What is the primary objective of **LGPD**?

**The primary objective of **LGPD** (Lei Geral de Proteção de Dados Pessoais, Law No. 13.709/2018) is to protect the fundamental rights of privacy and freedom of natural persons through comprehensive regulation of personal data processing.** It establishes 10 core principles (Art. 6), including purpose limitation, necessity, transparency, security, prevention, non-discrimination, and accountability, while granting data subjects rights such as access, correction, deletion, portability, and objection to automated decisions (Art. 18).

Who is legally or professionally required to comply with **LGPD**?

**All controllers and processors handling personal data of Brazilian residents must comply with **LGPD**, regardless of company size or location, due to its extraterritorial scope (Art. 3).** This includes any processing in Brazil, targeting Brazilian residents for goods/services, or involving data collected in Brazil; applies to public/private entities in sectors like e-commerce, fintech, healthcare, and cloud services, with no employee/revenue thresholds.

Does **LGPD** require an external audit or third-party certification?

****LGPD** does not mandate external audits or third-party certification, but the **ANPD** can conduct audits and requires controllers to maintain processing records (Art. 37) and perform DPIAs for high-risk activities (Art. 38).** Graduated sanctions (Art. 52) incentivize internal governance, with voluntary certifications like ISO 27701 recommended for demonstrating compliance.

How often should an assessment for **LGPD** be performed?

**LGPD assessments, including Record of Processing Activities (RoPA) reviews and DPIAs, should be performed continuously, with annual internal audits and updates triggered by changes in processing activities or ANPD guidance.** Incident logs must be retained for 5 years (Resolution CD/ANPD No. 15/2024), and high-risk processing demands ongoing risk-based evaluations to uphold accountability (Art. 6, X).

What are the consequences of non-compliance with **LGPD**?

**Non-compliance with **LGPD** incurs graduated sanctions by the **ANPD**, including warnings, fines up to 2% of Brazilian revenue (capped at R$50 million per infraction), daily fines, data blocking/deletion, operational suspension up to 6 months (extendable), and prohibitions (Art. 52-53).** Factors like gravity, cooperation, and safeguards influence penalties, plus civil liability for damages (Art. 42).

Can **LGPD** be mapped to other international frameworks?

**Yes, **LGPD** maps closely to international frameworks due to shared principles like purpose limitation, minimization, and data subject rights, enabling hybrid compliance programs.** Its 10 principles and bases align with GDPR (e.g., extraterritoriality, DPIAs), though LGPD adds prevention/non-discrimination and revenue-based fines; ANPD-approved SCCs (Resolution No. 19/2024) facilitate transfers.

What is the first step to begin implementing **LGPD**?

**The first step to implement **LGPD** is appointing a Data Protection Officer (DPO) for controllers and conducting a comprehensive data mapping to create a Record of Processing Activities (RoPA) (Arts. 37, 41).** This identifies data flows, legal bases, sensitive data, and risks, forming the foundation for governance, DPIAs, and principles compliance.

What is the primary objective of **ISO 27018**?

**ISO 27018 provides a code of practice for protecting personally identifiable information (PII) in public clouds acting as PII processors.** It extends **ISO 27001** and **ISO 27002** with ~25–30 privacy-specific controls addressing cloud risks like multi-tenancy, subprocessors, consent, purpose limitation, data minimization, breach notification, and restrictions on secondary PII use (e.g., no marketing without consent). The 2025 edition aligns with **ISO 27002:2022**, emphasizing transparency, accountability, and PII lifecycle management from collection to deletion.

Who is legally or professionally required to comply with **ISO 27018**?

**ISO 27018 targets public cloud service providers (CSPs) acting as PII processors, not controllers.** Applicable to hyperscalers, regional CSPs, and sector-specific platforms (e.g., healthcare, finance) processing customer PII. Controllers use it for vendor due diligence, but compliance is voluntary guidance, not legally mandated; market pressure from procurement, insurers, and regulations like GDPR drives adoption for processor obligations.

Does **ISO 27018** require an external audit or third-party certification?

**ISO 27018 does not offer standalone certification; controls are assessed within an ISO 27001 audit by accredited bodies under ISO/IEC 17021 and 27006.** Auditors review **Statement of Applicability** inclusions during Stage 1 (documents) and Stage 2 (effectiveness), with certificates referencing both standards. Annual surveillance and 3-year recertification apply.

How often should an assessment for **ISO 27018** be performed?

**ISO 27018 assessments occur via annual surveillance audits post-ISO 27001 certification, with full recertification every 3 years.** Internal risk assessments and gap analyses should be continual, integrated into the **ISMS** to address changes in cloud services, subprocessors, or regulations.

