What is the primary objective of **LGPD**?

**The primary objective of LGPD (Lei Geral de Proteção de Dados Pessoais, Law No. 13.709/2018) is to protect the fundamental rights of privacy and freedom of natural persons by regulating personal data processing.** Enacted August 14, 2018, with full enforcement from August 1, 2021, it mandates 10 principles (Art. 6), including purpose limitation, necessity, transparency, security, prevention, non-discrimination, and accountability, while granting data subjects rights to access, correction, deletion, portability, anonymization, and objection to automated decisions (Art. 18).

Who is legally or professionally required to comply with **LGPD**?

**All controllers and processors handling personal data of Brazilian residents must comply with LGPD, regardless of company size or location.** Its extraterritorial scope (Art. 3) applies to any processing in Brazil, targeting Brazilian residents for goods/services, or collecting data there, affecting public/private entities in sectors like e-commerce, fintech, healthcare, and cloud services. Controllers decide purposes/means (Art. 5, VI); processors execute instructions (Art. 5, VII), with no employee/revenue thresholds.

Does **LGPD** require an external audit or third-party certification?

**LGPD does not mandate external audits or third-party certification.** The **Autoridade Nacional de Proteção de Dados (ANPD)** conducts audits (Arts. 55-56), but organizations must maintain Records of Processing Activities (RoPAs, Art. 37), perform Data Protection Impact Assessments (DPIAs) for high-risk processing (Art. 38), and demonstrate compliance via governance like DPO appointment (Art. 41, often mandatory for controllers). Voluntary certifications enhance maturity but are not required.

How often should an assessment for **LGPD** be performed?

**LGPD assessments, including RoPAs and DPIAs, must be performed continuously with updates for changes in processing activities.** ANPD requires ongoing monitoring (e.g., Resolution CD/ANPD No. 15/2024 for incidents), incident logs retained 5 years, and DPIAs for high-risk legitimate interests or activities. Quarterly internal audits, annual full reviews, and ad-hoc reassessments post-incidents or transfers ensure alignment with 10 principles (Art. 6).

What are the consequences of non-compliance with **LGPD**?

**Non-compliance with LGPD incurs graduated sanctions by ANPD, including fines up to 2% of Brazilian revenue (capped at R$50 million per infraction), data blocking/deletion, processing suspension up to 6 months (extendable), and publicity of infractions.** Factors include gravity, cooperation, and safeguards (Art. 75); additional civil liabilities for damages (Art. 42) and operational disruptions apply to B2B/employee data.

An **LGPD** be mapped to other international frameworks?

**Yes, LGPD can be mapped to other international frameworks due to shared principles like purpose limitation, minimization, transparency, and data subject rights.** Its 10 principles (Art. 6) and bases (Art. 7) align closely with global regimes, enabling hybrid programs; however, nuances like Brazil revenue-based fines (vs. global), 10 bases (including credit protection), and ANPD-specific rules (e.g., SCCs by Aug 23, 2025, Resolution 19/2024) require tailored gap analysis.

What is the first step to begin implementing **LGPD**?

**The first step to implement LGPD is appointing a Data Protection Officer (DPO) and conducting data mapping to create a Record of Processing Activities (RoPA).** Secure executive sponsorship, then inventory data flows, purposes, legal bases, sensitive data, and transfers (Art. 37), prioritizing high-risk areas to enforce principles (Art. 6) and enable DPIAs/DSRs.

What is the primary objective of **BREEAM**?

**BREEAM's primary objective is to provide a science-led sustainability assessment and certification framework for the built environment.** It measures performance across categories like **Management**, **Health & Wellbeing**, **Energy**, **Transport**, **Water**, **Materials**, **Waste**, **Land Use & Ecology**, **Pollution**, and **Innovation**, converting credits into ratings from **Pass (≥30%)** to **Outstanding (≥85%)**. Developed by BRE in 1990, it verifies environmental, social, and resilience outcomes through third-party audits.

Who is legally or professionally required to comply with **BREEAM**?

**No organizations are legally required to comply with BREEAM, as it is a voluntary certification scheme.** Professionally, it applies to developers, owners, and operators of buildings, infrastructure, communities, and fit-outs seeking market differentiation, ESG credibility, or alignment with planning incentives. **National Scheme Operators** in Austria, Germany, Netherlands, Norway, Spain, and Sweden adapt it locally, while others use international versions.

Does **BREEAM** require an external audit or third-party certification?

**Yes, BREEAM requires third-party certification by BRE Global Ltd following quality audits.** Licensed **BREEAM Assessors** compile evidence from technical manuals and submit for BRE's QA, often including site visits. BRE holds **UKAS accreditation to ISO/IEC 17065**, ensuring impartiality for schemes like New Construction, In-Use (valid 3 years), and Infrastructure.

