LGPD vs GDPR vs US law: privacy fines and breach notice deadlines

Brazil requires breach notice within 3 business days, the EU within 72 hours, and the SEC 4 business days. Compare fine caps, deadlines and enforcement.

2026-10-27

Companies operating in Brazil, Europe and the United States face three different data protection models. Brazil and the EU have a general law and a central authority; the US has a patchwork of sector rules, securities regulation and state laws. The differences matter most on two practical points: how large a fine can be and how quickly a breach must be reported.

Side by side

	Brazil (LGPD)	EU (GDPR)	US
Authority	ANPD, a regulatory agency since 2026	National authorities + EDPB	FTC, HHS/OCR, SEC, state agencies
Fine cap	2% of Brazilian revenue, up to R$50m per violation	€20m or 4% of global turnover	Varies by law and violation
Breach notice	3 business days (ANPD and data subjects)	72 hours	SEC: 4 business days after materiality; HIPAA: up to 60 days
DPO	Required (small agents exempt)	Required in Art. 37 cases	No general rule

Brazil: short deadline, rare fines

ANPD Resolution 15/2024 set a 3-business-day deadline to notify the ANPD and affected individuals, with supplements within 20 business days and incident records kept for 5 years, per Mayer Brown. Fines follow Resolution 4/2023: violations are light, medium or severe; aggravating factors add 5% to 90%, mitigating factors cut 5% to 75%, and waiving appeal earns a 25% discount (Cescon Barrieu).

Enforcement has been light: the only monetary fine published by early 2026 was R$14,400 against Telekall. But in June 2026 the ANPD opened 19 sanction proceedings, its largest batch ever (Turivius).

Europe: billion-euro fines

The GDPR caps fines at €20 million or 4% of global turnover and requires notice within 72 hours. According to DLA Piper, cumulative fines reached €7.1 billion by January 2026, about €1.2 billion in 2025 alone, and regulators receive 443 breach notifications a day.

United States: many rules, many clocks

SEC: listed companies must file an 8-K within 4 business days of deeming an incident material. Disclosures fell from 64 in 2023 to 32 in 2025 (Board Cybersecurity).
CIRCIA: 72-hour incident and 24-hour ransom-payment reporting; the final rule had not been confirmed as published by October 31, 2026 (Hunton).
States: 24 comprehensive privacy laws (ComplyJet). California's CPPA issued its largest fine, $1.35 million, against Tractor Supply (White & Case).
Health: HHS/OCR closed 19 HIPAA actions in 2025 totaling about $6.7 million (Compliancy Group).

The federal SECURE Data Act, introduced in April 2026, remained in committee in October (IAPP).

What to do

Map every jurisdiction's deadline and plan around the shortest.
Decide in advance who determines whether an incident is reportable or material.
Keep an incident register, including unreported events.
Appoint a DPO and maintain a data-subject request channel.