Brazil's Data Protection Agency has issued its sanction regulation as of Feb. 27, 2023, bridging the gap between theoretical LGPD obligations and real enforcement. This regulation outlines nine sanctions, including fines up to 2% of Brazilian revenue (capped at R$50 million per infraction), operational suspensions, and public disclosure requirements.
Many teams treating LGPD compliance as a simple extension of GDPR will soon discover the gaps. Here's what often goes wrong, why it happens, and how to fix it before the ANPD comes knocking.
Why These Mistakes Keep Happening
The ANPD's sanction framework aims to encourage compliance before penalties are enforced. The regulation includes mitigating circumstances that can reduce fines if you've implemented procedures to minimize harm to data subjects. However, most organizations don't realize they're non-compliant until an audit or incident forces a review.
The issue isn't ignorance of the law, but the assumption that GDPR compliance automatically covers LGPD requirements. While both laws share structural similarities, Brazil's enforcement approach and specific requirements differ in ways that matter operationally. Teams often skip the data mapping exercise that would reveal these gaps, or they map once and never update when processing changes.
Mistake 1: Assuming You Have a Legal Basis When You Don't
Why it happens: Teams often transfer their GDPR legal basis analysis without checking if the same justification works under LGPD. Article 7 of the LGPD lists ten legal hypotheses for processing, but their scope and application differ from GDPR's six legal bases. What qualifies as "legitimate interest" under GDPR may not meet LGPD's Article 7, X standard.
Real consequence: Processing without a valid legal hypothesis triggers a "serious" infraction classification under the regulation. Serious infractions carry the highest penalty tier and require at least one aggravating factor, which "processing without one of the LGPD's listed legal hypotheses" automatically satisfies.
The fix: Audit every processing activity in your data map and document which LGPD Article 7 hypothesis applies. Don't assume consent covers everything. If you're processing employee data, verify that your employment relationship justification aligns with Article 7, I. For marketing, check whether you need explicit consent under Article 7, I or can rely on legitimate interest under Article 7, IX, and document the balancing test.
Mistake 2: Treating Sensitive Data Like Regular Personal Data
Why it happens: LGPD defines sensitive data more broadly than many teams expect. Article 5, II includes racial or ethnic origin, religious belief, political opinion, trade union or religious organization membership, health or sex life data, genetic or biometric data. Teams processing this data often use the same consent mechanisms and retention schedules they use for basic contact information.
Real consequence: The regulation explicitly lists sensitive data processing as an aggravating factor that elevates infractions to "serious" classification. If you're processing sensitive data without meeting the heightened requirements in Article 11, you're facing maximum-tier penalties plus the reputational damage of public disclosure.
The fix: Segregate sensitive data processing in your data map. For each sensitive data category, document your Article 11 legal hypothesis (consent, legal obligation, health protection, etc.). Implement separate retention policies. If you're collecting health data for benefits administration, don't retain it longer than the specific purpose requires. Review your consent notices to ensure they separately call out sensitive data categories and explain the specific purpose.
Mistake 3: Ignoring the "Good Faith Compliance" Mitigators
Why it happens: Article 7 of the regulation lists factors the ANPD considers when determining sanctions, including "the offender's good-faith compliance efforts." But teams don't understand what counts as good faith in the ANPD's view. Simply having a privacy policy doesn't demonstrate good faith. The regulation rewards "internal procedures and mechanisms for minimizing damage to data subjects."
Real consequence: You're leaving money on the table. The regulation's Article 13 outlines mitigating circumstances that reduce fines. Without documented compliance procedures, you can't claim these mitigators when the ANPD investigates an infraction.
The fix: Document your data protection program in writing. This means:
- Written procedures for handling data subject rights requests
- Incident response plans that include notification timelines and mitigation steps
- Regular training records showing you've educated staff on LGPD requirements
- Vendor management processes that verify third-party processors meet security standards
- Quarterly or annual reviews of your data map to catch processing changes
When the ANPD reviews your case, these artifacts demonstrate you've implemented mechanisms to minimize harm, even if an infraction occurred.
