#
Statutory penalty and powers framework is robust and has just been substantially strengthened, but actual enforcement volume remains modest and concentrated in the public sector, and ANPD's historic capacity constraints are only now being addressed.
Sub-modules (6)
Regulator Powers And PenaltiesGreen
ANPD has sole responsibility for LGPD sanctions (Art. 55-K), which include warnings, fines up to 2% of Brazilian revenue capped at BRL 50 million per infraction, daily fines, publicization, data blocking/deletion, and processing/database suspension up to 12 months; the 2025 reform added cease-operation, seizure and police-assistance powers.
Claims (2):
- ANPD has sole responsibility for applying LGPD sanctions (Art. 55-K), including fines of up to 2% of a company's Brazil-derived revenue for the prior fiscal year, excluding taxes, capped at BRL 50 million per infraction, plus daily fines subject to the same cap.
- Provisional Measure 1.317/2025 makes clear that ANPD can now order establishments to cease operations, seize goods, and request police assistance in cases of obstruction of its functions.
Enforcement Activity IndexAmber
Of ANPD's seven to eight published sanctioning decisions, most target the public sector; five concerned Article 48 breach-notification violations and three concerned Article 49 security violations, alongside the Meta AI-training suspension order (BRL 50,000 daily fine).
Claims (2):
- Of ANPD's seven sanctioning decisions published to date, most target the public sector, with five dealing with Article 48 breach-communication violations.
- Among ANPD's first eight sanctioning procedures, seven were issued against public entities.
Regulator Funding And CapacityAmber
ANPD historically operated with a small technical and administrative staff limiting its scope of action; the September 2025 transformation into an autonomous agency (with tenured technical staff positions) is expected to substantially increase structural and budgetary capacity.
Claims (2):
- ANPD's actions in relation to public entities have historically been predominantly pedagogical and limited in scope, aggravated by the authority's small technical and administrative staff.
- ANPD's transformation into a regulatory agency is expected to bring greater structural and budgetary robustness, with increased staff and technical resources and enhanced operational independence.
Collective Redress And Class ActionsGreen
Individual and class suits are possible independent of ANPD's administrative process, and fines collected by ANPD are allocated to Diffuse Rights Defense Funds.
Claims (1):
- The sum of fines collected by ANPD is allocated to the Diffuse Rights Defense Funds referred to in Law No. 7.347/1985 and Law No. 9.008/1995.
Private Right Of ActionGreen
Brazil's Constitution gives all citizens both a private right of action and a public right of action via the Public Prosecutors' Office, enabling enforcement by individuals, consumer-protection organisations, and prosecutors independent of ANPD sanctions.
Claims (1):
- Brazil's Constitution gives all citizens a private right of action and a public right of action to the Brazil Public Prosecutors' Office, enabling individual and class suits regardless of ANPD's administrative sanction status.
Recent Developments 180DGreen
Within the last 180 days (Feb.-Aug. 2026): the EU-Brazil mutual adequacy regime took effect (EU Implementing Decision 2026/179 and ANPD Resolution 32/2026, Jan. 2026); the Digital ECA Decree 12.881/2026 operationalised the Digital ECA which took force 17 March 2026; and ANPD opened a May 2026 public consultation to update its Age Verification Mechanisms Guide.
Claims (3):
- In January 2026, the European Commission recognized that Brazil ensures an adequate level of protection for personal data transferred from the EU under the GDPR.
- Brazil's Digital ECA (Law 15.211/2025) took effect 17 March 2026, alongside Decree 12.881/2026 operationalizing its preventive-measures and accountability requirements, with ANPD empowered as enforcer.
- On 22 May 2026, ANPD opened a call for contributions on its Age Verification Mechanisms Guide, updating preliminary guidelines published in March 2026 to implement the Digital ECA.
Enforcement & Redress
ANPD's 25 August 2026 decision against ByteDance, operator of TikTok, applied the LGPD's simple-fine cap under article 52, II, up to 2 percent of gross revenue limited to R$50 million per infraction, separately to five distinct LGPD infractions. The result was a combined sanction of R$153,769,671.33, alongside an order requiring data elimination. The decision is appealable to ANPD's Conselho Diretor within ten working days. This is reported as the operative benchmark for ANPD's enforcement reach to date.
Two regulatory processes have followed in the weeks since. First, ANPD published Aviso de Audiência Pública nº 3/2026 on 15 October 2026, opening a public hearing for 29 October 2026 on a draft Resolution amending the Regulamento de Dosimetria e Aplicação de Sanções Administrativas, currently Resolução CD/ANPD nº 4/2023, the methodology by which per-infraction fines such as the TikTok decision are calculated. This is a direct procedural follow-on from the visibility the TikTok decision generated. Second, and separately, ANPD opened a public consultation running 9 September to 26 October 2026, conducted exclusively through the Brasil Participativo platform, on a draft Resolution amending the Regulamento do Processo de Fiscalização e do Processo Administrativo Sancionador, currently Resolução CD/ANPD nº 1/2021. This draft is reported to propose broadening ANPD's investigative instruments and expanding the universe of firms it actively supervises; the primary consultation text was not independently opened this cycle, so the precise scope remains unconfirmed.
Outlook
The sanctions-dosimetry public hearing on 29 October 2026 and the inspection-process consultation closing 26 October 2026 are the two items to track. Together they indicate the regulator is actively formalising both how it calculates fines and how broadly it investigates, in the period immediately following its largest enforcement action to date.
3 earlier distinct update(s)
Enforcement & Redress
The ANPD is understood to have fined ByteDance (TikTok) R$153.7 million in September 2026 for processing children's and adolescents' data without a lawful basis, accompanied by a data-elimination order and a compliance plan. This figure and date rest on secondary legal commentary; the exact ANPD decision or process number was not independently retrieved this cycle, so the fine amount and date should be read as reported rather than as directly confirmed against the primary ANPD decision.
