What is the primary objective of **LGPD**?

**The primary objective of LGPD (Lei Geral de Proteção de Dados Pessoais, Law No. 13.709/2018) is to protect the fundamental rights of privacy and freedom of natural persons by regulating the processing of personal data.** Enacted on August 14, 2018, with full enforcement from August 1, 2021, it establishes 10 core principles (Art. 6), including purpose limitation, necessity, transparency, security, prevention, non-discrimination, and accountability, while granting data subjects rights such as access, correction, deletion, portability, and objection to automated decisions (Art. 18).

Who is legally or professionally required to comply with **LGPD**?

**All controllers and processors handling personal data of Brazilian residents must comply with LGPD, regardless of company size or location.** Its extraterritorial scope (Art. 3) applies to any processing in Brazil, targeting Brazilian residents for goods/services, or collecting data there. Controllers decide purposes/means (Art. 5, VI); processors execute instructions (Art. 5, VII). No employee/revenue thresholds exist; public/private entities, including multinationals in e-commerce, fintech, healthcare, and cloud services, are liable.

Does **LGPD** require an external audit or third-party certification?

**LGPD does not mandate external audits or third-party certification.** The **Autoridade Nacional de Proteção de Dados (ANPD)** conducts audits (Arts. 55-56), but organizations must maintain records of processing activities (Art. 37), perform Data Protection Impact Assessments (DPIAs) for high-risk activities (Art. 38), and demonstrate accountability via internal governance, including a mandatory Data Protection Officer (DPO) for controllers (Art. 41, with public disclosure).

How often should an assessment for **LGPD** be performed?

**LGPD requires ongoing assessments, with Records of Processing Activities (RoPAs) maintained continuously and DPIAs conducted for high-risk processing like legitimate interests or sensitive data.** ANPD regulations (e.g., CD/ANPD No. 02/2022) mandate simplified records for small entities; security incident logs must be kept for 5 years. Best practice involves quarterly internal audits, annual full reviews, and ad-hoc updates for new processing or ANPD guidance changes.

What are the consequences of non-compliance with **LGPD**?

**Non-compliance with LGPD triggers graduated ANPD sanctions, including fines up to 2% of Brazilian revenue (capped at R$50 million per infraction), data processing suspension (up to 6 months, extendable), deletion orders, and public disclosure.** Factors considered: infraction gravity, recidivism, cooperation, and safeguards (Art. 53). Additional risks include civil claims for damages (Art. 42) and operational disruptions.

Can **LGPD** be mapped to other international frameworks?

**Yes, LGPD can be mapped to other international frameworks due to shared principles like purpose limitation, minimization, transparency, and data subject rights.** Its 10 principles (Art. 6) and 10 legal bases (Art. 7) align closely with global regimes, facilitating hybrid programs; ANPD-approved Standard Contractual Clauses (SCCs, Resolution CD/ANPD No. 19/2024) support transfers, with no adequacy decisions issued yet.

What is the first step to begin implementing **LGPD**?

**The first step to implement LGPD is appointing a Data Protection Officer (DPO) and conducting a comprehensive data mapping to create a Record of Processing Activities (RoPA).** Secure executive sponsorship, inventory data flows/purposes/legal bases (Art. 37), identify sensitive data/high-risk processing, and prioritize remediation per ANPD guidance.

What is the primary objective of **SAMA CSF**?

**SAMA CSF aims to create a common cybersecurity approach across regulated financial institutions, achieve minimum Maturity Level 3, and ensure proper management of cybersecurity risks.** Issued in May 2017 by the Saudi Arabian Monetary Authority, it structures controls across four domains—Cyber Security Leadership and Governance, Risk Management and Compliance, Operations and Technology, and Third Party Cyber Security—using a principle-based, 5-pillar, 29-objective, 114-subcontrol matrix and a six-tier maturity model from Level 0 (Non-existent) to Level 5 (Adaptive).

Who is legally or professionally required to comply with **SAMA CSF**?

**SAMA CSF is mandatory for all SAMA-regulated financial institutions in Saudi Arabia, including banks, insurance and reinsurance companies, financing companies, credit bureaus, and financial market infrastructures.** Full applicability targets banks across all domains; non-banks have tailored exceptions (e.g., excluding payment systems unless handling cards/SWIFT). Boards, senior management, CISOs, and compliance functions bear accountability, with a Saudi national CISO requiring SAMA no-objection.

Does **SAMA CSF** require an external audit or third-party certification?

**No, SAMA CSF does not mandate external audits or third-party certification; compliance relies on periodic internal self-assessments using SAMA questionnaires and supervisory reviews by SAMA.** Independent internal audits per 3.2.5 are required, with evidence of the documentation pyramid (policy-standard-procedure) and KPIs at Level 3. SAMA conducts audits to verify maturity, but no ISO-like certification regime exists.

How often should an assessment for **SAMA CSF** be performed?