What are the consequences of non-compliance with **ISO 27018**?

**Non-compliance with ISO 27018 risks loss of certification, procurement rejection, cyber insurance issues, and weakened legal defenses in breaches.** As voluntary guidance, direct penalties are absent, but failure exposes CSPs to regulatory fines (e.g., GDPR Article 28 violations), reputational damage, and contract losses from lacking audited PII processor assurances.

Can **ISO 27018** be mapped to other international frameworks?

**Yes, ISO 27018 maps directly to ISO 27001 Annex A (93 controls), ISO 27002, ISO 27017 (cloud security), and ISO 27701 (PIMS).** It aligns with GDPR Article 28 processor obligations, supporting data subject rights, subprocessor transparency, and breach notification; complements OECD privacy guidelines and ISO 29100 principles without replacing legal requirements.

What is the first step to begin implementing **ISO 27018**?

**Conduct a gap analysis against current ISMS, documenting ISO 27018 controls in the Statement of Applicability.** Engage stakeholders for discovery, review policies/contracts/technical controls for PII lifecycle gaps, prioritize remediation (e.g., subprocessor disclosure, breach procedures), and plan integration with ISO 27001 certification.

LGPD vs ISO 27018

Standards Comparison

LGPD

Mandatory

2020

Brazil's comprehensive regulation for personal data protection

ISO 27018

Voluntary

2019

International code for PII protection in public clouds

Quick Verdict

LGPD mandates comprehensive data protection for Brazilian residents across all sectors with fines up to 2% revenue, while ISO 27018 provides voluntary cloud privacy controls for processors via ISO 27001 audits. Companies adopt LGPD for legal compliance, ISO 27018 for trust and procurement advantage.

Data Privacy

LGPD

Lei Geral de Proteção de Dados Pessoais (Law No. 13.709/2018)

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Extraterritorial scope targets Brazilian residents' data processing
Ten core principles include prevention and non-discrimination
Fines up to 2% Brazilian revenue capped at R$50M
Mandatory Data Protection Officer for controllers
SCCs required for cross-border transfers by 2025

Cloud Privacy

ISO 27018

ISO/IEC 27018:2025 PII protection in public clouds

Cost

€€€

Complexity

Medium

Implementation Time

6-12 months

Key Features

Requires subprocessor disclosure and location transparency
Prohibits PII use for marketing without consent
Mandates breach notification to customers
Extends ISO 27001 with privacy-specific controls
Supports data subject rights like erasure

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

LGPD Details

What It Is

LGPD (Lei Geral de Proteção de Dados Pessoais, Law No. 13.709/2018) is Brazil's comprehensive data protection regulation. Enacted in 2018 and fully enforced since 2021, it adopts a risk-based approach to govern personal data processing with extraterritorial scope for Brazilian residents, mirroring GDPR but tailored to local principles.

Key Components

**10 core principlespurpose limitation, necessity, transparency, security, prevention, accountability.
**Data subject rightsaccess, correction, deletion, portability, objection to automated decisions.
**10 legal basesconsent, contracts, legitimate interests, etc.; stricter for sensitive data.
**ANPD enforcementgraduated sanctions, no formal certification but requires records, DPO, DPIAs.

Why Organizations Use It

Mandatory compliance avoids fines up to 2% Brazilian revenue (R$50M cap), operational halts. It reduces breach risks, builds stakeholder trust, enables market access in Brazil's digital economy, and provides competitive advantages via privacy-by-design.

Implementation Overview

**Phased risk-based methodologygovernance/DPO appointment, data mapping/RoPA, policies/controls, DSR/incident processes, vendor management, monitoring. Applies to all sizes/industries processing Brazilian data globally; ANPD audits ensure ongoing compliance.

ISO 27018 Details

What It Is

ISO/IEC 27018:2025 is a code of practice extending ISO 27001 and ISO 27002 for protecting personally identifiable information (PII) processed by public cloud service providers (CSPs) acting as PII processors. It employs a risk-based approach, adding ~25-30 privacy-specific controls addressing cloud risks like multi-tenancy and cross-border flows.

Key Components

Privacy controls on consent, purpose limitation, data minimization, transparency, accountability.
Integrated into ISO 27001 ISMS; assessed during its audits, not standalone certification.
Aligned with ISO 29100 principles and mapped to Annex A domains.

Why Organizations Use It

Builds trust, accelerates procurement via Statement of Applicability.
Supports GDPR Article 28, HIPAA processor obligations.
Mitigates risks, improves cyber insurance, differentiates in market.

