BrazilLGPD, civil liability, administrative sanctions and the ANPD
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect administrative sanctions, including a simple fine of up to 2% of the private legal entity's, group's, or conglomerate's revenue in Brazil in its last fiscal year, excluding taxes, capped in total at R$50,000,000.00 per infraction, for violations the ANPD investigates through due administrative process.
- As a controller or operator, repair patrimonial, moral, individual, or collective damage you cause a person by processing personal data in violation of the data-protection legislation, and expect a court to shift the burden of proof to you where the data subject's allegation is plausible.
- Expect the ANPD to require information from you at any time, to receive and act on data-subject complaints, and to inspect and sanction noncompliant processing through a process that guarantees your defense and right of appeal.
- Comply with an ANPD warning's corrective-measures deadline before facing escalation to a fine, publicity of the infraction, blocking or deletion of the data involved, or suspension of the processing activity.
These lines are LexLint's reading of the law's text. Also read by: Agência Nacional de Proteção de Dados (ANPD) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 52, II states the fine as a simple fine of up to 2% of the private legal entity's, group's, or conglomerate's revenue in Brazil in its last fiscal year, excluding taxes, but limits the total to this fixed cap per infraction; article 52, III also allows a daily fine observing the same total limit.
- Rule
- Fixed only
- As of
- Currency
- BRL
- Fixed cap
- 50,000,000
Who enforces it
Enforcement body
Agência Nacional de Proteção de Dados (ANPD)
Enforcement record
The ANPD's monitoring-cycle report for to (24 months) records 3 administrative sanctioning proceedings opened, which is 1.5 a year; the count excludes the 35 inspection procedures and 4 preparatory procedures the same report lists, and any private suit for damages under article 42. The report states no fine total.
- As of
- Source link
- https://www.gov.br/anpd/pt-br/assuntos/fiscalizacao/saiba-como_fiscalizamos/relatoriociclodemonitoramento20232025_0610.pdf/@@display-file/file
- Actions per year
- 1.5
Settledness
The ANPD's own Regulation on Dosimetry and Application of Administrative Sanctions (Resolution CD/ANPD No. 4 of ), in the ANPD's English version, states how the base value of a simple fine is calculated and limited.
- As of
- Guidance link
- https://www.gov.br/anpd/pt-br/centrais-de-conteudo/outros-documentos-e-publicacoes-institucionais/regulamento-de-dosimeria-em-lingua-inglesa.pdf/@@display-file/file
- Guidance body
- Agência Nacional de Proteção de Dados (ANPD)
- Open questions
- Does the ceiling of 2% of revenue in article 52, II of the LGPD apply together with the total limit of R$ 50.000.000,00 per infraction, or does the limit alone apply where the ANPD, under article 52, §4, uses the total revenue of the company or group because the revenue of the line of business in which the infraction occurred is unavailable or incomplete?
What it makes you log
Logging duty
Articles 42 to 45 set civil liability; Article 42, paragraph 2 lets a judge reverse the burden of proof in the data subject's favor in a civil case, which allocates evidence between the parties and sets no duty to keep a record. Articles 52 to 54 set the administrative sanctions, and Articles 55-A to 58-B set up the national authority and its competence, including the power in Article 55-J to carry out or order audits of processing. No cited article requires a log or a record; the register of processing operations is in Article 37, which this row does not cite.
- Kind
- None
- As of
What this law does
Article 42 makes a controller or operator that causes patrimonial, moral, individual, or collective damage through personal-data processing in violation of the data-protection legislation liable to repair it, holds an operator jointly liable when it breaches the legislation or departs from the controller's lawful instructions, lets a court shift the burden of proof to the controller where the data subject's claim is plausible, and lets the reparation claim proceed collectively in court.
Article 52 subjects a controller or operator to administrative sanctions the ANPD applies after a due process guaranteeing full defense, from a warning with a correction deadline through a simple fine of up to 2% of the private legal entity's, group's, or conglomerate's revenue in Brazil in its last fiscal year, excluding taxes, capped in total at R$50,000,000.00 per infraction, a daily fine observing the same cap, publicity of the confirmed infraction, blocking or deletion of the data at issue, and suspension of the database or the processing activity for up to six months, renewable once.
Articles 53 and 54 require the ANPD to publish, after public consultation, the methodology it uses to calculate a fine's base value and to ground a daily fine's amount in the violation's gravity and the harm caused.
Article 55-A creates the supervisory authority as a special autarchy; its most recent redação, given by Lei nº 15.352, de 2026, names it the Agência Nacional de Proteção de Dados (ANPD) rather than the Autoridade Nacional de Proteção de Dados the LGPD first created in 2018, and links it to the Ministério da Justiça e Segurança Pública with functional, technical, decision-making, administrative, and financial autonomy.
Article 55-J gives the ANPD the power to issue rules, demand information from any controller or operator at any time, receive and act on data-subject complaints, and inspect and sanction noncompliant processing through a process that guarantees the defendant's defense and right of appeal.
Articles 58-A and 58-B create a National Council on Data Protection and Privacy with representatives of government, the legislature, the judiciary, and civil society to advise the ANPD and propose data-protection and privacy policy.
The civil-liability chapter and the ANPD's own creation took effect with the LGPD's general provisions on , but the administrative-sanctions chapter, articles 52 to 54, did not take effect until , under article 65, I-A, added by Lei nº 14.010/2020.
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .