Data protection laws: GDPR vs LGPD vs CCPA

GDPR
The General Data Protection Regulation (GDPR) went into effect on May 25, 2018, replacing the 1995 EU Data Protection Directive. The GDPR lays out specific requirements for businesses and organizations who are established in Europe or who serve users in Europe. It regulates how businesses can collect, use, and store personal data.

LGPD
Lei Geral de Proteção de Dados (“LGPD”) is a new data privacy law that is expected to go into effect on August 16, 2020. LGPD applies to businesses (both inside and outside Brazil) that process the personal data of users located in Brazil. A Brazilian Data Protection Authority (DPA) will be established and will provide guidelines on how to interpret and implement the LGPD’s requirements. As the DPA is yet to be established, Google’s approach is subject to further change.

CCPA
The California Consumer Privacy Act (CCPA) is a new data privacy law which applies to certain businesses that collect personal information from California residents. The law went into effect on January 1, 2020.