The General Data Protection Regulation (Regulation (EU) 2016/679) applies to those who process personal data in the European Union, even from Brazil. Privacy Tools It handles both GDPR and LGPD in the same registration.
The GDPR is the European Union's data protection regulation, in effect since May 25, 2018. Official source: Text of the regulation in EUR-Lex.
The main obligations of the regulation are:
What the regulation defines for companies inside and outside the European Union:
Activities, data subjects, and risks are all contained in a single registry that complies with both GDPR and LGPD: the Data Mapping generates the registration of article 30; a Management of Holders' Requests controls the one-month deadline; the Incident Management Organize the notification within 72 hours.
Os Diagnoses and Assessments They produce the DPIA; a Consent Management and Cookie Management and Policies They record valid consents; Third Party Risk Management It documents processors and international transfers.
Treatment record as per article 30
Holders' requests with a controlled one-month deadline
Data Breaches with notification within 72 hours
DPIA based on legal basis and associated risks
International transfers and documented processors
The General Data Protection Regulation (Regulation (EU) 2016/679) is the European Union's data protection standard, in force since May 25, 2018. It defines the legal bases, the rights of data subjects, the obligations of controllers and processors, and the penalties imposed by national authorities.
Yes, when offering goods or services to people in the European Union or monitoring their behavior, even without being based in Europe (Art. 3). In these cases, it may be necessary to appoint a representative in the EU (Art. 27) and document international transfers.
Both laws share the same structure: legal bases, data subject rights, activity logs, and incident reporting. The differences lie in the timeframes (one month under the GDPR, 15 days under the LGPD), the amount of fines (up to 4% of global turnover under the GDPR, up to 2% in Brazil), and obligations such as the EU representative and the DPIA. The platform handles both in the same registration.
The data protection authority must be notified within 72 hours of becoming aware of the breach (Art. 33). If there is a high risk to individuals, they must also be informed without delay (Art. 34). The Incident Management module records the case, assesses the risk, and generates the communication.
The Data Protection Impact Assessment is the impact assessment required by Article 35 for high-risk processing, such as large-scale monitoring or the use of sensitive data. It is equivalent to the RIPD of the LGPD (Brazilian General Data Protection Law). The Diagnostics and Assessments of Privacy Tools They produce the DPIA (Detailed Risk Impact Assessment) with the risks and measures linked to each activity.
Speak with one of our specialists and see how to comply with GDPR and LGPD in the same environment, with support in Brazil.
