Data:Brazil
Purpose and Objectives
The LGPD is frequently described as a legal transplant of the GDPR to the Brazilian context. However, there are significant differences between the two regulations where it relates to purpose and objective. Where the GDPR explicitly prioritizes the dual objectives of fundamental rights of citizens and the free movement of personal data, Article 2 of the LGPD defines a broader set of objectives including “free enterprise, free competition and consumer protection” as well as “economic and technological development and innovation”.
This is especially noteworthy in context of the LGPD’s equivalent of Article 20 GDPR: the right to data portability (Article 18(V) LGPD). Though Article 18 LGPD lacks Article 20 GDPR’s stipulation that data controllers must permit data portability “without hindrance from the controller”, the explicit framing in Article 2(VI) LGPD implies a pro-competitive reading of Article 18(V) LGPD.
The “economic development” objective is further apparent in the geopolitical interests that may have in part driven the drafting of the LGPD: specifically a desire to join the OECD as a full-fledged member. Accession requires compliance with OECD guidelines, including the “OECD Privacy Guidelines”. In this regard, the LGPD appears to have been successful, as accession talks were officially initiated in 2022. This was evidently of lesser concern in the EU, as 22 of its 28 member states were already OECD members at the time the GDPR was drafted.
Similar to the European Union, Brazil’s system of government features exclusive and shared competences. Whereas the TFEU has never been amended as relates to the competences of the Union, Brazil shifted protection and processing of personal data to the exclusive legislative competence of the Federal Union by way of Amendment EC 115/2022. The same amendment also made data protection a fundamental right, though the Supreme Federal Court of Brazil (Supremo Tribunal Federal) had already treated the right as implicit for several years at that point.
In summary, both LGPD and GDPR are congruent in their basis in fundamental rights, but distinct in their respective complementary goals of pro-consumer economic-developmental logic (LGPD) and internal market integration (GDPR).
Structure and Effectiveness of Brazilian Data Portability Regulation
Brazilian data portability rests on distinct instruments. The Constitution, article 5(LXXIX), protects personal data; the General Data Protection Law (LGPD), article 18(V), establishes a request-based right to data portability. Financial data sharing is governed by CMN/BCB Joint Resolution 1/2020, as amended by 4/2022; insurance by CNSP Resolution 415/2021 and SUSEP Circular 635/2021. Health-data exchange through the National Health Data Network (RNDS) follows Decree 12,560/2025. ANEEL's Open Energy remains a proposal under Public Consultation 7/2025. Consumer and competition legislation provides complementary safeguards. These regimes have different purposes and levels of legal maturity, not a single uniform portability standard.
From a rights perspective, article 18(V) establishes a statutory entitlement, but its exercise remains incompletely specified: it requires an express request, follows ANPD regulation and preserves commercial and industrial secrecy. In September 2026, the ANPD still listed regulation of data-subject rights as under internal preparation. That demonstrates an implementation gap, not suspension of the statutory right. RNDS interoperability likewise must not be mistaken for a general patient-directed portability mechanism.
For markets, mandatory participation and standardised interfaces can lower informational barriers to entry. Yet Open Finance activity measures technical uptake, not causally established reductions in prices or concentration. Research identifies continued concentration and implementation costs; competition effects require direct assessment.
Consumers may gain access to comparison tools and tailored offers, subject to comprehensible consent, security, and genuine choice. Survey findings associate lower income with lower reported adoption, without establishing national causal effects. Economic theory additionally suggests that refusal to share could disadvantage borrowers when lenders interpret non-disclosure adversely.
For industry, shared interfaces reduce integration duplication but entail security and maintenance costs that smaller providers may struggle to bear. Ambiguous trade-secret exceptions and weak downstream safeguards can undermine confidence. Technical standardisation therefore requires public oversight, not merely industry agreement.
Further legislation is neither necessarily sufficient nor the best immediate remedy. The stronger priority is binding ANPD regulation on scope, formats, timelines, secure direct transmission and reviewable secrecy refusals, coordinated with sector regulators. Accessible consent processes, independent testing, shared technical tools, consumer education and collective redress should complement regulation.
Success should be measured against completed transfers, switching, prices, market entry, complaints, security incidents, and distributionBrazilian Data participation. Brazil demonstrates operational possibilities; its broader rights and welfare effects remain to be established