Brazil's LGPD in practice: what the ANPD enforces and how to comply
Three-day breach notices, DPO rules, standard clauses and fines up to R$50 million: the ANPD regulations in force and its 2026–2027 enforcement priorities.
Brazil's General Data Protection Law (LGPD) has entered a more practical phase. The National Data Protection Authority (ANPD) has issued regulations that spell out what companies must do, and it plans to step up enforcement.
More enforcement in 2026–2027
The ANPD's priority map for 2026–2027, approved at the end of 2025, foresees a 25% increase in enforcement actions, according to Convergência Digital. The four priority areas are data subjects' rights (health, financial and biometric data; targeted advertising), children and adolescents (under Law 15,211/2025), the public sector, and artificial intelligence, which has its own chapter for the first time.
The authority says it now has the institutional maturity to move from a mainly advisory stance to stronger enforcement. Provisional Measure 1,317/2025, which turned the ANPD into an independent regulatory agency, provides for 218 positions in a new career of data protection regulation specialists. Telecommunications, data aggregators and digital platforms are no longer stand-alone priorities; platforms will be examined when their processing touches one of the four main themes. In the children's chapter, the ANPD plans its first structured oversight cycle of platforms and services, looking at privacy by design, age assurance and excessive data retention. In the AI chapter, it will look at profiling, algorithmic opacity and facial recognition in both the public and private sectors.
Regulations in force
- Resolution 4/2023 (sanctions): nine sanctions, from warnings to processing bans; simple fines up to 2% of revenue, capped at R$50 million per infraction (Mobile Time).
- Resolution 15/2024 (security incidents): notify the ANPD and data subjects within three business days when an incident may significantly affect people and involves sensitive, children's, financial, authentication, confidential or large-scale data; keep records of all incidents for five years (Cescon Barrieu).
- Resolution 18/2024 (DPO): formal appointment and public disclosure of the DPO's identity and contact details (Lefosse).
- Resolution 19/2024 (international transfers): since 23 August 2025, contract-based transfers must use the ANPD's standard clauses or ANPD-approved specific clauses (Lefosse).
For incidents, the clock starts when the controller learns that personal data were affected, not when it concludes that the risk is relevant. Initial notices can be supplemented within 20 business days, and small processing agents get double the time. Notices must describe the data affected, the number of people involved (including children and older adults), the risks, the mitigation measures and the DPO's contact details.
A compliance checklist
- Map personal data flows and their legal bases.
- Formally appoint a DPO and publish contact details.
- Update supplier contracts and adopt Brazil's standard clauses for transfers abroad.
- Build an incident response plan that can meet the three-business-day deadline.
- Keep an incident log for five years.
- Set up a process for data subject requests.
- Prioritise health, financial, biometric and children's data, and any AI-driven profiling.
Sanction criteria reward good faith, cooperation, governance programmes and swift corrective action, so documented compliance pays off if the regulator knocks.
Source
- Convergência Digital – ANPD: mais funcionários, mais aperto na fiscalização (12/01/2026)
- Cescon Barrieu – ANPD aprova o Regulamento de Comunicação de Incidente de Segurança
- Mobile Time – ANPD publica regulamento de dosimetria e aplicação de sanções
- Lefosse – ANPD publica regulamento sobre a atuação do encarregado (DPO)
- Lefosse – Prazo para adoção das cláusulas-padrão da ANPD se encerra em 23 de agosto