Compliance: LGPD deep dive
This course covers Brazil's Lei Geral de Proteção de Dados (Law 13,709/2018) by focusing on where it diverges from GDPR. It walks through the ten legal bases for ordinary data and the separate list for sensitive data. It covers the ANPD as the single national authority and the roles of titular, controlador, operador and encarregado. It also covers titular rights and response deadlines, graduated sanctions and international transfers. The last lesson separates what a Rails team builds once from what each regime needs. Nothing here is legal advice.
What you'll learn
- ✓The ten LGPD legal bases in Article 7 and the separate sensitive-data list in Article 11
- ✓How the ANPD works as a single authority that enforces and issues binding resolutions
- ✓Where the encarregado differs from a GDPR DPO, including the small-scale exemption
- ✓Titular rights and response deadlines that differ from GDPR's one month
- ✓Sanction ceilings, dosimetry factors and the ANPD's international transfer mechanisms
- ✓Which compliance pieces a Rails app shares across GDPR and LGPD and which need a regime branch
LGPD is not GDPR with Portuguese labels
The senior course "Compliance: GDPR deep dive" built the habits: a lawful basis chosen before the row exists, data subject rights as real workflows, erasure that reaches backups and logs beyond one table, a schema that minimises and retains on purpose, a subprocessor register, a breach clock. None…
Read the full lesson free →Curriculum
7 lessonsLGPD is not GDPR with Portuguese labels
Introduces LGPD's timeline, its shared core with GDPR, and the structural differences the course examines.
Ten legal bases, not six
Compares LGPD's ten legal bases in Article 7 and the separate sensitive-data list in Article 11 with GDPR's six.
One authority: the ANPD
Explains the ANPD as Brazil's single authority, its binding resolutions, and graduated sanctions under the dosimetry regulation.
Titular, controlador, operador, encarregado
Maps titular, controlador and operador to GDPR roles and shows where the encarregado differs from a DPO.
Titular rights, where they diverge from GDPR
Covers titular rights that diverge from GDPR, including third-party disclosure, automated decision review and shorter deadlines.
Sanctions, and crossing the border
Explains fine ceilings, dosimetry factors, data blocking orders and the ANPD's 2024 international transfer regulation.
Build once, map to both
Sorts what a Rails team serving EU and Brazilian users builds once from what needs regime-specific handling.