Policy Briefing — Brazil LGPD Sanctions Enforcement Begins
Brazil’s LGPD entered its administrative sanction phase on 1 August 2021, empowering the ANPD to impose fines, public reports, and data-blocking orders on controllers and processors that fail to implement lawful bases, data subject rights, or governance obligations.
Executive summary. Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados, LGPD) formally entered its administrative sanction phase on 1 August 2021, enabling the Autoridade Nacional de Proteção de Dados (ANPD) to impose warnings, daily or fixed fines of up to 2% of Brazilian revenue (capped at BRL 50 million per violation), publicizing violations, ordering data blocking or deletion, and suspending or prohibiting processing activities.[1] Enforcement now pairs these powers with the ANPD’s sanctioning regulation and dosimetry methodology, requiring organizations to evidence lawful bases, proportionality, security controls, and cooperation throughout supervisory investigations.
The sanction start date closes the grace period created by Article 65, exposing controllers and processors to escalating interventions if they cannot demonstrate compliance maturity. Although the ANPD initially prioritized guidance and educational actions, it published its oversight and administrative proceeding regulation in October 2021 and finalized the dosimetry framework in October 2023, detailing aggravating and mitigating factors, calculation bands, and procedural safeguards.[2][3] Organizations therefore need not only written policies but also operational evidence—records of processing, DPIA documentation, breach response playbooks, and supplier oversight artifacts—to answer ANPD requests within prescribed timelines.
Enforcement posture. The ANPD’s oversight regulation confirms a risk-based approach, with monitoring, guidance, and corrective plans preceding sanctions when feasible. Nevertheless, it allows for summary measures when risks to fundamental rights are acute, including preliminary blocking orders to contain ongoing violations. The dosimetry resolution grades infractions (light, medium, serious), assesses intentionality, cooperation, recidivism, and economic conditions, and then applies multipliers to daily or single fines. Public disclosure, processing suspension, or prohibitions are reserved for serious, repeated, or unremedied failures, especially where sensitive data or children’s data are involved.
Due process expectations. Administrative proceedings guarantee notice and defense, but timelines are tight: organizations typically have ten business days to respond to ANPD information requests and fifteen to thirty days to present defenses, depending on the phase. The regulator may negotiate adjustment terms, but only when violations are corrigible and the organization can prove prompt containment. Appeals run to the ANPD Board of Directors, so documentation quality and traceability of remedial steps materially influence outcomes.
Scope and triggers. Sanctions can reach both controllers and processors established in Brazil or offering goods or services to Brazilian data subjects. The ANPD can open proceedings after complaints from data subjects, referrals from consumer or competition authorities, mandatory breach notifications under Article 48, or media reports. Sector regulators remain active—e.g., the Central Bank and health regulators continue to scrutinize incident handling—so LGPD compliance must be integrated with financial, telecom, and health-sector oversight obligations.
Lawful basis discipline. Article 7 requires identifiable bases for each processing purpose, while Article 10 imposes proportionality and transparency obligations. In enforcement contexts the ANPD has asked for per-purpose mappings, data minimization rationales, and proof that consent-based processing meets Article 8’s demonstrability standard. Controllers relying on legitimate interest should retain balancing tests and notices tailored to the specific use cases.
Data subject rights operations. Articles 18–20 grant access, correction, portability, anonymization, and deletion rights. The enforcement regulation highlights failure to respond within statutory timelines or to provide intelligible responses as aggravating factors. Controllers should track fulfillment deadlines, maintain redaction and verification procedures, and capture evidence of responses to demonstrate diligence if audited.
Security and incident response. Article 46’s security duty is measured against the nature of processed data and technology available. Under Article 48 and ANPD guidance, organizations must notify incidents to the ANPD and, when applicable, affected data subjects without undue delay and preferably within two business days of learning of the breach. The ANPD has signaled that delayed containment, incomplete notifications, or absence of logs elevate sanction severity, while timely isolation, forensic evidence, and corrective actions mitigate penalties.
Processor management. Article 39 mandates that controllers supervise processors and ensure contractual clauses on confidentiality, security, breach notification, and subprocessor approvals. In sanctioning scenarios, the ANPD may evaluate whether processors complied with instructions and whether controllers exercised oversight (audits, attestations, SOC reports). Shared liability means both parties should document incident drills and approval workflows for new processing operations.
Cross-border transfers. Article 33 requires transfers to rely on adequate safeguards, such as ANPD-approved standard clauses, BCRs, adequacy decisions, or specific legal bases (e.g., consent or necessity for international cooperation). The ANPD is actively consulting on standard contractual clauses; until final templates arrive, organizations should evidence risk assessments, jurisdictional analysis, and contract language aligning with LGPD Articles 33–36.
Children and sensitive data. Processing sensitive personal data (Article 11) or children’s data (Article 14) is treated as higher risk. The dosimetry framework lists harm to vulnerable groups as an aggravating factor. Privacy notices must be age-appropriate, and parental consent must be verifiable. Security measures should reflect the heightened risk profile, with tighter access control, encryption, and retention rules.
