What is the primary objective of LGPD?

The primary objective of LGPD (Lei Geral de Proteção de Dados Pessoais, Law No. 13.709/2018) is to protect the fundamental rights of privacy and freedom of natural persons by establishing rules for processing personal data. Enacted August 14, 2018, effective September 2020 with sanctions from August 1, 2021, it mandates 10 core principles (Art. 6)—purpose limitation, adequacy, necessity, transparency, security, prevention, non-discrimination, accountability, data quality, and free access—for controllers and processors. LGPD defines personal data (Art. 5, I) as information relating to identified/identifiable natural persons and sensitive data (Art. 5, II) like health or biometrics, enforced by ANPD.

Who is legally or professionally required to comply with LGPD?

All controllers and processors handling personal data of individuals located in Brazil must comply with LGPD, regardless of company size or location. Its extraterritorial scope (Art. 3) applies to any processing in Brazil, targeting individuals located in Brazil for goods/services, or data collected there. No employee/revenue thresholds exist; public/private entities, including multinationals in e-commerce, fintech, healthcare, and cloud services, are liable. Exemptions (Art. 4) cover non-economic private uses, journalism, and public security.

Does LGPD require an external audit or third-party certification?

LGPD does not mandate external audits or third-party certification. ANPD conducts audits (Art. 55), but organizations must maintain Records of Processing Activities (RoPAs, Art. 37, simplified for small entities per CD/ANPD 02/2022) and perform Data Protection Impact Assessments (DPIAs) for high-risk processing (Art. 38). Voluntary certifications like ISO 27701 enhance maturity, but accountability relies on internal governance, including mandatory DPOs for controllers.

How often should an assessment for LGPD be performed?

LGPD assessments, including RoPAs and DPIAs, must be maintained continuously with updates for new processing or risks. ANPD requires incident logs for 5 years (Res. CD/ANPD 15/2024) and ongoing monitoring. Best practices recommend quarterly internal audits, annual full reviews, and ad-hoc DPIAs for high-risk activities like legitimate interests or sensitive data processing.

What are the consequences of non-compliance with LGPD?

Non-compliance with LGPD incurs graduated ANPD sanctions up to 2% of Brazilian revenue (capped at R$50 million per infraction). Nine penalties (Art. 52) include warnings, daily fines, publicity, data blocking/deletion, and 6-month processing suspensions (extendable). Factors like gravity, cooperation, and safeguards influence severity; civil claims for damages (Art. 42) add liability.

Can LGPD be mapped to other international frameworks?

Yes, LGPD maps closely to GDPR due to shared principles, rights, and extraterritoriality, enabling hybrid compliance programs. LGPD's 10 principles and bases exceed GDPR's, with nuances like revenue-based fines (2% Brazil vs. 4% global) and controller-only DPOs. Multinationals leverage overlaps in data subject rights (Art. 18) and security for efficiency.

What is the first step to begin implementing LGPD?

The first step for LGPD implementation is appointing a Data Protection Officer (DPO) and conducting data mapping for a Record of Processing Activities (RoPA). Per Art. 41 and Art. 37, publish DPO details publicly; inventory data flows, purposes, legal bases (Art. 7), and risks to prioritize high-risk processing like sensitive data or transfers.

What is the primary objective of PDPA?

The primary objective of PDPA is to govern the collection, use, and disclosure of personal data by organisations while balancing individuals’ right to protect their data and organisations’ need to process it for reasonable purposes. Singapore’s PDPA (2012) articulates this in PDPC Advisory Guidelines, covering data protection provisions effective 2 July 2014 and Do Not Call elements from 2 January 2014. Thailand’s PDPA (effective 1 June 2022) and Taiwan’s (2016) similarly emphasise transparency, security, and accountability.

Who is legally or professionally required to comply with PDPA?

All organisations processing personal data of residents in PDPA jurisdictions—Singapore, Thailand, Taiwan—are required to comply, including controllers and processors with extraterritorial reach. Singapore regulates “organisations”; Thailand applies to data controllers/processors handling Thai residents’ data regardless of location; Taiwan covers government/non-government agencies. No employee/revenue thresholds apply universally, but Thailand mandates DPOs for processing 100,000+ data subjects or sensitive data activities.

Does PDPA require an external audit or third-party certification?

No, PDPA does not mandate external audits or third-party certification; compliance relies on internal accountability, policies, and demonstrable reasonable safeguards. Singapore’s PDPC expects organisations to appoint a DPO and maintain a Data Protection Management Programme. Thailand and Taiwan emphasise self-assessments, risk mechanisms, and security measures without statutory certification requirements.