Separately, the ANPD's Consulta Pública nº 1/2026, open through 26 October 2026, proposes expanded investigative powers for the regulator, including cautionary measures that may be applied without prior notice, through a revision of Resolução CD/ANPD nº 1/2021. This is a draft proposal under public consultation, not yet a final binding rule. Taken together with the ByteDance fine and the institutional autonomy granted to the ANPD under Lei nº 15.352/2026, the consultation suggests the regulator is seeking to formalise procedural tools that would support the kind of large-scale enforcement action it has already demonstrated the capacity to bring.
Outlook
The consultation on expanded investigative powers closes 26 October 2026. Given the regulator's demonstrated willingness to impose a record fine this cycle, the adoption of cautionary measures without prior notice would materially strengthen its practical enforcement toolkit going forward.
Enforcement & Redress
ANPD enforces LGPD with fines of up to BRL 50 million per violation and, following Lei no 15.352/2026, can now also order a business to cease operations as a supervisory measure. This cessation power sits on top of ANPD's existing fining authority and represents a materially stronger enforcement tool than monetary sanction alone. The agency's largest fine to date, BRL 153.7 million against ByteDance for minors'-data violations, demonstrates the scale at which ANPD is prepared to act even before accounting for the new cessation power.
Separately, ANPD opened a public consultation on 29 September 2026 reviewing its own administrative enforcement and sanctioning procedures, following a public hearing with 43 registered participants. This procedural review follows directly from, and may formalise, the practical exercise of the agency's strengthened powers described above.
Outlook
The procedural-review consultation's outcome will determine whether ANPD's sanctioning-regulation dosimetry methodology changes, and whether the agency's cessation power is accompanied by specific procedural safeguards or exercised under general statutory discretion. This is the clearest near-term indicator of how assertively ANPD intends to use its strengthened mandate going forward.
Enforcement & Redress
ANPD's enforcement activity escalated markedly this cycle across two concurrent matters. ANPD opened a supervisory proceeding against Claro, with Serasa notified for a parallel proceeding, alleging LGPD violations arising from the transfer of more than one hundred pieces of customer information per partnership. A potential fine of up to R$50 million, or 2 percent of the company's Brazilian revenue for the prior fiscal year, whichever is applicable, is in prospect, consistent with ANPD's standing statutory penalty ceiling under LGPD Article 52; the proceeding remains at a proposed, unresolved stage this cycle.
This proceeding lands alongside the separately reported R$153.77 million fine against a social-media platform for children's-data violations, described under Children & Vulnerable Groups, and both sit against the backdrop of ANPD's February 2026 conversion to full institutional autonomy under Law 15.352. ANPD's standing statutory powers include the ability to impose fines of up to 2 percent of Brazilian revenue capped at R$50 million per infraction, and to block databases, delete data, publicise violations, and suspend or prohibit processing activities; these powers pre-date this cycle but provide the statutory basis against which the newly opened Claro/Serasa proceeding and the sanctioned children's-data case should be read.
The concurrence of a large resolved fine and a newly opened, unresolved proceeding of comparable potential magnitude is itself a signal of a regulator operating at a materially higher enforcement tempo than in prior periods.
Outlook
The Claro/Serasa proceeding's resolution, whether by settlement, sanction, or dismissal, is the clearest near-term indicator of ANPD's post-autonomy enforcement trajectory; watch for its outcome and for the eventual fine amount relative to the R$50 million or 2 percent statutory ceiling.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (11)
- ConfirmedIAPP — ANPD has sole responsibility for applying LGPD sanctions (Art. 55-K), including fines of up to 2% of a company's Brazil-derived revenue for the prior fiscal year, excluding taxes, capped at BRL 50 million per infraction, plus daily fines subject to the same cap.observed
- ConfirmedIAPP — Provisional Measure 1.317/2025 makes clear that ANPD can now order establishments to cease operations, seize goods, and request police assistance in cases of obstruction of its functions.observed
- ConfirmedIAPP — Of ANPD's seven sanctioning decisions published to date, most target the public sector, with five dealing with Article 48 breach-communication violations.observed
- ConfirmedIAPP — Among ANPD's first eight sanctioning procedures, seven were issued against public entities.observed
- ConfirmedIAPP — ANPD's actions in relation to public entities have historically been predominantly pedagogical and limited in scope, aggravated by the authority's small technical and administrative staff.observed
- ProbableIAPP — ANPD's transformation into a regulatory agency is expected to bring greater structural and budgetary robustness, with increased staff and technical resources and enhanced operational independence.observed
- ConfirmedIAPP — The sum of fines collected by ANPD is allocated to the Diffuse Rights Defense Funds referred to in Law No. 7.347/1985 and Law No. 9.008/1995.observed
- ConfirmedIAPP — Brazil's Constitution gives all citizens a private right of action and a public right of action to the Brazil Public Prosecutors' Office, enabling individual and class suits regardless of ANPD's administrative sanction status.observed
- ConfirmedIAPP — In January 2026, the European Commission recognized that Brazil ensures an adequate level of protection for personal data transferred from the EU under the GDPR.observed
- ConfirmedIAPP — Brazil's Digital ECA (Law 15.211/2025) took effect 17 March 2026, alongside Decree 12.881/2026 operationalizing its preventive-measures and accountability requirements, with ANPD empowered as enforcer.observed
- ConfirmedIAPP — On 22 May 2026, ANPD opened a call for contributions on its Age Verification Mechanisms Guide, updating preliminary guidelines published in March 2026 to implement the Digital ECA.observed