Governance documentation. Article 37 requires records of processing operations (ROPA), and Article 38 empowers the ANPD to demand Data Protection Impact Assessments (DPIAs) for high-risk processing. The oversight regulation allows the ANPD to request these documents at any stage; absence, incompleteness, or outdated inventories can trigger sanctions or interim measures. Organizations should ensure ROPA and DPIAs are version-controlled, cross-referenced to lawful bases, and linked to controls and vendors.
DPO accountability. Article 41 obliges controllers to designate a Data Protection Officer (encarregado) and publish contact information. During enforcement the ANPD often communicates through the DPO; failure to respond or lack of authority to mobilize remediation can aggravate penalties. Smaller entities can use the flexibilities of Resolution CD/ANPD No. 2/2022, but must still demonstrate a channel and governance for data subject interactions.
Board and audit committee oversight. The ANPD’s dosimetry rule treats senior leadership involvement in remediation as a mitigating factor. Boards should receive periodic LGPD readiness updates, approve budgets for remediation plans, and confirm that enterprise risk management maps LGPD non-compliance as a top-tier risk. Internal audit should test evidence trails for lawful basis decisions, breach playbooks, and vendor due diligence.
Sector interplay and litigation exposure. ANPD sanctions do not displace consumer protection or civil liability. Public prosecutors and consumer authorities can pursue damages and collective actions, often using ANPD findings as evidentiary support. Financial institutions remain subject to Central Bank cybersecurity rules, while telecommunications operators must meet ANATEL incident-reporting deadlines. Coordinating responses and messaging across regulators reduces inconsistency that could be treated as lack of cooperation.
Timeline considerations. Because ANPD investigations can last months, organizations should sequence quick containment actions (blocking unlawful processing, patching vulnerabilities), mid-term documentation (refreshing ROPA, conducting DPIAs, updating notices), and long-term structural reforms (governance committee charters, technology upgrades, consent re-collection). Keeping a contemporaneous log of actions, approvals, and dates strengthens mitigation arguments under the dosimetry criteria.
Key compliance checkpoints
- Lawful basis traceability. Map each processing purpose to Articles 7 or 11 bases, keep legitimate-interest balancing tests, and ensure consent capture and withdrawal are demonstrable.
- Records and DPIAs. Maintain Article 37 processing records and Article 38 DPIAs for high-risk operations, updated after system or vendor changes.
- Security controls. Enforce least-privilege access, encryption, logging, and vulnerability management commensurate with Article 46, with breach notification templates ready to meet Article 48 timelines.
- Vendor oversight. Embed LGPD clauses in processor contracts (notification, subprocessor approval, audit rights) and retain evidence of reviews or attestations.
- Rights response SLAs. Track deadlines for Articles 18–20 requests, script verification and redaction steps, and retain proof of responses.
- Cross-border safeguards. Document transfer mechanisms under Articles 33–36 and monitor ANPD consultations on standard contractual clauses.
- DPO and governance. Confirm the DPO’s mandate, publication of contact details, and escalation paths to leadership and the ANPD.
Operational priorities
- Prepare for ANPD inquiries. Build a rapid-response pack with ROPA extracts, DPIA summaries, breach logs, and policy links to meet ten-day information requests.
- Run sanction-readiness exercises. Tabletop how to respond to notice of infraction, assign spokespeople, and rehearse defenses that emphasize prompt containment and cooperation.
- Elevate incident telemetry. Ensure centralized logging and retention to prove detection, isolation, and remediation steps; align with sectoral regulators to avoid contradictory reports.
- Remediate high-risk uses. Prioritize sensitive-data processing, children’s services, and large-scale profiling for control hardening and refreshed transparency notices.
- Strengthen vendor attestations. Require processors to evidence breach drills, subcontractor vetting, and encryption controls; document follow-up actions.
- Board reporting. Provide quarterly LGPD risk dashboards and sanction exposure estimates that reflect the ANPD dosimetry ranges and mitigating factors.
Sources
- Lei Geral de Proteção de Dados (Law No. 13.709/2018), Articles 7, 11, 18–20, 33–36, 37–39, 41, 46, 48, 52, 65
- ANPD Regulation on Supervision and Administrative Sanctioning Process (Resolução CD/ANPD nº 1/2021)
- ANPD Dosimetry and Administrative Sanctions Regulation (Resolução CD/ANPD nº 4/2023)
Continue in the Policy pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Semiconductor Industrial Strategy Policy Guide — Zeph Tech
Coordinate CHIPS and Science Act, EU Chips Act, and Defense Production Act programmes with capital planning, compliance, and supplier readiness.
-
Digital Markets Compliance Guide — Zeph Tech
Implement EU Digital Markets Act, EU Digital Services Act, UK Digital Markets, Competition and Consumers Act, and U.S. Sherman Act requirements with cross-functional operating…
-
Export Controls and Sanctions Policy Guide — Zeph Tech
Integrate U.S. Export Control Reform Act, International Emergency Economic Powers Act, and EU Dual-Use Regulation requirements into trade compliance, engineering, and supplier…