How often should an assessment for PDPA be performed?

PDPA assessments should be performed periodically, with continuous monitoring, risk reviews, and updates tied to changes in processing or regulations. Singapore PDPC guidance recommends ongoing Data Protection Management Programmes with regular audits. Thailand requires periodic security measure reviews; Taiwan’s Enforcement Rules stress continuous improvement, risk assessments, and internal audits without fixed frequencies.

What are the consequences of non-compliance with PDPA?

Non-compliance with PDPA incurs administrative fines up to 10% of annual turnover or SGD 1 million (Singapore), THB 5 million (Thailand), criminal liability including imprisonment (Thailand/Taiwan), and director/manager exposure. Singapore enforces via PDPC investigations; Thailand’s PDPC issues orders with civil/criminal sanctions; Taiwan imposes monetary penalties and corrective orders like data erasure.

Can PDPA be mapped to other international frameworks?

No, these FAQs address PDPA standalone; mapping to frameworks like GDPR requires jurisdiction-specific analysis. PDPA regimes share principles (consent, rights, transfers) but diverge in mechanics (e.g., Singapore’s deemed consent, Thailand’s 72-hour breach notification).

What is the first step to begin implementing PDPA?

The first step to implement PDPA is to appoint a Data Protection Officer and conduct comprehensive data mapping/inventory. Singapore mandates DPO designation; Thailand requires it above thresholds. Map personal data flows, purposes, processors, and risks per PDPC guidelines to establish a baseline for governance and DPIAs.

Standards Comparison

LGPD vs PDPA

LGPD

Mandatory

2020

Brazil's comprehensive regulation for personal data protection

PDPA

Mandatory

2012

Singapore regulation for personal data protection.

Quick Verdict

LGPD mandates comprehensive data protection for individuals located in Brazil with extraterritorial reach and ANPD enforcement, while PDPA frameworks (Singapore/Thailand) govern private sector processing with jurisdiction-specific PDPCs. Companies adopt LGPD for Brazil market access, PDPA for regional compliance and trust.

Data Privacy

LGPD

Lei Geral de Proteção de Dados Pessoais (Law No. 13.709/2018)

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Extraterritorial scope targeting individuals located in Brazil
10 core principles including prevention and non-discrimination
10 legal bases exceeding GDPR for flexibility
Mandatory DPO appointment with public disclosure for controllers
3-business-day breach notifications to ANPD and subjects

Data Privacy

PDPA

Personal Data Protection Act 2012

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Mandatory Data Protection Officer appointment
72-hour data breach notification obligation
Consent with withdrawal and notification requirements
Cross-border transfer limitation safeguards
Accountability via DPMP and policies

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

LGPD Details

What It Is

LGPD (Lei Geral de Proteção de Dados Pessoais, Law No. 13.709/2018) is Brazil's comprehensive data protection regulation. It governs personal data processing with extraterritorial scope, applying to any entity targeting individuals located in Brazil. Primary purpose: safeguard privacy rights via risk-based accountability, mirroring GDPR but with Brazilian adaptations like 10 principles.

Key Components

10 core principles: purpose limitation, necessity, transparency, security, prevention, non-discrimination, accountability.
10 legal bases for processing (e.g., consent, legitimate interests, credit protection).
Data subject rights (access, deletion, portability, anonymization).
ANPD enforcement with graduated sanctions; mandatory DPO, DPIAs, RoPAs; SCCs for transfers.

Why Organizations Use It

Mandatory compliance avoids fines up to 2% Brazilian revenue (R$50M cap), operational halts. Benefits: risk reduction, trust-building, market access in Brazil's digital economy, synergies with GDPR for multinationals, competitive differentiation via privacy-by-design.

Implementation Overview

Phased risk-based approach: governance/DPO appointment, data mapping/RoPAs, policies/controls, DSR/incident processes, vendor/SCC management, audits. Applies to all sizes/industries processing Brazilian data; no certification but ANPD audits.

PDPA Details

What It Is

PDPA (Personal Data Protection Act 2012) is Singapore's principal regulation governing collection, use, disclosure, and protection of personal data by organizations. It balances individual privacy rights with legitimate business needs through a principles-based approach, emphasizing reasonable purposes, consent, and accountability.

