Brazil LGPD ANPD Enforcement and Fines

Resolution 4/2023 says the ANPD applies sanctions only after an administrative proceeding and a reasoned decision, with full defense, contradiction, and due process. The decision must identify the facts and legal grounds and, when it imposes a sanction, state the relevant action, deadline, payment amount, or daily-fine terms.

The ANPD may use monitoring, orientation, prevention, and repression within its inspection framework, as well as preventive or corrective measures and Article 52 sanctions. Failure to comply with a preventive measure can aggravate a later sanction, while failure to comply with a sanction or regularize the conduct can lead the ANPD to escalate its response. Treat every official request, measure, and deadline as a separate obligation rather than waiting for a fine decision.

Keep the stages distinct: an information request or inspection finding is not a final infringement decision, and a corrective measure is not automatically a monetary sanction. The notice and current procedural record control what response is due, when it is due, and which review or appeal route is available.

Resolution 4/2023 classifies an infringement as light, medium, or serious. A medium infringement can significantly affect data subjects' fundamental interests and rights by materially limiting a right or service or causing material or moral harm, unless it meets the serious test. A serious infringement meets the medium test plus a listed factor, such as large-scale processing, economic advantage, risk to life, sensitive or children's data, processing without a legal basis, unlawful or abusive discrimination, or systematic irregular practices. Obstruction of ANPD supervision is also serious.

A warning may be used for a light or medium infringement without specific recidivism, or when corrective measures are needed. A simple fine applies when the infringer fails to meet preventive or corrective measures, the infringement is serious, or another sanction is unsuitable in light of the conduct, processing, data, and case circumstances. The ANPD must still justify its choice.

The ANPD calculates a value base for each infringement from its classification, the degree of harm, and the infringer's revenue in the business activity affected. If reliable activity-specific revenue is unavailable, Resolution 4/2023 provides alternatives, including total Brazil revenue in defined circumstances. The statutory basis is not worldwide group turnover.

The ANPD then applies aggravating and mitigating factors. Specific recidivism adds 10% per case up to 40%; generic recidivism adds 5% per case up to 20%; failure to meet orientation or preventive measures adds 20% per measure up to 80%; and failure to meet corrective measures adds 30% per measure up to 90%. Mitigation can reduce the amount for timely cessation, implemented governance and damage-minimization controls, timely measures that reverse or mitigate effects, and cooperation or good faith. The infringer bears the burden of proving the mitigating conditions.

Legal or regulatory affairs should coordinate the proceeding. Privacy, security, product, operations, finance, and the relevant controller or operator should supply verified evidence within their remit. The response should connect every factual assertion to a contemporaneous record and every remedial claim to a dated outcome.

Keep a single chronology from the processing decision or incident through notice, investigation, containment, data-subject communications, remediation, ANPD submissions, and final action. Record disputed facts and legal positions clearly; cooperation does not require conceding an unsupported allegation.