Mistake 4: Failing to Update Processing After Business Changes
Why it happens: You mapped your data processing when you launched in Brazil, but you didn't build a trigger system to update that map when the business changes. Marketing launches a new campaign using behavioral analytics. Product adds a recommendation engine. HR switches to a new benefits platform. None of these changes flow back to the compliance team until something breaks.
Real consequence: The regulation defines "systematically adopted irregular practices of processing" as an aggravating factor that makes infractions serious. If the ANPD finds multiple processing activities without valid legal bases because you didn't update your analysis when systems changed, you're demonstrating systematic non-compliance, not an isolated mistake.
The fix: Build a change management process that routes new data processing through compliance review before launch. This doesn't mean blocking every initiative. It means:
- Requiring a data protection impact assessment (DPIA) for any processing involving sensitive data, large-scale monitoring, or automated decision-making
- Updating your Article 30-equivalent processing register (LGPD doesn't mandate this, but it's the artifact that proves you know what you're processing)
- Reviewing vendor contracts when you add new processors
- Scheduling quarterly reviews with product, marketing, and HR to surface processing changes that didn't trigger formal review
Mistake 5: Underestimating the Scope of "Large Scale" Processing
Why it happens: The regulation lists "processing of personal data on a large scale, taking into consideration the volume, duration, frequency, and geographic extent" as a factor that elevates infractions to serious classification. Teams assume "large scale" means millions of records. But the ANPD considers duration and frequency, not just volume.
Real consequence: If you're processing even moderate volumes continuously over months or years, you may meet the large-scale threshold. Combined with any other serious-infraction factor (sensitive data, lack of legal basis, discriminatory effects), you're in the highest penalty tier.
The fix: Don't guess whether your processing qualifies as large scale. Document the four factors:
- Volume: How many data subjects?
- Duration: How long do you retain the data?
- Frequency: Is this continuous processing or occasional?
- Geographic extent: Are you processing data from multiple Brazilian states?
If you're processing more than a few thousand records, retaining data for years, running continuous analytics, or operating across multiple states, treat it as large scale. Implement the heightened controls that demonstrate good faith: regular audits, documented security measures, and clear retention limits.
Mistake 6: Ignoring the Escalation Path
Why it happens: Teams read that the ANPD "encourages compliance before applying penalties" and assume they'll get multiple warnings before real sanctions land. But the regulation's Article 3 specifies that the three most severe sanctions (partial database suspension, processing suspension, and partial/total processing ban) can only occur after you've already received one of sanctions 2 through 6 (fines, public disclosure, data blocking, or data deletion).
Real consequence: If you ignore a fine or fail to cure an infraction after public disclosure, the ANPD can suspend your database operations for up to six months (extendable). For a business operating in Brazil, a six-month processing suspension isn't a fine you can budget for; it's an existential threat.
The fix: Treat any ANPD communication as urgent. If you receive a warning (the mildest sanction), cure the infraction immediately and document the remediation. If you receive a fine, don't just pay it. Implement the corrective measures that prevent recurrence, because the next infraction triggers the escalation path toward operational suspension. Build an incident response plan that includes:
- Designated points of contact for ANPD communications
- Internal escalation procedures to get executive attention within 24 hours
- A cure timeline that assumes you have days, not weeks, to respond
- Documentation procedures that create an audit trail of your remediation efforts
Prevention Checklist
Before the ANPD investigates:
- Complete a data mapping exercise that identifies every processing activity in Brazil
- Document the Article 7 legal hypothesis for each processing activity
- Segregate sensitive data processing and verify you meet Article 11 requirements
- Implement written procedures for data subject rights, incident response, and vendor management
- Schedule quarterly reviews to update your processing map when business changes
- Assess whether any processing qualifies as large scale (volume, duration, frequency, geography)
- Build a change management process that routes new processing through compliance review
- Designate ANPD communication owners and document your escalation procedure
- Train staff on LGPD requirements and keep records of training completion
- Review retention schedules to ensure you're not holding data longer than the specific purpose requires
The ANPD designed the sanction framework to reward proactive compliance. The mitigating circumstances in Article 13 reduce fines when you've implemented internal mechanisms to protect data subjects. The question isn't whether you'll face an infraction; it's whether you'll have the documented compliance program that demonstrates good faith when the investigation starts.
