Data:Brazil

Purpose and Objectives

The LGPD is frequently described as a legal transplant of the GDPR to the Brazilian context. However, there are significant differences between the two regulations where it relates to purpose and objective. Where the GDPR explicitly prioritizes the dual objectives of fundamental rights of citizens and the free movement of personal data, Article 2 of the LGPD defines a broader set of objectives including “free enterprise, free competition and consumer protection” as well as “economic and technological development and innovation”.  

This is especially noteworthy in context of the LGPD’s equivalent of Article 20 GDPR: the right to data portability (Article 18(V) LGPD). Though Article 18 LGPD lacks Article 20 GDPR’s stipulation that data controllers must permit data portability “without hindrance from the controller”, the explicit framing in Article 2(VI) LGPD implies a pro-competitive reading of Article 18(V) LGPD.

The “economic development” objective is further apparent in the geopolitical interests that may have in part driven the drafting of the LGPD: specifically a desire to join the OECD as a full-fledged member. Accession requires compliance with OECD guidelines, including the “OECD Privacy Guidelines”. In this regard, the LGPD appears to have been successful, as accession talks were officially initiated in 2022. This was evidently of lesser concern in the EU, as 22 of its 28 member states were already OECD members at the time the GDPR was drafted. 

Similar to the European Union, Brazil’s system of government features exclusive and shared competences. Both systems divide legislative competence between exclusive and shared categories. In the EU, these are set out in Articles 3 and 4 TFEU, which have not been amended since the Lisbon Treaty and do not expressly list data protection; the Union's legislative basis is instead Article 16(2) TFEU. In Brazil, Constitutional Amendment 115/2022 added item XXX to Article 22 of the Constitution, placing the protection and processing of personal data within the Union's privative legislative competence. The same amendment made data protection a fundamental right, which the Supreme Federal Court had already recognized as implicit since at least 2020. The same amendment also made data protection a fundamental right, though the Supreme Federal Court of Brazil (Supremo Tribunal Federal) had already treated the right as implicit for several years at that point. In summary, both LGPD and GDPR are congruent in their basis in fundamental rights, but distinct in their respective complementary goals of pro-consumer economic-developmental logic (LGPD) and internal market integration (GDPR).

Structure and Effectiveness of Brazilian Data Portability Regulation

Brazilian data portability rests on distinct instruments. The Constitution, article 5(LXXIX), protects personal data; the General Data Protection Law (LGPD), article 18(V), establishes a request-based right to data portability. Financial data sharing is governed by CMN/BCB Joint Resolution 1/2020, as amended by 4/2022; insurance by CNSP Resolution 415/2021 and SUSEP Circular 635/2021. Health-data exchange through the National Health Data Network (RNDS) follows Decree 12,560/2025. ANEEL's Open Energy remains a proposal under Public Consultation 7/2025. Consumer and competition legislation provides complementary safeguards. These regimes have different purposes and levels of legal maturity, not a single uniform portability standard.

From a rights perspective, article 18(V) establishes a statutory entitlement, but its exercise remains incompletely specified: it requires an express request, follows ANPD regulation and preserves commercial and industrial secrecy. In September 2026, the ANPD still listed regulation of data-subject rights as under internal preparation. That demonstrates an implementation gap, not suspension of the statutory right. RNDS interoperability likewise must not be mistaken for a general patient-directed portability mechanism.

For markets, mandatory participation and standardised interfaces can lower informational barriers to entry. Yet Open Finance activity measures technical uptake, not causally established reductions in prices or concentration. Research identifies continued concentration and implementation costs; competition effects require direct assessment. Consumers may gain access to comparison tools and tailored offers, subject to comprehensible consent, security, and genuine choice. Survey findings associate lower income with lower reported adoption, without establishing national causal effects. Economic theory additionally suggests that refusal to share could disadvantage borrowers when lenders interpret non-disclosure adversely. For industry, shared interfaces reduce integration duplication but entail security and maintenance costs that smaller providers may struggle to bear. Ambiguous trade-secret exceptions and weak downstream safeguards can undermine confidence. Technical standardisation therefore requires public oversight, not merely industry agreement. 

Further legislation is neither necessarily sufficient nor the best immediate remedy. The stronger priority is binding ANPD regulation on scope, formats, timelines, secure direct transmission and reviewable secrecy refusals, coordinated with sector regulators. Accessible consent processes, independent testing, shared technical tools, consumer education and collective redress should complement regulation. Success should be measured against completed transfers, switching, prices, market entry, complaints, security incidents, and distributionBrazilian Data participation. Brazil demonstrates operational possibilities; its broader rights and welfare effects remain to be established