ANPD Sanctions: Fines, Warnings, and the Sanctioning Procedure

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Brazil’s National Data Protection Authority has a graduated set of sanctions, ranging from a warning to a complete ban on data processing activities. They apply to public and private entities that violate Brazil’s General Data Protection Law. The administrative sanctioning procedure follows a formal process set out in its own regulation, with adversarial proceedings and a full defense guaranteed at every stage.

The Range of Penalties Under Article 52 of the LGPD (Brazil’s General Data Protection Law)

Article 52 of Law 13.709/2018 sets out the exhaustive list of administrative sanctions that the ANPD (Brazil’s National Data Protection Authority) may impose. The structure is deliberately graduated. It lets the authority tailor the government’s response to the extent of the misconduct it finds, without having to move through the penalties in a fixed order.

The penalties include a warning with a deadline to take corrective measures; a simple fine of up to 2% of the revenue of the company’s economic group in Brazil in its most recent fiscal year (capped at R$ 50 milhões per violation); a daily fine subject to the same cap; public disclosure of the violation once it has been conclusively established; blocking and deletion of the personal data involved in the violation; and, in the most serious cases, partial or total suspension of the database and a ban on carrying out data processing activities.

The ANPD may impose a fine directly, without a prior warning, when the seriousness of the violation justifies it. But the ANPD’s technical discretion in making that choice is limited by the penalty-calibration criteria set out in the law itself and by the duty to give reasons that applies to every administrative sanctioning act.

Penalty Calibration: The Criteria That Determine How Severe the Penalty Will Be

The first paragraph of Article 52 of the LGPD lists the factors the authority must weigh when setting a sanction. The main ones are the seriousness and nature of the violations, the violator’s good faith, any economic advantage gained from the unlawful conduct, repeat offenses, the degree of harm caused to data subjects, and the economic condition of the processing agent.

The simple fine, capped at R$ 50 milhões per violation, is not the only financial risk: a ban on processing can shut down essential operations at companies whose core business depends on processing personal data.

Adopting a privacy governance program, as provided in Article 50 of the LGPD, is an expressly recognized mitigating factor. Processing agents that can show structured internal policies, regular training, and documented compliance procedures tend to receive milder penalties. This shows that the law is meant to encourage good practices, not just punish violations.

Cooperating with the investigation and immediately ending the unlawful conduct are also viewed favorably during the proceeding. How the investigated party behaves throughout the process can therefore have a significant effect on the final penalty calculation, which is why specialized legal counsel from the very start of an inspection is so important.

The Administrative Sanctioning Procedure and Its Stages

The ANPD’s regulations created the Enforcement and Administrative Sanctioning Procedure Regulation (Processo Administrativo Sancionador, or PAS), which gives a formal structure to the agency’s exercise of its punitive power. The PAS has distinct stages: initiation, evidence gathering, preparation of a technical report, and a decision by the Board of Directors, with adversarial proceedings and a full defense guaranteed at each stage.

A proceeding may be initiated by complaints from data subjects, by security incident reports submitted by the processing agents themselves, or by enforcement action the ANPD begins on its own initiative. The evidence-gathering stage allows documentary evidence and, depending on the complexity of the case, technical inspections and investigative measures at the investigated party’s premises, including access to systems and databases.

The final decision rests with the Board of Directors, the agency’s highest decision-making body. The decision may be appealed within the agency. If the penalty is upheld, it may then be challenged in court. In principle, however, that challenge does not suspend the immediate enforceability of the sanctioning act, a feature of the state’s police power.

Frequently Asked Questions

Are micro and small businesses subject to the same fines?

The LGPD provides for differentiated treatment of micro businesses, small businesses, and startups in Article 55-J, paragraph 3, with simplified requirements and a preference for corrective measures over financial penalties. The ANPD’s Enforcement Regulation also makes the violator’s economic condition a mandatory penalty-calibration criterion, which can result in proportionally lower amounts for smaller entities. The reduction is not automatic, however. You must demonstrate your actual economic situation during the proceeding.

Can public agencies be sanctioned by the ANPD?

Yes. The LGPD applies equally to public and private processing agents, except for processing carried out for public safety, national defense, and criminal investigation, which are governed by specific legislation. The key difference is that the fine does not apply to the government. The penalties available for the public sector are limited to a warning with a deadline for correction, public disclosure of the violation, and blocking and deletion of the personal data involved.

How long do I have to submit a defense after the PAS begins?

Under the ANPD’s regulations on the administrative sanctioning procedure, the investigated party has a set period to submit a written defense after being formally notified that the proceeding has begun. The regulation allows that period to be extended upon a reasoned request, which the ANPD will evaluate based on the complexity of the case and the need shown by the investigated party. Failing to exercise the right of defense within the deadline results in a default (revelia), and the proceeding continues whether or not the investigated party responds.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.