What is the primary objective of LGPD?

The primary objective of LGPD (Lei Geral de Proteção de Dados Pessoais, Law No. 13.709/2018) is to protect the fundamental rights of privacy and freedom of natural persons by regulating personal data processing. It unifies fragmented norms, mandates 10 principles (e.g., purpose limitation, necessity, accountability, prevention, non-discrimination per Art. 6), grants data subjects rights (access, correction, deletion, portability, anonymization per Art. 18), and enforces obligations on controllers and processors via ANPD oversight.

Who is legally or professionally required to comply with LGPD?

All controllers and processors handling personal data of Brazilian residents must comply with LGPD, regardless of company size or location. Applies extraterritorially (Art. 3) to processing in Brazil, targeting Brazilian residents for goods/services, or data collected there—no thresholds like employee count or revenue. Includes public/private entities; exemptions limited (Art. 4: non-economic private use, journalism, public security).

Does LGPD require an external audit or third-party certification?

LGPD does not mandate external audits or third-party certification. ANPD conducts audits (Arts. 55-56); controllers/processors must maintain records of processing activities (Art. 37, simplified for small entities per CD/ANPD No. 02/2022), perform DPIAs for high-risk activities (Art. 38), and demonstrate compliance via internal governance, but voluntary certifications enhance maturity.

How often should an assessment for LGPD be performed?

LGPD requires ongoing assessments with no fixed frequency, but ANPD guidance mandates annual internal reviews and ad-hoc for high-risk changes. Maintain updated records (Art. 37), conduct DPIAs for legitimate interests/high-risk processing (Art. 38), log incidents for 5 years, and perform quarterly monitoring of RoPAs, vendors, and risks per best practices (e.g., Resolution CD/ANPD No. 15/2024).

What are the consequences of non-compliance with LGPD?

Non-compliance with LGPD triggers graduated ANPD sanctions, including fines up to 2% of Brazilian revenue (capped at R$50 million per infraction), processing suspension up to 6 months (extendable), data blocking/deletion, and publicity of violations. Factors include gravity, cooperation, safeguards (Art. 53); applies to B2B/employee data; civil claims for damages also possible (Art. 42).

Can LGPD be mapped to other international frameworks?

Yes, LGPD maps closely to international frameworks due to shared principles, rights, and structures like GDPR. Aligns on extraterritoriality, data subject rights (9 vs. GDPR's 8), minimization, accountability (10 principles), legal bases (10 including credit protection), DPIAs, transfers (SCCs/BCRs); differences include Brazil revenue-based fines (2% cap) and controller-only DPO.

What is the first step to begin implementing LGPD?

The first step for LGPD implementation is appointing a Data Protection Officer (DPO) and conducting data mapping to create a Record of Processing Activities (RoPA). DPO mandatory for controllers (Art. 41, public disclosure); map flows, purposes, legal bases, sensitive data, transfers (Art. 37) to enforce principles and identify gaps.

What is the primary objective of FSSC 22000?

The primary objective of FSSC 22000 is to provide independent third-party certification of Food Safety Management Systems (FSMS) ensuring organizations consistently provide safe food across food chain categories. It combines ISO 22000:2018, sector-specific PRPs (e.g., ISO/TS 22002-1 for manufacturing), and FSSC Additional Requirements like food defense and allergen management, benchmarked by GFSI since 2010 for supply-chain trust and a public register of 40,059 certified sites.

Who is legally or professionally required to comply with FSSC 22000?

FSSC 22000 is not legally mandatory but professionally required by retailers, manufacturers, and foodservice operators for market access across food chain categories B–K. Applicable to primary handling (BIII), manufacturing (C), feed (D), catering (E), retail (F), transport (G), packaging (I), and bio/chemicals (K), with GFSI recognition enabling global trade via 134 licensed Certification Bodies.

Does FSSC 22000 require an external audit or third-party certification?

Yes, FSSC 22000 mandates external audits and third-party certification by licensed Certification Bodies per ISO/IEC 17021-1:2015 and ISO 22003-1:2022. Certification involves Stage 1/2 audits with minimum 2 days, ≥50% on operational PRPs/controls; surveillance annually (1/3 duration) and recertification every 3 years (2/3 duration), plus TFSSC time for scheme specifics.

