Brazil's ANPD Just Put 21 Companies on Notice: Is Your LGPD Compliance Up to Snuff?

ANPD's Monitoring: What Happened?

Brazil's National Data Protection Authority (ANPD) has wrapped up a targeted monitoring of data controllers and is now evaluating sanctions against 21 companies and public entities. This isn't a drill—it's a clear signal that the LGPD is being enforced with teeth.

Featured Snippet Bait: The ANPD's monitoring focused on compliance with Data Protection Officer (DPO) requirements under the LGPD. Organizations that failed to appoint a DPO or make their contact information publicly available are now facing potential fines.

Why This Matters for Your Organization

If you're subject to the LGPD, this is your wake-up call. The ANPD is moving from guidance to enforcement, and the list of 21 includes both private companies and public bodies. The message is simple: compliance isn't optional.

Think of it like a traffic stop. You might speed for months without getting caught, but once the radar is up, you're toast. The ANPD just turned on the radar.

What Are the Key LGPD Obligations?

The monitoring specifically targeted DPO requirements under Article 41 of the LGPD. Every controller must appoint a DPO and publicly disclose their contact information. It's not just about having someone on paper—they need to be accessible and active.

For a full breakdown of LGPD obligations, check the official ANPD website.

What Sanctions Are on the Table?

The ANPD can impose a range of penalties, from warnings to fines of up to 2% of a company's revenue in Brazil (capped at R$50 million per violation). For public entities, sanctions may include public reprimands or orders to cease processing.

But here's the kicker: the ANPD is also considering 'aggravating factors' like repeat offenses or obstruction of investigations. So if you've been ignoring compliance, now's the time to act.

How to Avoid Being Next

First, appoint a DPO if you haven't already. Second, ensure their contact info is publicly available on your website. Third, document your data processing activities. It's boring, but so is cleaning grout with a toothbrush—and you still do it because mold is gross.

Finally, stay updated. The ANPD is likely to expand monitoring to other areas like data breach notifications and consent management.

FAQ