LGPD vs GDPR

Data subjects' requests under the right to deletion must be responded to without delay and in any event within 1 month of the receipt of the request.

The deadline can be extended to 2 additional months where there is great complexity or depending on the number of requests. In any of these cases, the data subject must be notified of any such extension within one month of receiving the request, along with the reasons for the delay and the possibility of complaining with the supervisory authority.

This right requires the controller to provide the following information to the data subject when requested. This should be given in a concise, transparent, intelligible and easily accessible form, using plain language:

• The identity and contact details of the controller, controller’s representative and DPO, where applicable
• The purpose and the legal basis of the processing
• The categories of personal data concerned
• The recipients of the personal data
• The appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available

The controller must provide information necessary to ensure fair and transparent processing whether or not the personal data is collected from the data subject. This information includes the duration of data storage, the legitimate interests pursued by the controller, and the existence of the rights to access, erasure, rectification, restriction of processing, data portability and lodging a complaint with the supervisory authority.

Data subjects have the right to object to their personal data being processed. This can be done on the basis of legitimate interest or public interest.

Once this right is exercised, the controller must stop processing the individual's data, unless it demonstrates grounds that override the data subject's request.

GDPR states that, when responding to an access request, a data controller must indicate the following:

• The categories of personal data concerned
• The recipients or categories of recipients to whom personal data have been disclosed to
• The retention period
• The right to lodge a complaint with the supervisory authority
• The existence of data transfers
• The existence of automated decision making
• The information must be provided without undue delay and in any event within one month of the receipt of the request.

GDPR defines the right to data portability as the right to send data in a “structured, commonly used, and machine-readable format.” This right may be exercised only where it is technically feasible to do so.

This is the right of the data subject to obtain from the controller the rectification of inaccurate personal data and to have incomplete personal data completed.

This right applies when the accuracy of data is contested by the data subject, the processing is unlawful and the data subject opposes erasure and requests restriction. Data subjects must be informed before any such restriction is lifted.

Article 22 of the GDPR provides data subjects the right to not be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them.