Brazil LGPD Penalties and Fines

A warning identifies a deadline for corrective measures. A simple fine is a one-time monetary sanction. A daily fine accumulates to secure compliance with a non-monetary sanction or ANPD order, address obstruction when needed, or respond to a continuing infringement. Public disclosure requires the infringer to publish the infringement after it has been investigated and confirmed; it is different from the ANPD publishing its own decision.

Blocking temporarily stops every processing operation involving the affected data while preserving the data until the conduct is regularized. Deletion removes the affected data. When data have been shared, the infringer generally must notify the other processing agents so they repeat the blocking or deletion, unless that communication is demonstrably impossible or disproportionate and the ANPD accepts the exception.

The simple-fine ceiling is up to 2% of the applicable revenue of a private legal entity, group, or conglomerate in Brazil in its last fiscal year, excluding taxes, and no more than R$50 million per infringement. This is not an automatic penalty, a worldwide-turnover calculation, or a cap for an entire investigation regardless of the number of infringements.

Resolution 4/2023 calculates the value for each infringement from its light, medium, or serious classification, degree of harm, and the infringer's revenue in the affected business activity. It then applies aggravating and mitigating factors and statutory minimums and ceilings. A daily fine accumulates until compliance under the terms in the decision but is also limited to R$50 million per infringement.

A monetary decision must also be calendarized. Resolution 4/2023 sets payment within up to 20 business days after official notice, with double time for qualifying small processing agents. An infringer that waives the appeal may receive a 25% reduction if it pays within the applicable period; late payment can add interest and a daily late charge under the regulation.

Partial database suspension applies to a database that does not comply with data-protection law. It can last up to six months and be extended once for the same period, until the controller regularizes the processing. Suspension of the affected processing activity has the same maximum period and possible extension.

Partial or total prohibition of processing activities is reserved for the conditions in Article 26 of Resolution 4/2023: recurrence after a suspension sanction, processing for unlawful purposes or without a legal basis, or loss of the technical and operational conditions needed for proper processing. Under LGPD Article 52(6), the suspension and prohibition sanctions require that at least one of the specified earlier sanctions already have been imposed for the same case, and the ANPD must hear a competent sector regulator when applicable.

Private processing agents can face the full Article 52 sanction set when the conditions are met. Public entities and bodies can face warning, public disclosure, blocking, deletion, partial database suspension, processing suspension, and partial or total prohibition, alongside consequences under public-service, administrative-misconduct, access-to-information, and other applicable laws. Resolution 4/2023 does not list simple or daily fines among the sanctions applicable to public bodies.

For any organization, an ANPD sanction does not settle every form of liability. Article 52 states that its administrative sanctions do not replace administrative, civil, or criminal sanctions under the Consumer Defense Code and other specific legislation. A single event may therefore require separate analysis by courts, consumer authorities, prosecutors, or sector regulators.