EU GDPR vs. Brazil LGPD

1. the right to be informed;
2. the right of access;
3. the right to rectification;
4. the right to be forgotten;
5. the right to restrict processing;
6. the right to data portability;
7. the right to object to processing and 
8. the rights in relation to automated decision-making and profiling

The LGPD (Lei Geral de Proteção de Dados) creates nine rights for data subjects.

They are found in Article 18 and empower individuals with the rights to:

1. confirmation of the existence of the processing of their data,
2. access their data,
3. correct incomplete, inaccurate or out-of-date data,
4. anonymize, block, or delete unnecessary or excessive data or data that is not being processed in compliance with the LGPD,
5. have their data be portable, i.e. handed over to another service or processor if requested,
6. have their data deleted,
7. information about public and private entities with which the controller has shared data,
8. information about the possibility of denying consent and the consequences,
9. revoke consent.

1. Consent (lit. a)
2. Contractual performance (lit. b)
3. Compliance with a legal obligation (lit. c)
4. Vital interests (lit. d)
5. Public interest (lit. e)
6. Legitimate interests (lit. f)

The ten legal bases in the LGPD (Article 7) for lawful processing of personal data are: 

1. With the consent of the data subject,
2. To comply with a legal or regulatory obligation of the controller,
3. To execute public policies provided in laws or regulations, or based on contracts, agreements, or similar instruments,
4. To carry out studies by research entities that ensure, whenever possible, the anonymization of personal data,
5. To execute a contract or preliminary procedures related to a contract of which the data subject is a party,
6. To exercise rights judicial, administrative or arbitration procedures,
7. To protect the life or physical safety of the data subject or a third party,’
8. To protect health, in a procedure carried out by health professionals or by health entities,
9. To fulfill the legitimate interests of the controller or a third party, except when the data subject’s fundamental rights and liberties which require personal data protection prevail,
10. To protect credit.