Under Brazil's LGPD (Law No. 13.709/2018), a fine can reach 2% of a company's or group's revenue in Brazil in its last financial year, excluding taxes, capped at R$50 million per infringement. Fines are two of the nine sanctions in force under Article 52, which run from a warning to a partial or total ban on processing personal data. They have applied since 1 August 2021, and the ANPD sets fines using its dosimetry regulation of February 2023.
In practice, enforcement has so far fallen mostly on public bodies that failed to report security incidents. The ANPD's own list of concluded sanctioning proceedings, last updated on 16 September 2025, has eight entries, and seven of them are public bodies.
Article 52 lists nine sanctions in force
Article 52 of the LGPD has twelve numbered items, but three of them (VII to IX) were vetoed when the law was signed. Items X to XII were added in 2019 by Law 13.853. That leaves nine sanctions, which the ANPD can apply on their own or together, after an administrative procedure that gives the organisation a full right of defence.
| Sanction | What it means | Limit |
|---|---|---|
| Warning | Formal notice with a deadline for corrective measures | Deadline set by the ANPD |
| Simple fine | Up to 2% of the company's or group's revenue in Brazil in its last financial year, excluding taxes | R$50 million per infringement |
| Daily fine | Accrues for each day the infringement continues | The same R$50 million cap |
| Publication | The infringement is made public once confirmed | None |
| Blocking | The personal data involved is blocked until the situation is put right | Until regularisation |
| Deletion | The personal data involved is deleted | None |
| Database suspension | Partial suspension of the database involved | 6 months, renewable once |
| Processing suspension | The processing activity involved is suspended | 6 months, renewable once |
| Ban | Partial or total prohibition of processing activities | No fixed limit |
The last three are a second step. Under Article 52(6), they can be applied only after at least one of the fine, daily fine, publication, blocking or deletion has already been imposed for the same case, and, for controllers overseen by another regulator, only after hearing that regulator.
How the ANPD sets a fine
Article 52(1) lists the criteria the ANPD must weigh: the seriousness and nature of the infringement and the rights affected, good faith, any advantage gained or sought, the offender's economic situation, repeat offending, the degree of damage, cooperation, internal measures that reduce harm, a good practice and governance policy, prompt corrective action, and proportionality between the fault and the sanction.
The dosimetry regulation, Resolution CD/ANPD No. 4 of 24 February 2023, turns those criteria into a method. It classifies an infringement as light, medium or serious, sets a base amount from that classification and the offender's revenue, and then applies aggravating and mitigating factors such as repeat offending, ignoring the ANPD's measures, stopping the infringement early or having a governance programme. Where the ANPD does not have reliable revenue figures for the business line concerned, Article 52(4) lets it use the total revenue of the company or group.
Who has been sanctioned
Private companies face every sanction, fines included. Public bodies can receive warnings, publication, blocking, deletion, suspensions and bans, but no fines (Article 52(3)). The ANPD publishes its proceedings on its supervision activities page. Its list of concluded sanctioning proceedings, updated on 16 September 2025:
| Organisation | Reason given by the ANPD |
|---|---|
| Telekall Infoservices | Not complying with an ANPD determination |
| Instituto de Pesquisa Jardim Botânico do Rio de Janeiro | Not reporting a security incident to the ANPD and data subjects, not answering ANPD requests |
| Secretaria de Educação do Distrito Federal | Not reporting an incident to data subjects, no proof of security standards or processing records |
| Secretaria de Estado da Saúde de Santa Catarina | Not reporting an incident to data subjects, missing security measures, not following ANPD determinations |
| IAMSPE (São Paulo state employees' health institute) | Not reporting an incident to data subjects, missing security measures |
| INSS (National Social Security Institute) | Not reporting an incident to data subjects, not following a preventive measure |
| Ministério da Saúde | No proof of a DPO, no impact report, not reporting an incident, not answering ANPD requests |
| Secretaria de Desenvolvimento Social, Criança e Juventude | Not reporting an incident to data subjects, missing security measures |
Seven of the eight concern security incidents that were not properly reported. The one private company, Telekall Infoservices, a small company, was the ANPD's first fine in 2023, which made the point that the LGPD applies whatever the size of the business. The ANPD also says that every sanctioning proceeding it has opened so far started because the organisation did not cooperate during supervision.
Proceedings still open
The same page lists three sanctioning proceedings in progress:
- The Ministry of Health, over incident communication and security measures
- Bytedance Brasil (TikTok), over conduct that does not respect the best interests of children and adolescents
- RaiaDrogasil, a pharmacy chain, over alleged behavioural profiling based on sensitive personal data to sell targeted advertising
The last two are the closest to what websites and apps do every day.
The ANPD has also acted outside formal sanctions, for example over the use of Brazilian users' data to train AI models. Those actions are preventive measures rather than sanctions, so they do not appear in the concluded list.