How often should an assessment for **BREEAM** be performed?

**Assessments are performed once per certification cycle, with BREEAM In-Use requiring reassessment every 3 years.** New Construction and similar schemes involve staged submissions (design, post-construction), while operational assets use In-Use for ongoing verification. **Knowledge Base Compliance Notes (KBCNs)** mandate monitoring updates for sustained compliance.

What are the consequences of non-compliance with **BREEAM**?

**Non-compliance results in denied credits, lower ratings, or failed certification, with no direct legal penalties as BREEAM is voluntary.** Consequences include lost market premiums (e.g., up to 25% rental uplift), rejected planning incentives, ESG reporting gaps, and higher operational costs from unoptimized energy or health performance.

Can **BREEAM** be mapped to other international frameworks?

**BREEAM is not explicitly mapped to other frameworks within its standalone requirements.** Version 7 aligns internally with EU Taxonomy for whole-life carbon and net-zero strategies, but executives must select schemes independently. BRE guidance emphasizes BREEAM's self-contained category weightings and evidence standards.

What is the first step to begin implementing **BREEAM**?

**The first step is appointing a licensed BREEAM Assessor and selecting the appropriate scheme/version at project inception.** Register the project, conduct a pre-assessment for credit targeting, and embed requirements into design and procurement. Early involvement of a **BREEAM AP** optimizes categories like Energy and Health & Wellbeing.

LGPD vs BREEAM

Standards Comparison

LGPD

Mandatory

2020

Brazil's comprehensive personal data protection regulation

BREEAM

Voluntary

1990

Global sustainability certification for built environment performance

Quick Verdict

LGPD mandates data protection for Brazilian residents' privacy across industries, enforced by ANPD fines. BREEAM voluntarily certifies sustainable buildings via credits and audits. Companies adopt LGPD for legal compliance, BREEAM for ESG value, efficiency, and market premiums.

Data Privacy

LGPD

Lei Geral de Proteção de Dados Pessoais (Law 13.709/2018)

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Extraterritorial scope for Brazilian residents' data worldwide
10 core principles including prevention and non-discrimination
Fines up to 2% Brazilian revenue capped R$50M
Mandatory DPO for controllers with public disclosure
3-business-day breach notifications to ANPD and subjects

Building Sustainability

BREEAM

Building Research Establishment Environmental Assessment Method

Cost

€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Credit-based scoring across 10 sustainability categories
Third-party certification with BRE quality audits
Lifecycle schemes for new, existing, and infrastructure
Evidence-driven compliance via technical manuals and KBCNs
Weighted ratings from Pass to Outstanding

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

LGPD Details

What It Is

Lei Geral de Proteção de Dados Pessoais (LGPD), Law No. 13.709/2018, is Brazil's comprehensive data protection regulation. It governs personal data processing with extraterritorial scope, applying to any data of Brazilian residents. Primary purpose: safeguard privacy rights via risk-based approach, mirroring GDPR but with Brazil-specific adaptations like 10 principles.

Key Components

**10 core principlespurpose limitation, necessity, transparency, security, prevention, non-discrimination, accountability.
**Data subject rightsaccess, correction, deletion, portability, objection to automated decisions.
**Legal bases10 options including consent, legitimate interests, credit protection.
**Governancemandatory DPO for controllers, DPIAs for high-risk processing, ANPD enforcement with graduated sanctions.

Why Organizations Use It

Legal obligation with fines up to 2% Brazilian revenue (R$50M cap). Reduces breach risks, builds trust, enables market access in Brazil's digital economy. Competitive edge via privacy-by-design, synergies with GDPR.

Implementation Overview

Phased: governance, data mapping (RoPA), policies, controls, training, audits. Applies to all sizes/industries processing Brazilian data. No certification, but ANPD audits enforce compliance.

BREEAM Details

What It Is

BREEAM (Building Research Establishment Environmental Assessment Method) is a science-led sustainability certification framework for the built environment. Developed by BRE in 1990, it assesses environmental, social, and resilience performance across buildings, infrastructure, and communities. Its credit-based methodology weighs performance in key domains into ratings from Pass to Outstanding.

