Leyes de protección de datos y delitos informáticos por país
LGPD, GDPR, leyes estatales de EE. UU. y 19 países comparados: autoridades, multas máximas, plazos de notificación, delitos informáticos y penas.
| Law | Authority | Max fine | Notification | |
|---|---|---|---|---|
| Brasil | LGPD (Lei 13.709/2018) – General Data Protection Law | ANPD (regulatory agency since 25 Feb 2026, Lei 15.352/2026) | 2% of Brazilian revenue, capped at BRL 50M per infraction; ECA Digital: up to 10% of the group's Brazilian revenue | 3 business days to the ANPD and data subjects (Res. CD/ANPD 15/2024) |
| Estados Unidos | No general federal law; sectoral laws (FTC Act §5, HIPAA, COPPA) and 24 state laws (e.g. CCPA/CPRA) | FTC, SEC, HHS/OCR, CPPA (California), NYDFS and state attorneys general | Per violation, varies by law; CPPA record: US$1.35M; breach settlements up to US$700M (Equifax) | SEC 8-K: 4 business days after materiality; NYDFS: 72h (extortion payment 24h); CIRCIA (pending): 72h / 24h |
| México | LFPDPPP (DOF 20/03/2025) | Secretaría Anticorrupción y Buen Gobierno (sucesora del INAI) | Fijadas en UMA (tope no verificado) | — |
| Colombia | Ley 1581 de 2012 | SIC (Superintendencia de Industria y Comercio) | Hasta 2.000 salarios mínimos mensuales (art. 23) | — |
| Chile | Ley 21.719 (datos personales) y Ley 21.663 (Ley Marco de Ciberseguridad) | Agencia de Protección de Datos Personales y ANCI (ciberseguridad) | Ley 21.719: hasta 20.000 UTM o 4% de los ingresos (reincidencia); Ley 21.663: hasta 40.000 UTM para OIV | ANCI: alerta temprana en 3 h, informe preliminar en 72 h (24 h para OIV), final en 15 días |
| Argentina | Ley 25.326 (2000) | AAIP (Agencia de Acceso a la Información Pública) | — | — |
| Perú | Ley 29.733 + Reglamento DS 016-2024-JUS | ANPD-Perú (MINJUSDH) | — | 48 h (Reglamento 2024) |
| Uruguay | Ley 18.331 (2008) | URCDP (Unidad Reguladora y de Control de Datos Personales) | — | 72 h (Ley 19.670/2018) |
| Unión Europea | GDPR (Regulation 2016/679) | National data protection authorities + EDPB | €20M or 4% of global turnover | GDPR: 72h; NIS2: 24h early warning, 72h notification, final report in 1 month |
| Germany | GDPR + StGB (computer crimes) | BfDI (federal authority) | €20M or 4% (GDPR); e.g. Vodafone €45M (2025) | 72h (GDPR) |
| France | GDPR + Code pénal (art. 323-1 et seq.) | CNIL | €20M or 4% (GDPR); e.g. Google €325M (2025) | 72h (GDPR) |
| Italy | GDPR | Garante per la protezione dei dati personali | €20M or 4% (GDPR); e.g. Enel Energia €79M (2024) | 72h (GDPR) |
| United Kingdom | UK GDPR + Data (Use and Access) Act 2025 | ICO (Information Commissioner's Office) | £17.5M or 4% (UK GDPR; extended to PECR by the DUAA) | — |
| India | DPDP Act 2023 + DPDP Rules 2025 | Data Protection Board of India (appeals to TDSAT) | Up to ₹250 crore (security safeguards); ₹200 crore (unreported breach or children); ₹50 crore (other) | Data principals: "without delay" |
| China | PIPL + Cybersecurity Law (CSL, amended) | CAC (Cyberspace Administration of China) | PIPL: RMB 50M or 5% of annual revenue; CSL: up to RMB 10M in serious cases | Relatively serious incident: preliminary in 4h, full report in 72h, analysis within 30 days |
| Japan | APPI (Act on the Protection of Personal Information) | PPC (Personal Information Protection Commission) | Up to ¥100M for companies that breach orders | Preliminary "promptly" (about 3–5 days); final within 30 days (60 if wilful) |
