What is the primary objective of LGPD?

The primary objective of LGPD (Lei Geral de Proteção de Dados Pessoais, Law No. 13.709/2018) is to protect the fundamental rights of freedom, intimacy, and personal data of natural persons through comprehensive regulation of processing activities. Enacted August 14, 2018, with full sanctions from August 1, 2021, it unifies prior fragmented laws under 10 core principles (Art. 6), including purpose limitation, necessity, transparency, security, prevention, non-discrimination, and accountability, while granting data subjects rights like access, correction, deletion, portability, and objection to automated decisions (Art. 18).

Who is legally or professionally required to comply with LGPD?

All controllers and operators processing personal data in Brazil, targeting Brazilian residents, or collected therein must comply with LGPD, regardless of organization size or location (Art. 3). This extraterritorial scope applies to public/private entities in sectors like e-commerce, fintech, healthcare, and cloud services; no employee/revenue thresholds exist, capturing multinationals via B2B/employee data. Controllers decide purposes/means (Art. 5, VI); operators execute instructions (Art. 5, VII).

Does LGPD require an external audit or third-party certification?

LGPD does not mandate external audits or third-party certification, but ANPD may conduct audits and require Records of Processing Activities (RoPAs) or DPIAs on demand (Arts. 37, 38). Controllers must maintain internal governance, including DPO appointment (Art. 41, potentially universal with public disclosure), security measures, and incident logs (5 years). Voluntary certifications like ISO 27701 enhance maturity but are not compulsory.

How often should an assessment for LGPD be performed?

LGPD requires ongoing assessments via continuous monitoring, with annual internal audits, quarterly RoPA reviews, and DPIAs for high-risk processing like legitimate interests or sensitive data (Art. 38). ANPD guidance (e.g., CD/ANPD No. 15/2024) mandates regular vendor audits, risk scoring, and updates to data mappings/incident plans; ad-hoc triggers include new processing or ANPD inquiries.

What are the consequences of non-compliance with LGPD?

Non-compliance with LGPD incurs graduated ANPD sanctions, including warnings, fines up to 2% of Brazilian revenue (capped at R$50 million per infraction), data blocking/deletion, processing suspension (up to 6 months, extendable), and publicity of infractions (Art. 52). Factors like gravity, cooperation, and safeguards influence severity; civil claims for damages (Art. 42) add reputational/operational risks.

Can LGPD be mapped to other international frameworks?

Yes, LGPD maps closely to international frameworks due to shared principles, rights, and risk-based approaches, enabling hybrid compliance programs. Its 10 principles and data subject rights align with GDPR (e.g., purpose limitation, minimization), while legal bases (Art. 7) and security mandates support NIST/ISO 27001 adaptations; ANPD resolutions facilitate cross-mapping for multinationals.

What is the first step to begin implementing LGPD?

The first step to implement LGPD is appointing a Data Protection Officer (DPO) and conducting enterprise-wide data mapping to create a Record of Processing Activities (RoPA) (Arts. 37, 41). Secure executive sponsorship, inventory data flows/purposes/legal bases, identify sensitive data/cross-border transfers, and prioritize high-risk areas for gap analysis.

What is the primary objective of TISAX?

TISAX's primary objective is to standardize information security assessments and enable secure exchange of results across the automotive supply chain via the ENX portal. Developed by the ENX Association using the VDA ISA catalog (version 6.0 or later), it verifies protection of sensitive data like IP, prototypes, and personal information against cyber threats, emphasizing the CIA triad at Basic, Significant, and Very High maturity levels.

Who is legally or professionally required to comply with TISAX?

TISAX compliance is a contractual requirement for automotive OEMs, Tier 1/Tier 2 suppliers, service providers, and logistics firms handling sensitive automotive data. Mandated by OEMs like Volkswagen and BMW in RFPs and agreements, it applies to any entity processing OEM IP (e.g., ADAS software, prototypes), regardless of size—scalable from SMEs via self-assessments to multinationals requiring full audits.

Does TISAX require an external audit or third-party certification?

Yes, TISAX requires assessments by ENX-accredited providers (e.g., DQS, TÜV) for Significant and Very High levels, issuing labels valid for three years. AL1 allows self-assessment without labels; AL2 involves remote plausibility checks; AL3 mandates on-site audits with interviews, facility inspections, and evidence review per VDA ISA's 70+ controls across seven groups.