Implementation Overview

Conduct gap analysis on existing ISMS, update policies/contracts.
Implement subprocessors disclosure, breach notification.
Applicable to CSPs all sizes; requires third-party audits annually.

Key Differences

Aspect	LGPD	ISO 27018
Scope	Personal data processing in Brazil, all sectors	PII protection in public clouds, processors only
Industry	All industries targeting Brazilian residents	Cloud service providers worldwide
Nature	Mandatory national law with ANPD enforcement	Voluntary code of practice, ISO 27001 extension
Testing	ANPD audits, DPIAs for high-risk processing	ISO 27001 audits including 27018 controls
Penalties	Fines up to 2% Brazilian revenue, R$50M cap	No legal penalties, loss of certification

Scope

LGPD

Personal data processing in Brazil, all sectors

ISO 27018

PII protection in public clouds, processors only

Industry

LGPD

All industries targeting Brazilian residents

ISO 27018

Cloud service providers worldwide

Nature

LGPD

Mandatory national law with ANPD enforcement

ISO 27018

Voluntary code of practice, ISO 27001 extension

Testing

LGPD

ANPD audits, DPIAs for high-risk processing

ISO 27018

ISO 27001 audits including 27018 controls

Penalties

LGPD

Fines up to 2% Brazilian revenue, R$50M cap

ISO 27018

No legal penalties, loss of certification

Frequently Asked Questions

Common questions about LGPD and ISO 27018

LGPD FAQ

ISO 27018 FAQ

You Might also be Interested in These Articles...

Proving CIS Controls v8.1 Works: A KPI & Evidence Framework for Board Reporting, Audits, and Continuous Assurance

Prove CIS Controls v8.1 effectiveness with KPI catalog, evidence checklist & reporting cadence. Ideal for board reports, audits & cyber-insurance. Measure outco

Your Compliance Command Center: How Modern Tools Orchestrate Cross-Departmental Adherence

Unlock your compliance command center with modern tools for real-time monitoring, automation & integrations across IT, HR, Legal & Finance. Slash non-compliance

CIS Controls v8.1, Operationalized: Top 10 Reasons Compliance Monitoring Software Accelerates Real-World Implementation

Operationalize CIS Controls v8.1 with compliance monitoring software. Turn checklists into dashboards, tickets, and audit-proof workflows. Top 10 reasons it acc

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Check out these other Gradum.io Standards Comparison Pages

CE Marking vs ISO 27017

Discover CE Marking vs ISO 27017: EU product compliance vs cloud security controls. Key differences, requirements & strategies for market access & data protection. Dive in!

ISO 22301 vs AS9120B

Discover ISO 22301 vs AS9120B: Compare BCMS resilience for disruptions with aerospace distributor QMS for traceability & counterfeit prevention. Key clauses, benefits, implementation tips. Choose wisely!

APPI vs AS9100

Compare APPI vs AS9100: Japan's privacy law vs aerospace QMS. Key differences, compliance strategies & pitfalls. Master both for global success—read now!

LGPD

ISO 27018

Quick Verdict

LGPD

Key Features

ISO 27018

Key Features

Detailed Analysis

LGPD Details

What It Is

Key Components

Why Organizations Use It

Implementation Overview

ISO 27018 Details

What It Is

Key Components

Why Organizations Use It

Implementation Overview

Key Differences

Scope

Industry

Nature

Testing

Penalties

Frequently Asked Questions

LGPD FAQ

What is the primary objective of LGPD?

Who is legally or professionally required to comply with LGPD?

Does LGPD require an external audit or third-party certification?

How often should an assessment for LGPD be performed?

What are the consequences of non-compliance with LGPD?

Can LGPD be mapped to other international frameworks?

What is the first step to begin implementing LGPD?

ISO 27018 FAQ

What is the primary objective of ISO 27018?

Who is legally or professionally required to comply with ISO 27018?

Does ISO 27018 require an external audit or third-party certification?

How often should an assessment for ISO 27018 be performed?

What are the consequences of non-compliance with ISO 27018?

Can ISO 27018 be mapped to other international frameworks?

What is the first step to begin implementing ISO 27018?

You Might also be Interested in These Articles...

Proving CIS Controls v8.1 Works: A KPI & Evidence Framework for Board Reporting, Audits, and Continuous Assurance

Your Compliance Command Center: How Modern Tools Orchestrate Cross-Departmental Adherence

CIS Controls v8.1, Operationalized: Top 10 Reasons Compliance Monitoring Software Accelerates Real-World Implementation

Run Maturity Assessments with GRADUM

Check out these other Gradum.io Standards Comparison Pages

CE Marking vs ISO 27017

ISO 22301 vs AS9120B

APPI vs AS9100