| Singapore | PDPA (Personal Data Protection Act) | PDPC (Personal Data Protection Commission) | 10% of local turnover (if > S$10M) or S$1M | 3 calendar days after assessment |
| South Korea | PIPA (Personal Information Protection Act) | PIPC (Personal Information Protection Commission) | — | — |
| Australia | Privacy Act 1988 (POLA Act 2024 reform) | OAIC (Office of the Australian Information Commissioner) | Greatest of A$50M, 3x the benefit obtained or 30% of adjusted turnover | — |
Largest GDPR fines
| Company | Authority | Amount | Year | Reason |
|---|---|---|---|---|
| Meta Platforms Ireland | DPC (Ireland) | €1.2bn | 2023 | Data transfers to the US |
| TikTok | DPC | €530M | 2025 | Transfers to China; upheld by the High Court, questions referred to the CJEU |
| Meta (Instagram) | DPC | €405M | 2022 | Teenagers' data |
| Meta | DPC | €390M | 2023 | Legal basis for ads |
| TikTok | DPC | €345M | 2023 | Children's accounts |
| LinkedIn Ireland | DPC | €310M | 2024 | Behavioral advertising |
| Uber | AP (Netherlands) | €290M | 2024 | Driver data transfers |
| Meta | DPC | €265M | 2022 | Scraping of 533M accounts |
| Meta | DPC | €251M | 2024 | 2018 breach (29M accounts) |
| WhatsApp Ireland | DPC | €225M | 2021 | Transparency |
| Google LLC | CNIL (France) | €200M | 2025 | Gmail ads and cookies |
| SHEIN | CNIL | €150M | 2025 | Cookies without consent |
| Google Ireland | CNIL | €125M | 2025 | Same decision (€325M total) |
| Meta | DPC | €91M | 2024 | Plaintext passwords |
| Google LLC | CNIL | €90M | 2021 | Cookies |
| Enel Energia | Garante (Italy) | €79M | 2024 | Telemarketing |
| Google Ireland | CNIL | €60M | 2021 | Cookies |
| Vodafone Germany | BfDI (Germany) | €45M | 2025 | Security failures |
| Amazon France Logistique | CNIL | €32M | 2023 | Employee monitoring |
| Clearview AI | AP (Netherlands) | €30.5M | 2024 | Illegal facial database |
| Amazon Europe Core | CNPD (Luxembourg) | €746M (annulled) | 2021 | Annulled by Luxembourg courts on 12 Mar 2026 |
Fuente: Enzuzo, GDPR Local, DeepStrike; Amazon: Chronicle.lu; TikTok: Digital Policy Alert. O caso Meta na Espanha (€479 mi, 2025) é decisão de concorrência desleal, não multa do GDPR.
2026 privacy fine highlights (EU and UK)
| Date | Company | Authority | Amount | Reason |
|---|---|---|---|---|
| 13/01/2026 | Free Mobile + Free | CNIL | €42M (27 + 15) | Breach of 24M contracts, including IBANs |
| 23/02/2026 | ICO (UK) | £14.47M | Under-13 data without age assurance | |
| 07/05/2026 | South Staffordshire Water | ICO | £963.9k | Ransomware undetected for 20 months, started by phishing |
| 28/05/2026 | IQVIA Operations France | CNIL | €5M | Poorly protected health data |
| Jul 2026 | Wind Tre | Garante | €1.72M | Social engineering |
Fuente: GDPR Local – Top GDPR fines 2026; Solicitors Journal
Cumulative GDPR fine totals
| Source | Total | Cut-off date | Link |
|---|---|---|---|
| DLA Piper | €7.1bn since 25 May 2018; about €1.2bn in 2025; 443 breach notifications per day (+22%) | 10/01/2026 | ↗ |
| CMS Enforcement Tracker | 2,685 fines (3,062 incl. incomplete data), about €6.11bn; Spain leads by count (1,048) | 01/03/2026 | ↗ |
| CMS (cited by DeepStrike) | About €6.31bn across 3,195 fines | Jul 2026 | ↗ |
Fuente: Metodologias diferentes: não somar DLA Piper e CMS.
