What the ANPD is
The Autoridade Nacional de Proteção de Dados (ANPD) is Brazil's federal authority for overseeing compliance with the Lei Geral de Proteção de Dados (LGPD), the country's general law on data protection (Law No. 13,709/2018). The law itself created the ANPD, which began work in 2020. It later gained the status of a special autonomous federal agency (autarquia especial) linked to the Ministry of Justice. It has its own budget and administrative independence from sector regulators.
Its reach is broad. The LGPD applies to any processing of personal data carried out in Brazil or aimed at people located there. The ANPD therefore oversees companies, public bodies, and non-profit organizations in every sector, including health, finance, telecommunications, education, and public administration. Sector regulators keep their own competences and work alongside it.
Powers and regulatory tools
The ANPD combines the roles of rule-maker, adviser, and enforcer. Its main tools are:
| Tool | What it means |
|---|---|
| Regulations | Binding rules that implement the LGPD, e.g. breach notification |
| Guidance and interpretation | Official statements, technical guidance, and public consultations |
| Oversight and inspection | Power to demand information, audit processing, and require evidence |
| Investigation and sanctions | Administrative proceedings that can end in warnings, fines or restrictions |
| Cooperation | Coordination with Brazilian authorities and foreign data protection regulators |
Investigations and proceedings
Cases reach the ANPD through complaints from data subjects, data breach reports from organizations, referrals from other authorities, or the authority's own monitoring. Once an investigation opens, the controller may be asked for documents and explanations. A case can close with a corrective commitment, or move to a formal administrative proceeding in which the parties present their defense.
When a sanction is considered, the authority weighs the factors set out in the law. These include the severity and nature of the infraction, the nature of the affected data, including sensitive data, whether damage occurred, bad faith, the economic advantage gained, recidivism, and cooperation with the investigation. Since 2023 these criteria have been detailed in the ANPD's inspection and sanctioning regulations. Enforcement has moved from guidance documents to substantial fines in cases that set precedent.
Sanctions the ANPD can impose
Under Article 52 of the LGPD, a confirmed infraction can attract a graduated set of sanctions. Daily fines can apply for as long as a violation persists. Fines are calculated on revenue in Brazil for the previous fiscal year, excluding taxes, and capped at 50 million reais per infraction.
| Sanction | What it involves | Applies to |
|---|---|---|
| Warning | Deadline for corrective measures, usually for minor or first violations | Minor or first violations |
| Fines | Up to 2% of Brazilian revenue, capped at 50 million reais | Revenue in Brazil for the previous fiscal year, excluding taxes |
| Publicizing the infraction | Publication of the decision after the proceeding closes | The confirmed infraction |
| Blocking or deletion of data | Blocking the data involved until fixed, or ordering its deletion | The data involved |
| Suspension and prohibition | Partial database suspension for up to six months, or a processing ban | The processing activity |
The ANPD internationally
The LGPD was strongly influenced by the European GDPR. In Brazil the ANPD holds the position that national supervisory authorities hold in the EU: an independent regulator that enforces the law and shapes its practical meaning through regulation. It takes part in international cooperation networks such as the Global Privacy Assembly. Cross-border cases increasingly involve parallel proceedings before the ANPD and European authorities.
For multinational organizations, Brazilian data protection is a separate workstream. The ANPD's rules, deadlines, and sanctions apply to processing that reaches Brazil, even when the company's main establishment and its GDPR documentation sit elsewhere.
How organizations work with the ANPD
For an organization processing personal data in Brazil, the relationship with the authority is mostly preventive and procedural. These duties are usually part of an LGPD adequacy program:
| Obligation | What it means |
|---|---|
| Data protection officer (encarregado)Contact with the ANPD | Appoint a person for requests and ANPD contact; publish their details |
| Breach notificationIncident report | Report relevant incidents within three business days of awareness |
| Requests for informationDocumentation | Provide documentation on processing within the deadlines set |
| Prior consultationHigh-risk processing | Consult the ANPD before processing if high risk remains |
| International transfersTransfer mechanism | Use a legal transfer mechanism, such as ANPD standard contractual clauses |
Where to start
A company that processes personal data in Brazil can start with a short list: who controls the data, which categories it holds, who answers ANPD requests and who would report an incident within three business days. Controls such as data loss prevention help show where that data travels. Multinationals should treat Brazil as a separate workstream, not as a footnote to a GDPR program.
Further reading: Use Anexet Ultimate DLP system for GDPR compliance.
A regulator's first question is rarely about the breach. It asks who holds personal data, why, and who answers for it.
Anexet Team