Regulation of New Technologies
ANPD enforcement: fines and how Brazil’s data authority acts
Guilherme Chambarelli
Published on
3 min read
In this article
The National Data Protection Agency (ANPD) enforces Brazil’s LGPD through monitoring, guidance, preventive measures and, when needed, sanctioning proceedings. ANPD enforcement can lead to warnings, fines of up to 2% of revenue in Brazil, capped at BRL 50 million per infraction, publicization of the infraction, blocking or deletion of data and suspension of processing. Since Law 15,352/2026, the ANPD is a special autonomous agency with a stronger structure.
Key points
- The sanctions are listed in Article 52 of the LGPD.
- Inspection and sanctioning procedures follow Resolution CD/ANPD 1/2021.
- Fines are calculated under the Dosimetry Regulation (Resolution CD/ANPD 4/2023).
- Sanctions so far have targeted both private companies and public bodies.
- Governance programs, cooperation and corrective measures can reduce penalties.
How does the ANPD act?
The ANPD works in stages. It monitors the market and receives complaints and incident reports. It can issue guidance and request information, apply preventive measures and, when it identifies an infraction, open an administrative sanctioning proceeding with the right of defense and appeal. Many cases end with corrective plans rather than fines. Under the new legal framework, the agency also has a broader mandate, including oversight related to the Digital Statute of Children and Adolescents (Law 15,211/2025).
What sanctions can be applied?
| Sanction | What it means |
|---|---|
| Warning | With a deadline for corrective measures |
| Simple fine | Up to 2% of revenue in Brazil of the group, capped at BRL 50 million per infraction |
| Daily fine | To compel compliance, subject to the same cap |
| Publicization | Public disclosure of the infraction once confirmed |
| Blocking or deletion | Of the personal data involved in the infraction |
| Suspension | Of the database or of processing activities, partially or totally, for limited periods |
Fines do not apply to public bodies, which may receive the other sanctions.
How are fines calculated?
The Dosimetry Regulation classifies infractions as light, medium or serious and sets a base amount that is then adjusted by aggravating and mitigating factors. Aggravating factors include recidivism, failure to comply with ANPD orders and the number of data subjects affected. Mitigating factors include stopping the infraction before the proceeding starts, adopting a privacy governance program, cooperating with the authority and implementing corrective measures.
What has the ANPD sanctioned so far?
The first fine, in 2023, was imposed on a small private company for processing data without a legal basis and for not appointing a DPO, together with a failure to respond to the authority. Since then, the ANPD has sanctioned public health and social security bodies and state agencies, mostly with warnings, publicization and orders to notify data subjects, for failures in incident communication, security measures, records of processing and impact reports. In late 2024, it also inspected large companies for not having a DPO or a contact channel.
What are the current priorities?
The ANPD’s priority topics map for 2026 and 2027 highlights data subject rights and response channels, children’s and adolescents’ data, artificial intelligence, health data and the public sector. Companies operating in these areas should expect closer scrutiny.
How to prepare
- Appoint a DPO formally and publish the contact channel.
- Keep records of processing and impact assessments for higher-risk activities.
- Have an incident response plan that meets the three-business-day notification rule.
- Answer data subject requests on time and document the responses.
- Respond promptly and completely to any ANPD request for information.
- Document your privacy governance program, as it can mitigate sanctions.
Frequently asked questions
Is the fine calculated on global revenue?
No. The LGPD uses revenue in Brazil of the private legal entity, group or conglomerate in the previous year, excluding taxes.
Can ANPD decisions be appealed?
Yes, within the administrative proceeding and, afterwards, in court.
Can a company be sanctioned without a complaint?
Yes. The ANPD can act on its own initiative, through monitoring and inspection programs.
How Chambarelli Advogados can help
Our Regulation of New Technologies team prepares companies for ANPD scrutiny, responds to information requests and defends clients in sanctioning proceedings, with support from our Foreign Desk for foreign groups. Book a meeting with one of our partners.
Informational content, updated October 2026. It does not replace advice on your specific case.