How often should an assessment for FSSC 22000 be performed?

FSSC 22000 requires initial certification audits followed by annual surveillance audits and full recertification every 3 years. Internal audits cover all sites annually for multi-site; PRP verifications occur routinely (e.g., monthly risk-based inspections); management reviews include trend data from environmental monitoring and culture objectives at least annually or on triggers.

What are the consequences of non-compliance with FSSC 22000?

Non-compliance with FSSC 22000 results in nonconformity classification, corrective action deadlines, potential certificate suspension/ withdrawal, and market exclusion. Serious events (recalls, shutdowns) must be notified to CB within 3 working days; recurring issues trigger Integrity Program actions, loss of GFSI recognition, and supply-chain de-listing by buyers.

An FSSC 22000 be mapped to other international frameworks?

Yes, FSSC 22000 maps seamlessly to ISO-based frameworks due to its ISO 22000:2018 harmonized structure and PDCA cycle. Clauses 4–10 align with shared elements like leadership (Clause 5), planning (Clause 6), and internal audits (Clause 9), enabling integration while PRPs and Additional Requirements maintain food safety specificity.

What is the first step to begin implementing FSSC 22000?

The first step to implement FSSC 22000 is to define the precise certification scope aligned to ISO 22003-1:2022 categories and draft an auditable scope statement per Annex 1. Conduct a gap analysis against ISO 22000:2018, applicable PRPs (e.g., ISO/TS 22002-1), and Additional Requirements, followed by top management commitment via a formal FSMS meeting establishing policy and objectives.

Standards Comparison

LGPD vs FSSC 22000

LGPD

Mandatory

2020

Brazil's comprehensive data protection regulation for personal data

FSSC 22000

Voluntary

2023

GFSI-benchmarked certification scheme for food safety management.

Quick Verdict

LGPD mandates data protection for Brazilian residents across industries, enforced by ANPD with heavy fines. FSSC 22000 certifies voluntary food safety systems for global chains via audits. Companies adopt LGPD for legal compliance, FSSC for market access and trust.

Data Privacy

LGPD

Lei Geral de Proteção de Dados Pessoais (Law 13.709/2018)

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Extraterritorial scope targets Brazilian residents' data processing
10 core principles including prevention and non-discrimination
Fines up to 2% Brazilian revenue capped at R$50M
Mandatory Data Protection Officer for controllers
ANPD-approved SCCs mandatory for cross-border transfers by 2025

Food Safety

FSSC 22000

Food Safety System Certification 22000

Cost

€€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Combines ISO 22000, PRPs, and additional requirements
GFSI-benchmarked for global supply chain acceptance
Food defense and fraud vulnerability assessments
Mandatory allergen management with validation
Food safety culture objectives and monitoring

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

LGPD Details

What It Is

Lei Geral de Proteção de Dados Pessoais (LGPD), Law No. 13.709/2018, is Brazil's comprehensive data protection regulation. It governs personal data processing with extraterritorial scope, applying to any targeting Brazilian residents. Primary purpose: safeguard privacy rights via risk-based accountability approach, mirroring GDPR but with local adaptations like 10 principles.

Key Components

**10 core principlespurpose limitation, necessity, transparency, security, prevention, non-discrimination, accountability.
**Data subject rightsaccess, correction, deletion, portability, objection to automated decisions.
**Legal bases10 options including consent, contracts, legitimate interests.
**Governancemandatory DPO for controllers, DPIAs for high-risk, ANPD enforcement with graduated sanctions.

Why Organizations Use It

Legal obligation with fines up to 2% Brazilian revenue (R$50M cap); reduces breach risks, builds trust. Enables market access in Brazil's digital economy, competitive edge via privacy-by-design, synergies with GDPR.

Implementation Overview

**Phased risk-based methodologygovernance setup, data mapping/RoPA, policies, technical controls, DSR/incident processes, audits. Applies to all sizes/industries processing Brazilian data; no certification but ANPD audits.

FSSC 22000 Details

What It Is

FSSC 22000 (Food Safety System Certification 22000) is a GFSI-benchmarked certification scheme for Food Safety Management Systems (FSMS). It applies across food chain categories like manufacturing, packaging, and logistics, using a risk-based approach integrating ISO 22000:2018 with sector PRPs.