US state privacy laws
| State | Law | Effective date |
|---|---|---|
| California | CCPA/CPRA | 01/01/2020 (CPRA: 01/01/2023) |
| Virginia | VCDPA | 01/01/2023 |
| Colorado | CPA | 01/07/2023 |
| Connecticut | CTDPA | 01/07/2023 |
| Utah | UCPA | 31/12/2023 |
| Texas | TDPSA | 01/07/2024 |
| Oregon | OCPA | 01/07/2024 |
| Florida | Digital Bill of Rights (narrow scope) | 01/07/2024 |
| Montana | MCDPA | 01/10/2024 |
| Delaware | DPDPA | 01/01/2025 |
| Iowa | ICDPA | 01/01/2025 |
| Nebraska | NDPA | 01/01/2025 |
| New Hampshire | NHDPA | 01/01/2025 |
| New Jersey | NJDPA | 15/01/2025 |
| Tennessee | TIPA | 01/07/2025 |
| Minnesota | MCDPA | 31/07/2025 |
| Maryland | MODPA | 1 Oct 2025 (applies to processing from 1 Apr 2026) |
| Indiana | ICDPA | 01/01/2026 |
| Kentucky | KCDPA | 01/01/2026 |
| Rhode Island | RIDTPPA | 01/01/2026 |
| Oklahoma | SB 546 | 01/01/2027 |
| Louisiana | SB 386 | 01/01/2027 |
| Alabama | HB 351 | 01/05/2027 |
| Vermont | S.71 (Act 145) | 01/01/2028 |
Fuente: ComplyJet – US State Privacy Laws List 2026; MultiState (04/02/2026). Datas no formato DD/MM/AAAA.
CCPA enforcement by the CPPA (California)
| Date | Company | Amount | Source |
|---|---|---|---|
| Mar 2025 | American Honda Motor (first action) | US$ 632.500 | ↗ |
| 2025 | Todd Snyder | US$ 345.000 | ↗ |
| Sep 2025 | Tractor Supply (largest CPPA fine) | US$1.35M | ↗ |
Fuente: Polsinelli; White & Case
FTC privacy and data security actions in 2025
| Date | Company | Type | Outcome |
|---|---|---|---|
| Jan 2025 | Cognosphere (Genshin Impact) | COPPA / Section 5 | US$20M + loot-box restrictions for under-16s |
| Sep 2025 (announced 31 Dec 2025) | Disney | COPPA (YouTube) | US$10M |
| 2025 | Apitor Technology | COPPA | US$500k (suspended) |
| Sep 2025 | Aylo Group (with Utah) | Stipulated order | Compliance program and age verification |
| Sep 2025 | Sendit (Iconic Hearts) | COPPA / ROSCA | Lawsuit pending |
| 2025 | GoDaddy | Data security | Comprehensive security program |
| Dec 2025 | Illuminate Education | Data security | Consent order; US$5.1M multistate settlement |
| Dec 2025 | Illusory Systems (Nomad) | Data security (crypto) | Security program + restitution |
Fuente: Perkins Coie – Privacy Law Recap 2025; Hunton (Disney)
Cyber incidents disclosed to the SEC via 8-K
| Year | Incidents |
|---|---|
| 2023 | 64 |
| 2024 | 55 |
| 2025 | 32 |
| 2026 (to 19 Apr) | 8 |
Fuente: Board Cybersecurity (20/04/2026); Itens 1.05, 8.01 e 7.01, contados pela 1ª divulgação
HIPAA: HHS/OCR fines and settlements in 2025
| Date | Entity | Amount (US$) |
|---|---|---|
| 14/01/2025 | Solara Medical Supplies | 3,000,000 |
| 28/05/2025 | BayCare Health System | 800,000 |
| 23/04/2025 | PIH Health | 600,000 |
| 10/04/2025 | Northeast Radiology | 350,000 |
| 08/01/2025 | USR Holdings | 337,750 |
| 23/07/2025 | Syracuse ASC | 250,000 |
| 21/03/2025 | Health Fitness Corp. | 227,816 |
| 07/07/2025 | Deer Oaks | 225,000 |
| 06/03/2025 | Oregon Health & Science University | 200,000 |
| 30/09/2025 | Cadia Healthcare | 182,000 |
| 18/08/2025 | BST & Co. CPAs | 175,000 |
| 07/01/2025 | Virtual Private Network Solutions | 90,000 |
| 07/01/2025 | Elgon Information Systems | 80,000 |
| 30/05/2025 | Comstar | 75,000 |
| 15/01/2025 | Memorial Healthcare System | 60,000 |
| 25/04/2025 | Comprehensive Neurology | 25,000 |
| 17/04/2025 | Guam Memorial Hospital Authority | 25,000 |
| 15/01/2025 | Northeast Surgical Group | 10,000 |
| 15/05/2025 | Vision Upright MRI | 5,000 |
Fuente: Compliancy Group – HIPAA Fines by Year: 19 ações, cerca de US$ 6,7 mi (soma das linhas US$ 6.717.566; cabeçalho da fonte US$ 6.697.566). Todas citam falha de análise de risco.