How often should an assessment for TISAX be performed?

TISAX assessments must be performed every three years to renew labels on the ENX portal. No annual surveillance audits are required, but continuous monitoring via internal audits, PDCA cycles, and quarterly reviews ensures maturity; reassessments apply after major changes like new scopes or VDA ISA updates.

What are the consequences of non-compliance with TISAX?

Non-compliance with TISAX results in contractual termination, lost OEM portal access, and revenue forfeiture (e.g., €10-50M for mid-tier suppliers). ENX-partnered OEMs impose penalties up to 5% of contract value, plus €20K-€100K re-audit costs; reputational damage and production halts cascade through just-in-time chains.

Can TISAX be mapped to other international frameworks?

Yes, TISAX maps directly to ISO 27001 and ISO 27002 via the VDA ISA catalog, enabling control reuse and integrated audits. It extends ISO with automotive-specific modules (e.g., prototype protection), achieving 70-90% audit efficiency gains and 20-30% cost savings for dual implementations.

What is the first step to begin implementing TISAX?

The first step is registering on the ENX portal (enx.com) and defining the Assessment Scope and Leadership Profile (ASLP). Collaborate with OEMs to classify protection needs (Normal/High/Very High), then download VDA ISA 6.0 for gap analysis across policy, access, and operations controls.

Standards Comparison

LGPD vs TISAX

LGPD

Mandatory

2020

Brazil's comprehensive regulation for personal data protection

TISAX

Mandatory

2017

Automotive framework for standardized information security assessments

Quick Verdict

LGPD mandates personal data protection for Brazilian residents across industries with ANPD fines, while TISAX provides voluntary security assessments for automotive suppliers via ENX labels. Companies adopt LGPD for legal compliance, TISAX for OEM contracts and supply chain trust.

Data Privacy

LGPD

Lei Geral de Proteção de Dados Pessoais (Law No. 13.709/2018)

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Extraterritorial scope targeting Brazilian residents worldwide
10 core principles including prevention and non-discrimination
Fines up to 2% Brazilian revenue capped at R$50M
Mandatory DPO appointment for controllers with disclosure
3-business-day breach notifications to ANPD and subjects

Cybersecurity

TISAX

Trusted Information Security Assessment Exchange (TISAX)

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Standardized assessments exchanged via ENX portal
Automotive-specific prototype protection controls
Three risk-based assessment levels AL1-AL3
70+ VDA ISA controls based on ISO 27001
Three-year labels reduce duplicate OEM audits

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

LGPD Details

What It Is

Lei Geral de Proteção de Dados Pessoais (LGPD), Law No. 13.709/2018, is Brazil's comprehensive federal regulation for personal data processing. It protects data subjects' rights with extraterritorial scope, applying to any processing targeting Brazilian residents. Adopting a risk-based approach, it mandates 10 principles like purpose limitation, necessity, and accountability.

Key Components

10 core principles (e.g., transparency, security, non-discrimination)
10 legal bases for processing (consent, legitimate interests, etc.)
Data subject rights (access, deletion, portability)
ANPD enforcement with graduated sanctions
DPIAs for high-risk activities; no formal certification but records and DPO required

Why Organizations Use It

LGPD compliance avoids fines up to 2% Brazilian revenue (R$50M cap), operational halts, and reputational harm. It builds trust, enables market access in Brazil's digital economy, reduces breach risks, and supports AI innovation via anonymization exemptions.

Implementation Overview

Phased risk-based methodology: governance/DPO appointment, data mapping/RoPAs, policies, technical controls, DSR/incident processes, vendor SCCs. Applies to all sizes/industries processing Brazilian data; ANPD audits enforce, no certification but ongoing monitoring essential.

TISAX Details

What It Is

TISAX (Trusted Information Security Assessment Exchange) is an industry-specific assessment framework and exchange platform for information security in the automotive supply chain. Developed by the ENX Association based on the VDA ISA catalog (version 6.0+), it verifies protection of sensitive data like IP, prototypes, and personal information against cyber threats. It uses a risk-based approach with three maturity levels: Basic, Significant, Very High.

Key Components

70+ controls across 7 groups: Policy, Organization, Personnel, Physical Security, Access, Cryptography, Operations.
Built on ISO 27001 with automotive extensions like prototype protection.
Assessment levels (AL1 self-assess, AL2 remote, AL3 on-site) and modular objectives (e.g., prototype parts/vehicles).
3-year labels shared via ENX portal.

