Understanding Regulatory Compliance with LGPD: Empirical Evidence from Brazilian Organizations

Context: With the global advance of data protection regulations such as the GDPR, Brazil enacted the R3C1 GeneralData Protection Law (in Portuguese, Lei Geral de Protec¸ ˜ao de Dados Pessoais - LGPD) to establish legal grounds forhandling personal data. Problem: However, the extent to which Brazilian organizations have adapted to the LGPDremains unclear, especially regarding cultural, operational, and structural impacts. Objective: This study aims toinvestigate how Brazilian public and private organizations have implemented the LGPD, analyze the challenges theyface, and understand the perceived impacts from the perspective of professionals directly involved in the complianceprocess. Methods: We conducted an exploratory empirical study combining a nationwide survey (n=152) and semi-structured interviews with professionals actively participating in LGPD compliance initiatives (n=9). Descriptivestatistics were used for survey data, and thematic analysis was applied to interview transcripts. Results: The findingsreveal that although 93.4% of respondents believe LGPD compliance should be a priority, only 3 organizations (8.8%)were fully compliant. Cultural resistance, lack of organizational knowledge, and financial constraints emerged as keybarriers. Notably, 70% of organizations had implemented only partial measures. Participants emphasized that LGPDimplementation triggered not only technological upgrades but also deep cultural shifts across multiple departments.Conclusion: The study highlights a significant gap between awareness and action in LGPD compliance among Brazil-ian organizations. While technical adaptations are underway, the most pressing challenge is cultural transformation.The results also suggest that similar difficulties observed in GDPR compliance, such as high costs, legal ambiguity,and the need for cross, departmental collaboration—are present in the Brazilian context.