Key Components

Nine core obligations: consent, notification, access/correction, accuracy, protection, retention limitation, transfer limitation, accountability, breach notification.
Built on principles like lawfulness, transparency, and proportionality.
Requires Data Protection Officer (DPO) appointment and Data Protection Management Programme (DPMP).
Compliance via self-assessment, PDPC guidance; no formal certification but enforcement with fines up to 10% of annual turnover or SGD 1 million.

Why Organizations Use It

Mandatory for Singapore organizations handling personal data.
Mitigates regulatory fines, breach risks, reputational damage.
Builds customer trust, enables data-driven innovation, supports cross-border operations.

Implementation Overview

Phased: governance, data mapping, policies, controls, training, audits.
Applies to all sizes/industries in Singapore; extraterritorial for data controllers.
Focuses on operational maturity via inventories, DPIAs, vendor contracts.

Key Differences

Aspect	LGPD	PDPA
Scope	Personal data processing in Brazil	Personal data in Singapore/Thailand/Taiwan
Industry	All sectors, extraterritorial for Brazilians	Private sector, jurisdiction-specific residents
Nature	Mandatory comprehensive law, ANPD enforcement	Mandatory acts, PDPC/PDPC enforcement varies
Testing	DPIAs for high-risk, ANPD audits	Risk assessments, self-assessments, audits
Penalties	2% Brazilian revenue, max R$50M	SGD1M/S$1M or THB5M, varies by jurisdiction

Scope

LGPD

Personal data processing in Brazil

PDPA

Personal data in Singapore/Thailand/Taiwan

Industry

LGPD

All sectors, extraterritorial for Brazilians

PDPA

Private sector, jurisdiction-specific residents

Nature

LGPD

Mandatory comprehensive law, ANPD enforcement

PDPA

Mandatory acts, PDPC/PDPC enforcement varies

Testing

LGPD

DPIAs for high-risk, ANPD audits

PDPA

Risk assessments, self-assessments, audits

Penalties

LGPD

2% Brazilian revenue, max R$50M

PDPA

SGD1M/S$1M or THB5M, varies by jurisdiction

Frequently Asked Questions

Common questions about LGPD and PDPA

LGPD FAQ

PDPA FAQ

You Might also be Interested in These Articles...

Image this: What if GDPR would have NOT been implemented by the EU

What if the EU never implemented GDPR? Explore this hypothetical: consumer data protection in Dec 2025, key differences, pros/cons for users & companies. Read t

HITRUST CSF MyCSF Platform Mastery: Infograph of Evidence Tagging Workflows and Top 5 Maturity Tier Acceleration Takeaways

Master MyCSF platform with infographics on evidence tagging for 1,400+ HITRUST controls across 19 domains. Cut documentation by 30%, boost Measured/Managed tier

From Hygiene to Governance: How to Scale Cyber Essentials into a Full ISO 27001 ISMS in 2026

Discover how to scale Cyber Essentials into a full ISO 27001 ISMS in 2026. Reuse evidence, map controls, meet DORA & NIS2 rules and win enterprise contracts.

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how LGPD and PDPA compare against other standards

Other LGPD Comparisons

Other PDPA Comparisons

Quick Verdict

What It Is

Key Components

10 core principles: purpose limitation, necessity, transparency, security, prevention, non-discrimination, accountability.

10 legal bases for processing (e.g., consent, legitimate interests, credit protection).

Data subject rights (access, deletion, portability, anonymization).

ANPD enforcement with graduated sanctions; mandatory DPO, DPIAs, RoPAs; SCCs for transfers.

What It Is

Key Components

Nine core obligations: consent, notification, access/correction, accuracy, protection, retention limitation, transfer limitation, accountability, breach notification.

Built on principles like lawfulness, transparency, and proportionality.

Requires Data Protection Officer (DPO) appointment and Data Protection Management Programme (DPMP).

Compliance via self-assessment, PDPC guidance; no formal certification but enforcement with fines up to 10% of annual turnover or SGD 1 million.

Aspect

LGPD

PDPA

Scope

Personal data processing in Brazil

Personal data in Singapore/Thailand/Taiwan

Industry

All sectors, extraterritorial for Brazilians

Private sector, jurisdiction-specific residents

Nature

Mandatory comprehensive law, ANPD enforcement

Mandatory acts, PDPC/PDPC enforcement varies

Testing

DPIAs for high-risk, ANPD audits

Risk assessments, self-assessments, audits

Penalties

2% Brazilian revenue, max R$50M

SGD1M/S$1M or THB5M, varies by jurisdiction