LGPD penalties compared with the GDPR
The GDPR allows administrative fines of up to EUR 20 million or 4% of worldwide annual turnover. The LGPD's fine is calculated on revenue in Brazil only and has a hard cap per infringement.
| Factor | LGPD | GDPR |
|---|---|---|
| Maximum fine | 2% of revenue in Brazil, capped at R$50 million per infringement | EUR 20 million or 4% of worldwide turnover |
| Revenue base | Brazil only (group revenue if figures are unreliable) | Worldwide |
| Fines on public bodies | Not allowed | Depends on the member state |
| Processing bans | Yes, after a prior sanction in the same case | Yes |
| Breach notification | 3 working days to the ANPD and data subjects (Resolution CD/ANPD No. 15/2024) | 72 hours to the authority (Article 33) |
| Sanctions apply since | 1 August 2021 (fine method since February 2023) | 25 May 2018 |
The sanctions that do not involve money can hurt more than a fine. Six months without access to a customer database, renewable once, would stop most online businesses.
Cookies and the LGPD
Cookies that identify or follow a person, such as _ga or _fbp, involve personal data under Article 5, so they need one of the ten legal bases in Article 7. The ANPD's 2022 cookie guide says consent is the most appropriate basis for non-necessary cookies such as advertising and behavioural profiling, and the LGPD consent requirements explain what valid consent looks like. The open RaiaDrogasil proceeding shows that profiling for advertising is on the authority's radar.
Breach notification is where most sanctions start
Resolution CD/ANPD No. 15 of 24 April 2024 requires controllers to tell the ANPD and the people affected about an incident that may cause relevant risk or damage within 3 working days of learning that personal data was affected. The deadline, the risk test and the register are covered in LGPD data breach notification.
Given that seven of eight concluded proceedings involve incident reporting, a breach plan that names who decides, who drafts the notice and how data subjects are contacted is the single most useful piece of preparation.
How to reduce your exposure
The criteria in Article 52(1) reward the same habits the regulation encourages:
- Appoint an encarregado (DPO) and publish the contact details, as Article 41 requires, unless you qualify for the small processing agent exemption.
- Prepare for incidents, so a notice can go out within 3 working days.
- Keep processing records and impact reports, since the Ministry of Health case turned partly on a missing impact report.
- Answer the ANPD: every sanctioning proceeding so far followed a lack of cooperation.
- Check your website's cookies and consent, so trackers wait for a valid choice.
- Cover transfers out of Brazil with a mechanism under Article 33, such as the ANPD's standard clauses or, for the EU, the mutual adequacy decisions of January 2026, explained in LGPD international data transfers.
ANPD priorities for 2026 and 2027
The ANPD, a regulatory agency since Law 15.352 of 25 February 2026, publishes a map of priority themes for its supervision. The map for 2026 to 2027 names data subject rights, the protection of children and adolescents online (including under the Digital ECA, Law 15.211/2025, in force since 17 March 2026), processing by public bodies, and AI and emerging technologies. As of October 2026, those themes, together with incident reporting, are where new proceedings are most likely. Brazil's rules sit next to others on the privacy laws by region overview.
Questions about LGPD fines and sanctions
What is the maximum LGPD fine for a single violation?
2% of the company's or group's revenue in Brazil in its last financial year, excluding taxes, capped at R$50 million per infringement. Daily fines are possible within the same cap.
Can the ANPD fine public sector organisations under the LGPD?
No. Article 52(3) lets the ANPD apply warnings, publication, blocking, deletion, suspensions and bans to public bodies, but not fines.
How does the ANPD classify the severity of an LGPD violation?
Its dosimetry regulation, Resolution CD/ANPD No. 4/2023, classifies infringements as light, medium or serious, sets a base amount from that and the offender's revenue, and then applies aggravating and mitigating factors based on the criteria in Article 52(1).
Do small businesses in Brazil need to comply with the LGPD?
Yes. The ANPD's first fine, in 2023, went to Telekall Infoservices, a small company. Small processing agents get some simplified rules under Resolution CD/ANPD No. 2/2022, but the law applies to them.
How quickly must a data breach be reported to the ANPD?
Within 3 working days of learning that a security incident affected personal data and may cause relevant risk or damage, under Resolution CD/ANPD No. 15/2024. The people affected must be told within the same period.
Can the ANPD ban a company from processing personal data entirely?
Yes. Article 52 includes a partial or total ban on processing, but under Article 52(6) it can only follow a fine, daily fine, publication, blocking or deletion already imposed in the same case.
Find out what your site sets before the ANPD does
If your website collects data from visitors in Brazil, its cookies are part of your exposure. A free cookie scan lists the cookies your pages set and sorts them into categories, so you can see which ones should wait for consent.
