← Lois sur la protection des données et la cybercriminalité par pays
Brazil : protection des données, cybercriminalité, amendes et peines
LGPD enforced by the ANPD, a regulatory agency since Feb 2026. Few fines published so far, but a record enforcement pipeline; the ECA Digital and Central Bank rules widen exposure.
- Law
- LGPD (Lei 13.709/2018) – General Data Protection Law
- Authority
- ANPD (regulatory agency since 25 Feb 2026, Lei 15.352/2026)
- Max fine
- 2% of Brazilian revenue, capped at BRL 50M per infraction; ECA Digital: up to 10% of the group's Brazilian revenue
- Breach notification
- 3 business days to the ANPD and data subjects (Res. CD/ANPD 15/2024)
- DPO
- Mandatory (art. 41), with a simplified regime for small processing agents
Crimes
| Unauthorized intrusion into a computer device | Art. 154-A Penal Code | 1 to 4 years' imprisonment + fine |
| Theft by electronic fraud | Art. 155, §4º-B Penal Code | 4 to 8 years |
| Electronic fraud | Art. 171, §2º-A Penal Code | 4 to 8 years |
| Extortion / ransomware | Art. 158 Penal Code | 4 to 10 years |
| False identity | Art. 307 Penal Code | 3 months to 1 year |
| Disruption of telematic services | Art. 266 Penal Code | 1 to 3 years |
Risks
- Unreported incidents: the main cause of ANPD sanctions
- Pix fraud and social engineering (MED 2.0 mandatory)
- Minors: ECA Digital, sanctions expected from Nov 2026
- Cyber compliance with Res. CMN 5.274 / BCB 538 (deadline 1 Mar 2026)
- No DPO or data-subject channel (20 large companies notified in Dec 2024)
- Res. CMN 5.274/2025 and BCB 538/2025: 14 controls, MFA for Pix/STR, threat intelligence and annual independent pentest
- Pix MED 2.0 mandatory since 2 Feb 2026: traces funds across accounts, refunds within 11 days
- BC Protege+ (Dec 2025): citizens can block account openings; 111k suspicious openings blocked in 1 month
- ECA Digital (Lei 15.211/2025) in force since 17 Mar 2026: age assurance, privacy by default
- Sectoral: CVM Res. 35/2021, ANATEL Res. 740/2020, ANEEL Res. 964/2021; Bill PL 4752/2025 (cybersecurity framework) pending
- AI Bill PL 2338/2023: passed the Senate on 10 Dec 2024; awaiting report in the Chamber (Oct 2026)
Source: ANPD – Relatório do Ciclo de Monitoramento 2023-2025 · Turivius – Multas da LGPD 2026 · Mayer Brown – Res. CD/ANPD 15/2024 · Trench Rossi – CMN/BCB · Planalto – Lei 13.709/2018