Key Components

10 core categories: Management, Health & Wellbeing, Energy, Transport, Water, Materials, Waste, Land Use & Ecology, Pollution, Innovation
Scheme-specific technical manuals with credits, prerequisites, and evidence requirements
Weighted scoring and third-party audits by BRE Global (UKAS-accredited to ISO/IEC 17065)
Continuous updates via Knowledge Base Compliance Notes (KBCNs)

Why Organizations Use It

Drives operational savings (e.g., 22-33% energy reduction), asset value uplift (up to 30% premiums), and ESG alignment
Meets planning incentives, tenant demands, and EU Taxonomy
Mitigates risks in carbon, resilience, and greenwashing
Builds stakeholder trust through verified benchmarks

Implementation Overview

Phased approach: pre-assessment, design integration, construction verification, certification
Appoint licensed Assessor and AP early; gather auditable evidence
Applies globally to all sizes/types; voluntary but strategic for portfolios

Key Differences

Aspect	LGPD	BREEAM
Scope	Personal data processing & privacy rights	Building sustainability & environmental performance
Industry	All sectors processing Brazilian data	Construction, real estate, infrastructure
Nature	Mandatory national data protection law	Voluntary sustainability certification
Testing	ANPD audits, DPIAs for high-risk	Assessor-led assessments, BRE audits
Penalties	Fines up to 2% Brazilian revenue	No fines, loss of certification

Scope

LGPD

Personal data processing & privacy rights

BREEAM

Building sustainability & environmental performance

Industry

LGPD

All sectors processing Brazilian data

BREEAM

Construction, real estate, infrastructure

Nature

LGPD

Mandatory national data protection law

BREEAM

Voluntary sustainability certification

Testing

LGPD

ANPD audits, DPIAs for high-risk

BREEAM

Assessor-led assessments, BRE audits

Penalties

LGPD

Fines up to 2% Brazilian revenue

BREEAM

No fines, loss of certification

Frequently Asked Questions

Common questions about LGPD and BREEAM

LGPD FAQ

BREEAM FAQ

You Might also be Interested in These Articles...

Asset-Backed Issuers and SEC Cybersecurity Rules: Applicability, Disclosures, and Compliance Roadmap

How SEC cybersecurity rules apply to asset-backed issuers (ABS): Form 10-D disclosures, ABS-EE risk management, Inline XBRL tagging, exemptions. Roadmap for tru

CMMC Level 3 Implementation Guide: Integrating NIST SP 800-172 Enhanced Controls for APT Defense

Step-by-step CMMC Level 3 guide for DIB contractors. Implement 24 NIST SP 800-172 controls on Level 2. Prep for DIBCAC, C3PAO scoping & 180-day POA&Ms. Boost cy

Top 10 SOC 2 Audit Pitfalls and Fixes: Real Auditor Red Flags from Type 2 Fieldwork with Evidence Checklists

Discover 10 common SOC 2 Type 2 audit pitfalls like evidence gaps, scope creep, vendor oversights. Get Fail/Pass visuals, client stories, checklists for 95% fir

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Check out these other Gradum.io Standards Comparison Pages

ISO 45001 vs AS9120B

Compare ISO 45001 vs AS9120B: Unpack OH&S leadership, risk planning & aerospace traceability diffs. Integrate standards, cut risks, elevate compliance. Discover now!

ISA 95 vs ISO 13485

Compare ISA 95 vs ISO 13485: ISA-95 integrates ERP-MES via Purdue levels & activity models; ISO 13485 enforces risk-based QMS for med devices. Optimize compliance—read now!

REACH vs IFS Food

Compare REACH vs IFS Food: Unlock key differences in EU chemical regs & food safety certs. Master compliance strategies, pitfalls & best practices for manufacturers. Secure market access now!

LGPD

BREEAM

Quick Verdict

LGPD

Key Features

BREEAM

Key Features

Detailed Analysis

LGPD Details

What It Is

Key Components

Why Organizations Use It

Implementation Overview

BREEAM Details

What It Is

Key Components

Why Organizations Use It

Implementation Overview

Key Differences

Scope

Industry

Nature

Testing

Penalties

Frequently Asked Questions

LGPD FAQ

What is the primary objective of LGPD?

Who is legally or professionally required to comply with LGPD?

Does LGPD require an external audit or third-party certification?

How often should an assessment for LGPD be performed?

What are the consequences of non-compliance with LGPD?

An LGPD be mapped to other international frameworks?

What is the first step to begin implementing LGPD?

BREEAM FAQ

What is the primary objective of BREEAM?

Who is legally or professionally required to comply with BREEAM?

Does BREEAM require an external audit or third-party certification?

How often should an assessment for BREEAM be performed?

What are the consequences of non-compliance with BREEAM?

Can BREEAM be mapped to other international frameworks?

What is the first step to begin implementing BREEAM?

You Might also be Interested in These Articles...

Asset-Backed Issuers and SEC Cybersecurity Rules: Applicability, Disclosures, and Compliance Roadmap

CMMC Level 3 Implementation Guide: Integrating NIST SP 800-172 Enhanced Controls for APT Defense

Top 10 SOC 2 Audit Pitfalls and Fixes: Real Auditor Red Flags from Type 2 Fieldwork with Evidence Checklists

Run Maturity Assessments with GRADUM

Check out these other Gradum.io Standards Comparison Pages

ISO 45001 vs AS9120B

ISA 95 vs ISO 13485

REACH vs IFS Food