Why Organizations Use It

Contractual mandates from OEMs (e.g., BMW, VW) prevent revenue loss.
Reduces duplicate audits (70-90% efficiency), enhances market access, mitigates €4.5M breach costs.
Builds trust, enables IP protection in €2.5T supply chain.

Implementation Overview

Phased (6-18 months): gap analysis, control remediation, tabletop exercises, accredited audits (e.g., DQS, TÜV). Targets automotive suppliers/OEMs globally; scalable for SMEs to enterprises.

Key Differences

Aspect	LGPD	TISAX
Scope	Personal data protection, rights, processing principles	Information security, prototype protection, supply chain
Industry	All sectors, Brazil-focused, extraterritorial for residents	Automotive supply chain, primarily European OEMs/suppliers
Nature	Mandatory national law, ANPD enforcement, fines	Voluntary industry assessment, ENX/VDA governed, contractual
Testing	DPIAs for high-risk, ANPD audits, no certification	AL1-AL3 assessments, on-site audits, 3-year labels
Penalties	2% Brazilian revenue fines (R$50M cap), suspensions	Contract loss, no direct fines, audit failure

Scope

LGPD

Personal data protection, rights, processing principles

TISAX

Information security, prototype protection, supply chain

Industry

LGPD

All sectors, Brazil-focused, extraterritorial for residents

TISAX

Automotive supply chain, primarily European OEMs/suppliers

Nature

LGPD

Mandatory national law, ANPD enforcement, fines

TISAX

Voluntary industry assessment, ENX/VDA governed, contractual

Testing

LGPD

DPIAs for high-risk, ANPD audits, no certification

TISAX

AL1-AL3 assessments, on-site audits, 3-year labels

Penalties

LGPD

2% Brazilian revenue fines (R$50M cap), suspensions

TISAX

Contract loss, no direct fines, audit failure

Frequently Asked Questions

Common questions about LGPD and TISAX

LGPD FAQ

TISAX FAQ

You Might also be Interested in These Articles...

NIST 800-53 Private Sector ROI Uncovered: 2025 Podcast Deep Dive into Control Family Impact on $10M+ Breach Aversions

Uncover NIST 800-53 ROI in healthcare & finance: RA, SI, IR controls break even after 1-2 incidents ($100K-$10M savings). Podcast deep dive with CISO metrics fo

Top 10 Reasons CMMC Level 3 Certification Unlocks Competitive Edge for Primes Handling Critical DoD Programs

Discover top 10 reasons CMMC Level 3 certification unlocks competitive edge for DoD primes. Reduced APT risks, procurement prefs, NIST 800-172 compliance via v2

NIST CSF 2.0 Implementation Tiers Roadmap: Step-by-Step Guide from Partial to Adaptive Cybersecurity Maturity

Master NIST CSF 2.0 Implementation Tiers with a step-by-step roadmap. Assess your tier, build gap analyses, and advance from Partial (Tier 1) to Adaptive (Tier

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how LGPD and TISAX compare against other standards

Other LGPD Comparisons

Other TISAX Comparisons

What It Is

Key Components

10 core principles (e.g., transparency, security, non-discrimination)

10 legal bases for processing (consent, legitimate interests, etc.)

Data subject rights (access, deletion, portability)

ANPD enforcement with graduated sanctions

DPIAs for high-risk activities; no formal certification but records and DPO required

What It Is

Key Components

70+ controls across 7 groups: Policy, Organization, Personnel, Physical Security, Access, Cryptography, Operations.

Built on ISO 27001 with automotive extensions like prototype protection.

Assessment levels (AL1 self-assess, AL2 remote, AL3 on-site) and modular objectives (e.g., prototype parts/vehicles).

3-year labels shared via ENX portal.

Aspect

LGPD

TISAX

Scope

Personal data protection, rights, processing principles

Information security, prototype protection, supply chain

Industry

All sectors, Brazil-focused, extraterritorial for residents

Automotive supply chain, primarily European OEMs/suppliers

Nature

Mandatory national law, ANPD enforcement, fines

Voluntary industry assessment, ENX/VDA governed, contractual

Testing

DPIAs for high-risk, ANPD audits, no certification

AL1-AL3 assessments, on-site audits, 3-year labels

Penalties

2% Brazilian revenue fines (R$50M cap), suspensions

Contract loss, no direct fines, audit failure