GDPR is applied to natural persons regardless of their residence or nationality; LGPD does not specify. Data Protection Officers: LGPD’s broad guideline states any organization that processes the data of Brazillian residents will need a DPO. Conversely, GDPR has specific requirements for when a DPO is needed. Legal basis for data processing: In both laws, a data controller must have a legal justification for processing a data subject’s information. While GDPR has six criteria, LGPD has ten.