In 2026, the authority became a regulatory agency with administrative autonomy, a larger staff, and a real capacity to increase the number of simultaneous proceedings. The 2026–2027 Priority Topics Map provides for 75 enforcement actions over the two-year period, focusing on health data, biometric data, financial data, children's data, and artificial intelligence. Understanding how LGPD fines work, what the ANPD reviews before imposing sanctions, and what your company needs to have in place is no longer merely a precaution. It has become a concrete necessity.
In this article, you will find:
What sanctions are provided for under the LGPD and how the amounts are calculated
What the ANPD actually investigates and which violations have already resulted in sanctions
What your company needs to have in place to avoid enforcement action
Enjoy the read.
What Sanctions Are Provided for Under the LGPD?
The LGPD provides for a range of sanctions that go beyond financial penalties. The ANPD may issue a warning, impose a fine, impose a daily fine, publicly disclose the violation, block unlawfully processed data, and order the deletion of data.
These sanctions are not mutually exclusive. A company may receive a warning and, in the event of noncompliance, have its data blocked and still be fined.
Administrative Fine
The fine can reach 2% of the company’s net revenue from the previous year, capped at R$50 million per violation. The amount is not fixed: the ANPD applies penalty-calculation criteria that consider the severity of the violation, the company’s good faith, the adoption of corrective measures, and the financial capacity of the infringing party.
Microenterprises and small businesses may have the amount adjusted proportionally, but they are not exempt. The first financial penalty imposed on a private-sector company was issued against a microenterprise, Telekall Infoservice, for failing to appoint a DPO and for improperly processing customer data.
Daily Fine
Deliberation CD-10/2025 introduced daily fines for failure to comply with precautionary measures. When the ANPD orders a company to take a measure and the deadline is not met, the fine accrues daily until compliance is achieved.
Public Disclosure of the Violation
Public disclosure of an enforcement action has a reputational impact that often exceeds the financial impact of the fine. Customers, partners, and suppliers have access to the information, and the damage to the company’s credibility can be more difficult to recover from than any amount paid.
What Does the ANPD Actually Investigate?
ANPD enforcement is not random. It follows thematic and sector-specific cycles defined in advance, and proceedings may be initiated based on data subject complaints, the authority’s own monitoring, or notifications directed at specific sectors.
The cases seen most frequently so far involve issues that any company can address before an inspection.
No DPO or Inadequate Communication Channel
In December 2024, the ANPD notified 20 major companies, including Uber, Serasa, Vivo, TikTok, and X, for failing to provide an effective communication channel for data subjects and for not having a designated data protection officer. All 20 implemented the measures required after being notified.
Failure to appoint a DPO is an independent violation. The ANPD has already demonstrated that it can sanction this issue regardless of any other violation.
Failure to Report Incidents
Companies that suffer data breaches and fail to notify the ANPD within the three-business-day deadline established by Resolution CD/ANPD No. 15/2024 are subject to a specific sanction for this failure, regardless of the incident itself.
Processing Data Without a Legal Basis
Collecting, storing, or sharing personal data without a defined legal basis is one of the most common violations and one of the most difficult to defend in sanctioning proceedings, because the absence of documentation leaves little room for argument.
What Does Your Company Need to Have in Place to Avoid an LGPD Fine?
The ANPD reviews documents, processes, and concrete evidence of compliance. Claiming that the company is compliant without being able to demonstrate it is what can turn a notification into an enforcement action.
The points most frequently reviewed by the authority are the same ones found in any well-structured LGPD compliance process: an appointed DPO with published contact information, a functional channel for handling data subject requests, an up-to-date record of processing activities, contracts with processors that establish security obligations, and an incident notification protocol.
In addition to documentation, the ANPD considers the company’s conduct during an investigation. Companies that voluntarily adopt corrective measures before any proceedings are initiated may have this behavior recognized as a mitigating factor when determining the sanction.
Data breach prevention is part of this effort: an incident that could have been prevented through appropriate technical controls can weigh negatively in the ANPD’s assessment of the company’s diligence.
Small Businesses Are Also on the Radar
A common misconception is that the ANPD focuses only on large corporations. The Telekall case demonstrated otherwise: the first financial fine imposed on a private-sector company was issued against a microenterprise.
What determines the ANPD’s attention is not the size of the company, but the severity of the violation and its impact on data subjects. A small business that processes sensitive data belonging to many data subjects without adequate controls can be just as exposed as a large organization.
STWBrasil helps companies structure the processes and controls that the ANPD reviews during enforcement actions, from appointing the DPO to implementing technical security and incident notification protocols. If your company does not yet have these processes in place, talk to our team.