**SAMA CSF requires periodic self-assessments using SAMA-provided questionnaires to gauge maturity levels and control effectiveness.** These occur regularly for benchmarking against peers, with annual reviews of critical assets (3.2.4), triggered by projects, outsourcing, or new products (3.2.1). Higher maturity (Levels 4-5) demands continuous KRIs, trend analysis, and post-incident evaluations.

What are the consequences of non-compliance with **SAMA CSF**?

**Non-compliance with SAMA CSF triggers SAMA supervisory actions, including remediation directives, heightened scrutiny, operational restrictions, and potential fines, as evidenced by 2019 penalties on 16 institutions like Al Rajhi Bank.** While specific CSF fines are not detailed, violations invoke broader SAMA powers, risking license conditions, reputational damage, and systemic intervention for critical infrastructure.

Can **SAMA CSF** be mapped to other international frameworks?

**Yes, SAMA CSF explicitly aligns with NIST CSF 2.0, ISO 27001, PCI DSS, BASEL, and SWIFT CSCF, enabling control mappings for integrated compliance.** Its principle-based design and maturity model facilitate dual implementations, e.g., NIST functions to SAMA domains for incident response evolution, with tools like EasyAudit supporting gap analyses and evidence management.

What is the first step to begin implementing **SAMA CSF**?

**The first step is conducting a comprehensive gap analysis against the framework's 114 subcontrols and six-tier maturity model to establish baseline maturity.** Secure Board sponsorship, form a Cyber Security Committee, inventory assets, and develop a phased roadmap prioritizing governance (Domain 3.1) and high-risk areas like IAM and incident response, using GRC tools for automation.

LGPD vs SAMA CSF

Standards Comparison

LGPD

Mandatory

2020

Brazil's comprehensive regulation for personal data protection

SAMA CSF

Mandatory

2017

Saudi regulatory framework for financial cybersecurity.

Quick Verdict

LGPD governs personal data protection across Brazil's economy with rights and fines, while SAMA CSF mandates cybersecurity maturity for Saudi financial firms via controls and audits. Companies adopt LGPD for compliance and trust, SAMA CSF for regulatory resilience.

Data Privacy

LGPD

Lei Geral de Proteção de Dados Pessoais (Law 13.709/2018)

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Extraterritorial scope targeting Brazilian residents' data
10 core principles including prevention, non-discrimination
Fines up to 2% Brazilian revenue per violation
Mandatory DPO appointment for controllers
3-business-day breach notifications to ANPD

Cybersecurity

SAMA CSF

SAMA Cyber Security Framework Version 1.0

Cost

€€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Six-tier maturity model with Level 3 baseline
Four domains and 114 detailed subcontrols
Board-endorsed governance and independent CISO
Principle-based risk management with waivers
Third-party risk and payment system controls

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

LGPD Details

What It Is

Lei Geral de Proteção de Dados Pessoais (LGPD), Law No. 13.709/2018, is Brazil's federal data protection regulation. Enacted in 2018 with full enforcement from 2021, it governs personal and sensitive data processing with extraterritorial scope for entities targeting Brazilian residents. Adopts a risk-based approach emphasizing accountability, principles, and data subject rights akin to GDPR but with Brazilian adaptations.

Key Components

**10 core principlespurpose limitation, adequacy, necessity, transparency, security, prevention, non-discrimination, accountability.
**Data subject rightsaccess, correction, deletion, portability, anonymization, objection to automated decisions.
**10 legal basesconsent, contracts, legitimate interests, legal obligations, sensitive data restrictions.
**ANPD enforcementgraduated sanctions up to 2% Brazilian revenue (R$50M cap), no formal certification but audits required.

Why Organizations Use It

Mandatory compliance avoids fines, suspensions, litigation.
Mitigates breach risks, reputational harm in $2T digital economy.
Builds trust, unlocks market access, partnerships.
Drives efficiency, innovation via anonymization exemptions.

Implementation Overview

**Phased methodologygovernance/DPO appointment, data mapping/RoPA, policies/DSR automation, technical controls/DPIAs, vendor SCCs, monitoring/training.
Applies universally to public/private entities processing Brazilian data.
ANPD oversees via audits, incident reports; scalable for SMEs.

SAMA CSF Details

What It Is

SAMA Cyber Security Framework (CSF) Version 1.0 is a mandatory regulatory framework issued by the Saudi Arabian Monetary Authority in May 2017. It applies to all regulated financial institutions in Saudi Arabia, focusing on protecting information assets' confidentiality, integrity, and availability. Adopting a principle-based, risk-centric approach, it draws from NIST, ISO 27001, and others.

Key Components

Four domains: Leadership/Governance, Risk Management/Compliance, Operations/Technology, Third-Party Security.
5 pillars, 29 objectives, 114 subcontrols.
Six-tier maturity model (Level 3 minimum: structured policies/standards/procedures).
Self-assessments and SAMA audits for compliance.

Why Organizations Use It

Mandatory for banks, insurers, etc., with enforcement via fines.
Enhances resilience, aligns with Vision 2030.
Builds trust, reduces risks, enables ERM integration.
Competitive edge through maturity benchmarking.

Implementation Overview

Phased: gap analysis, governance, controls, monitoring.
Targets financial sector; scalable by size.
Requires GRC tools, training; periodic self-assessments audited by SAMA.

Key Differences

Aspect	LGPD	SAMA CSF
Scope	Personal data processing, rights, transfers	Cybersecurity domains, maturity model, controls
Industry	All sectors in Brazil, extraterritorial	Saudi financial institutions only
Nature	Mandatory data protection law	Mandatory cybersecurity framework
Testing	DPIAs for high-risk, ANPD audits	Self-assessments, maturity levels, SAMA audits
Penalties	2% Brazilian revenue fines max R$50M	Regulatory fines, enforcement actions

Scope

LGPD

Personal data processing, rights, transfers

SAMA CSF

Cybersecurity domains, maturity model, controls

Industry

LGPD

All sectors in Brazil, extraterritorial

SAMA CSF

Saudi financial institutions only

Nature

LGPD

Mandatory data protection law

SAMA CSF

Mandatory cybersecurity framework

Testing

LGPD

DPIAs for high-risk, ANPD audits

SAMA CSF

Self-assessments, maturity levels, SAMA audits

Penalties

LGPD

2% Brazilian revenue fines max R$50M

SAMA CSF

Regulatory fines, enforcement actions

Frequently Asked Questions

Common questions about LGPD and SAMA CSF

LGPD FAQ

SAMA CSF FAQ

You Might also be Interested in These Articles...

Your Guide to Implementing PCI DSS in Your Organization

Step-by-step guide to implementing PCI DSS in your organization. Achieve compliance, protect cardholder data, and reduce risks. Start securing payments today!

SOC 2 for Bootstrapped SaaS: Lazy Founder's Automation Roadmap with Vanta/Drata Templates

Bootstrapped SaaS founders: Achieve SOC 2 Type 2 in 3 months with Vanta automation (cuts 70% manual work). Free templates, workflows, screenshots, metrics & Sig

DORA Third-Party Risk Management: A Consultant’s Guide to Mapping Critical ICT Service Providers in 2026

Navigate DORA's complex third-party risk pillar. Step-by-step consultant guide to identify critical ICT providers, remediate Article 30 contracts, and build the

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Check out these other Gradum.io Standards Comparison Pages

K-PIPA vs ISO 21001

Compare K-PIPA vs ISO 21001: Navigate South Korea's stringent privacy law alongside educational standards. Ensure data protection, learner trust & compliance. Discover key differences now!

COPPA vs SOC 2

Discover COPPA vs SOC 2: Child privacy rules (under-13 consent, $170M fines) vs security controls (TSC audits). Master compliance, avoid penalties, build trust for apps/sites now!

CMMI vs EU AI Act

Discover CMMI vs EU AI Act: Compare process maturity frameworks with risk-based AI regs. Unlock synergies for compliance, governance & innovation in software/IT. Align strategies now!

LGPD

SAMA CSF

Quick Verdict

LGPD

Key Features

SAMA CSF

Key Features

Detailed Analysis

LGPD Details

What It Is

Key Components

Why Organizations Use It

Implementation Overview

SAMA CSF Details

What It Is

Key Components

Why Organizations Use It

Implementation Overview

Key Differences

Scope

Industry

Nature

Testing

Penalties

Frequently Asked Questions

LGPD FAQ

What is the primary objective of LGPD?

Who is legally or professionally required to comply with LGPD?

Does LGPD require an external audit or third-party certification?

How often should an assessment for LGPD be performed?

What are the consequences of non-compliance with LGPD?

Can LGPD be mapped to other international frameworks?

What is the first step to begin implementing LGPD?

SAMA CSF FAQ

What is the primary objective of SAMA CSF?

Who is legally or professionally required to comply with SAMA CSF?

Does SAMA CSF require an external audit or third-party certification?

How often should an assessment for SAMA CSF be performed?

What are the consequences of non-compliance with SAMA CSF?

Can SAMA CSF be mapped to other international frameworks?

What is the first step to begin implementing SAMA CSF?

You Might also be Interested in These Articles...

Your Guide to Implementing PCI DSS in Your Organization

SOC 2 for Bootstrapped SaaS: Lazy Founder's Automation Roadmap with Vanta/Drata Templates

DORA Third-Party Risk Management: A Consultant’s Guide to Mapping Critical ICT Service Providers in 2026

Run Maturity Assessments with GRADUM

Check out these other Gradum.io Standards Comparison Pages

K-PIPA vs ISO 21001

COPPA vs SOC 2

CMMI vs EU AI Act