimate interests, sensitive data restrictions.
**Data subject rightsAccess, correction, deletion, portability, anonymization, objection to automated decisions.
Governance via DPO, records of processing, DPIAs for high-risk, 3-day breach notifications.
ANPD enforcement with graduated sanctions; no certification model.

Why Organizations Use It

Mandatory compliance avoids fines up to 2% Brazilian revenue (R$50M cap), suspensions.
Builds stakeholder trust, enables market access in Brazil's digital economy.
Risk reduction via security, breach readiness; competitive advantages like innovation via anonymization.

Implementation Overview

Phased: Governance/DPO appointment, data mapping/RoPA, policies/contracts, technical controls, DSR/incident processes, monitoring.
Applies to all sizes/industries processing Brazilian data globally; ANPD audits, no formal certification.

AS9120B Details

What It Is

AS9120B is the IAQG quality management system standard for aerospace distributors, building on ISO 9001:2015's high-level structure. It targets organizations procuring, storing, splitting, and reselling parts without alteration, emphasizing risk-based thinking to address distribution risks like traceability loss and counterfeits.

Key Components

Over 100 aerospace-specific requirements beyond ISO 9001.
Core areas: context analysis, leadership, planning, support, operations (traceability, preservation, counterfeit prevention), performance evaluation, improvement.
Built on PDCA cycle; requires documented information, not a full manual.
Certification via accredited bodies, listed in IAQG OASIS.

Why Organizations Use It

Commercial necessity for OEM/Tier 1 supply chains.
Mitigates risks of nonconformities, enhances chain-of-custody trust.
Provides market access (2,442 global certifications), operational efficiency, customer confidence.

Implementation Overview

Phased approach: gap analysis, process design, training, audits (6-12 months).
Applies to aviation/space/defense distributors globally; scales by size.
Involves internal audits, management reviews, Stage 1/2 certification audits.

Key Differences

Aspect	LGPD	AS9120B
Scope	Personal data protection and processing	Aerospace parts distribution quality management
Industry	All sectors, Brazil-focused, all sizes	Aerospace distribution, global, all sizes
Nature	Mandatory data protection regulation	Voluntary QMS certification standard
Testing	DPIAs for high-risk, ANPD audits	Internal audits, certification body surveillance
Penalties	Fines up to 2% Brazilian revenue	Loss of certification, market exclusion

Scope

LGPD

Personal data protection and processing

AS9120B

Aerospace parts distribution quality management

Industry

LGPD

All sectors, Brazil-focused, all sizes

AS9120B

Aerospace distribution, global, all sizes

Nature

LGPD

Mandatory data protection regulation

AS9120B

Voluntary QMS certification standard

Testing

LGPD

DPIAs for high-risk, ANPD audits

AS9120B

Internal audits, certification body surveillance

Penalties

LGPD

Fines up to 2% Brazilian revenue

AS9120B

Loss of certification, market exclusion

Frequently Asked Questions

Common questions about LGPD and AS9120B

LGPD FAQ

AS9120B FAQ

You Might also be Interested in These Articles...

CMMC Cost Calculator: Realistic Budgets for Levels 1-3, C3PAO Fees, and ROI for Small DIB Suppliers

Calculate realistic CMMC costs for Levels 1-3: self-assessments, C3PAO fees, tooling, remediation & ROI. Interactive tool for small DIB suppliers. Get benchmark

CIS Controls v8.1, Operationalized: Top 10 Reasons Compliance Monitoring Software Accelerates Real-World Implementation

Operationalize CIS Controls v8.1 with compliance monitoring software. Turn checklists into dashboards, tickets, and audit-proof workflows. Top 10 reasons it acc

You Guide on how to Start Implementing NIST CSF in Your Organization

Master NIST CSF implementation in your organization with this detailed guide. Learn core functions, key steps, best practices, and tips for cybersecurity succes

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how LGPD and AS9120B compare against other standards

Other LGPD Comparisons

Other AS9120B Comparisons

What It Is

Key Components

**10 principlesPurpose limitation, adequacy, necessity, transparency, security, prevention, non-discrimination, accountability.

**10 legal basesConsent, contracts, legitimate interests, sensitive data restrictions.

**Data subject rightsAccess, correction, deletion, portability, anonymization, objection to automated decisions.

Governance via DPO, records of processing, DPIAs for high-risk, 3-day breach notifications.

ANPD enforcement with graduated sanctions; no certification model.

What It Is

Key Components

Over 100 aerospace-specific requirements beyond ISO 9001.

Core areas: context analysis, leadership, planning, support, operations (traceability, preservation, counterfeit prevention), performance evaluation, improvement.

Built on PDCA cycle; requires documented information, not a full manual.

Certification via accredited bodies, listed in IAQG OASIS.

Aspect

LGPD

AS9120B

Scope

Personal data protection and processing

Aerospace parts distribution quality management

Industry

All sectors, Brazil-focused, all sizes

Aerospace distribution, global, all sizes

Nature

Mandatory data protection regulation

Voluntary QMS certification standard

Testing

DPIAs for high-risk, ANPD audits

Internal audits, certification body surveillance

Penalties

Fines up to 2% Brazilian revenue

Loss of certification, market exclusion