LGPD is not GDPR with Portuguese labels

The senior course "Compliance: GDPR deep dive" built the habits: a lawful basis chosen before the row exists, data subject rights as real workflows, erasure that reaches backups and logs beyond one table, a schema that minimises and retains on purpose, a subprocessor register, a breach clock. None of that gets rebuilt here. If you did that course, you already have the discipline this one needs; what changes is the regime it's pointed at.

Law 13,709/2018, the Lei Geral de Proteção de Dados, took effect in September 2020, and its sanctions regime (fines, the public enforcement teeth) started only in August 2021. It was written with GDPR open on the desk. The two share the same core moves: controller and processor, a lawful basis before processing, rights the data subject can invoke, and a national authority that can fine you.

A lesson-by-lesson rerun of the GDPR course with titular swapped in for "data subject" would teach you nothing new. It would also be a strange way to spend seven lessons on a regime most Brazilian engineers already live inside more than they live inside GDPR.

So this course inverts the framing. You already know the shape. What matters is where LGPD diverges, and where it doesn't map onto GDPR at all.

Why "close cousin" undersells the differences

Some of the differences are structural, well beyond cosmetic. GDPR gives you six lawful bases; LGPD gives you ten for ordinary personal data and a separate, shorter list for sensitive data. That's two lists, and conflating them is the most common mistake a team makes when it treats LGPD as a translation exercise.

GDPR is enforced by one authority per EU member state, coordinating through a lead supervisory authority when a case crosses borders. LGPD has one national authority for the whole country, the ANPD, with no cross-border coordination problem to solve, because there's only one Brazil.

GDPR's response clock for a data subject request is one month; LGPD's is different, and a compliance checklist shouldn't treat the two numbers as interchangeable. None of these is "same rule, different word". They're different shapes a Rails team has to build for.

The six lessons ahead

• Lesson 2: the ten legal bases against GDPR's six, which ones have no clean equivalent, and what having ten changes about choosing one.
• Lesson 3: the ANPD. One national authority, its sanction powers (in force since August 2021), and why a single-authority model is a different compliance shape from GDPR's many authorities.
• Lesson 4: titular, controlador, operador, encarregado. The vocabulary a Brazilian team uses, and where encarregado means more than the Portuguese word for "DPO".
• Lesson 5: the data subject rights where LGPD diverges from GDPR: information about the third parties data was shared with, review of automated decisions, and response times other than GDPR's one month.
• Lesson 6: sanctions (the percentage-of-revenue cap, the per-infraction ceiling, the ANPD's dosimetry rules) and international transfers out of Brazil under the ANPD's own transfer regulation.
• Lesson 7: what a Rails team serving both EU and Brazilian users builds once and maps to both regimes, and what needs separate handling.

One ground rule, carried over unchanged

Nothing in this course is legal advice, in either language. Brazilian regulatory detail, ANPD resolutions especially, moves faster than most engineers expect. It changes the operational detail of rules that stay stable in the text of the law. Where a figure or deadline is the kind of thing an ANPD resolution can revise, this course says so plainly instead of presenting it as permanent.

A senior engineer's job here is the same as in the GDPR course: know which calls are legal calls, and be the one who can turn "the encarregado said we need this" into a migration and a service object.

With that set, lesson 2 opens with the number that surprises engineers who assume LGPD is GDPR in Portuguese: ten lawful bases, where GDPR has six.