Key Components

**Three pillarsISO 22000:2018 (clauses 4-10), sector-specific PRPs (e.g., ISO/TS 22002-1), FSSC Additional Requirements (e.g., food defense, allergens).
Over 100 requirements across management, operations, and verification.
Built on PDCA cycle and HACCP principles.
Third-party certification via licensed bodies with defined audit cycles.

Why Organizations Use It

Meets retailer/buyer demands for GFSI recognition.
Enhances supply chain trust, reduces audit duplication.
Manages risks like fraud, defense, and waste.
Boosts market access, reputation, and operational efficiency.

Implementation Overview

Phased: gap analysis, FSMS design, training, audits.
Involves documentation, PRPs, hazard analysis.
Suits all sizes in food sector globally.
Requires Stage 1/2 certification audits, surveillance.

Key Differences

Aspect	LGPD	FSSC 22000
Scope	Personal data protection and processing	Food safety management systems
Industry	All sectors, Brazil-focused, global reach	Food chain sectors worldwide
Nature	Mandatory law with ANPD enforcement	Voluntary GFSI-benchmarked certification
Testing	DPIAs for high-risk, ANPD audits	CB audits, surveillance, recertification
Penalties	Fines up to 2% Brazilian revenue	Loss of certification, no fines

Scope

LGPD

Personal data protection and processing

FSSC 22000

Food safety management systems

Industry

LGPD

All sectors, Brazil-focused, global reach

FSSC 22000

Food chain sectors worldwide

Nature

LGPD

Mandatory law with ANPD enforcement

FSSC 22000

Voluntary GFSI-benchmarked certification

Testing

LGPD

DPIAs for high-risk, ANPD audits

FSSC 22000

CB audits, surveillance, recertification

Penalties

LGPD

Fines up to 2% Brazilian revenue

FSSC 22000

Loss of certification, no fines

Frequently Asked Questions

Common questions about LGPD and FSSC 22000

LGPD FAQ

FSSC 22000 FAQ

You Might also be Interested in These Articles...

Your Compliance Command Center: How Modern Tools Orchestrate Cross-Departmental Adherence

Unlock your compliance command center with modern tools for real-time monitoring, automation & integrations across IT, HR, Legal & Finance. Slash non-compliance

Real-World ISO 27701 Success: Synthesized Case Studies, Metrics, and Lessons for Privacy Resilience

Real-world ISO 27701 success from Tribeca, Kocho: DSAR efficiency gains, risk score reductions, certification ROI. Synthesized metrics prove privacy resilience

Unpacking the True Cost: A Guide to Calculating TCO for Modern Compliance Monitoring Software

Unpack the true Total Cost of Ownership (TCO) for compliance monitoring software. Factor in licenses, implementation, training, maintenance, and ROI savings for

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how LGPD and FSSC 22000 compare against other standards

Other LGPD Comparisons

Other FSSC 22000 Comparisons

What It Is

Key Components

**10 core principlespurpose limitation, necessity, transparency, security, prevention, non-discrimination, accountability.

**Data subject rightsaccess, correction, deletion, portability, objection to automated decisions.

**Legal bases10 options including consent, contracts, legitimate interests.

**Governancemandatory DPO for controllers, DPIAs for high-risk, ANPD enforcement with graduated sanctions.

Key Components

**Three pillarsISO 22000:2018 (clauses 4-10), sector-specific PRPs (e.g., ISO/TS 22002-1), FSSC Additional Requirements (e.g., food defense, allergens).

Over 100 requirements across management, operations, and verification.

Built on PDCA cycle and HACCP principles.

Third-party certification via licensed bodies with defined audit cycles.

Aspect

LGPD

FSSC 22000

Scope

Personal data protection and processing

Food safety management systems

Industry

All sectors, Brazil-focused, global reach

Food chain sectors worldwide

Nature

Mandatory law with ANPD enforcement

Voluntary GFSI-benchmarked certification

Testing

DPIAs for high-risk, ANPD audits

CB audits, surveillance, recertification

Penalties

Fines up to 2% Brazilian revenue

Loss of certification, no fines