# ANPD Enforcement Reference

## Autoridade Nacional de Proteção de Dados (ANPD)

Brazil's national data protection authority, established by Law 13,853/2019 as part of the federal government, with technical and decisional autonomy.

**Website:** https://www.gov.br/anpd/pt-br  
**Contact:** anpd@anpd.gov.br

---

## ANPD Organisational Structure

- **Board of Directors (Conselho Diretor):** 5 directors appointed by the President of Brazil; 4-year staggered terms
- **National Council for Personal Data and Privacy Protection (CNPD):** Advisory body; civil society, government, and expert representatives
- **Internal Structure:** Departments for enforcement, regulation, international affairs, communications

---

## Enforcement Process

### Phase 1 — Preliminary Investigation (Processo Administrativo Preliminar)
1. ANPD receives complaint, monitoring signal, or self-initiated referral
2. Preliminary investigation to determine whether to open formal proceedings
3. Duration: typically 60 days (extendable)
4. Controller/processor may be contacted for information

### Phase 2 — Administrative Investigation (Processo Administrativo Sancionador)
1. Formal notice to accused party
2. Right of defence: 15 business days to present response
3. Evidence gathering, hearings if necessary
4. Reporting officer prepares draft decision
5. Board votes on decision
6. Final administrative decision issued

### Phase 3 — Appeal
1. Decision may be appealed internally to ANPD Board within 10 business days
2. After ANPD appeal: judicial review available in Federal District courts

### Timelines
- **Prescription:** 5 years from when ANPD becomes aware (Art. 54)
- **Complaint response:** ANPD aims to respond to complaints within 30 days (varies in practice)

---

## Penalty Calculation Methodology

### Simple Fine (Art. 52, II)
**Cap:** Lesser of 2% of Brazilian revenue (prior FY) or R$50,000,000 per violation.

**For groups of companies:** 2% of group's Brazilian revenue.

**Factors considered (Art. 52, §1º):**

| Factor | Impact |
|--------|--------|
| Gravity and nature of violation | Higher gravity → higher fine |
| Data subjects' good faith | Mitigating |
| Advantage gained from violation | Higher advantage → higher fine |
| Conditions of controller (size, economic position) | Proportionality |
| Recidivism | Aggravating |
| Degree of damage | Higher damage → higher fine |
| Cooperation with investigation | Mitigating |
| Good faith and internal controls | Mitigating |
| Promptness of corrective measures | Mitigating |
| Proportionality and necessity | Baseline consideration |

### Daily Fine (Art. 52, III)
Daily accrual to compel compliance; same R$50M cap per violation.

### Multiple Violations
Each violation may be treated separately. Multiple fines may be stacked.

---

## Enforcement Priorities (ANPD Strategic Agenda)

ANPD has indicated priority focus areas:
1. **Large-scale data breaches** — incidents affecting many Brazilians
2. **Sensitive data processing without legal basis** — health, biometric, financial
3. **Children's data** — processing without verifiable parental consent
4. **International transfers** — to countries without adequate protection
5. **Failure to respond to data subject rights** — especially access and deletion
6. **Lack of DPO appointment** for controllers required to appoint

---

## Notable ANPD Enforcement Actions

### Telemarketing / Call Centre Sector (2023)
ANPD investigated multiple companies for unlawful processing of personal data for telemarketing without adequate legal basis. Issued warnings and remediation orders.

### Health Sector Data Sharing (2022–2023)
ANPD investigated sharing of health data (sensitive data) with third parties without express consent. Issued compliance orders.

### Large-Scale Data Breach Investigations
ANPD has opened investigations following major data leaks affecting millions of Brazilian CPF (taxpayer ID) numbers. Status of fines pending as of 2025.

### Clarification Orders
ANPD has issued numerous "Comunicados" and "Notas de Esclarecimento" setting expectations for sectors on specific topics (facial recognition, cookies, employee monitoring).

---

## Cooperation with Other Authorities

### Brazilian Authorities
- **SENACON (Secretaria Nacional do Consumidor):** Consumer protection — joint enforcement on matters affecting consumers
- **CADE (Conselho Administrativo de Defesa Econômica):** Competition — data and market power interactions
- **Banco Central:** Financial data oversight
- **ANS/ANVISA:** Health sector data

### International Cooperation
ANPD has signed MoUs with:
- Portuguese DPA (CNPD — Portugal)
- Uruguayan authority (URCDP)
- CNIL (France)
- UK ICO
- Ibero-American Data Protection Network (RIPD)

ANPD participates in Global Privacy Assembly (GPA).

---

## Complaint Filing Process

Data subjects may file complaints with ANPD at: https://www.gov.br/anpd/pt-br/assuntos/peticoes

**Required information:**
- Identity of data subject (CPF required for Brazilian residents)
- Identity of controller (CNPJ/name)
- Description of alleged violation
- Evidence where available
- Rights already exercised with the controller

**ANPD first refers complaint to controller** (gives opportunity to resolve); escalates to investigation if unresolved.

---

## LGPD vs. Other Brazilian Law Obligations

| Law | Interaction with LGPD |
|-----|----------------------|
| Consumer Defence Code (CDC) | LGPD supplements CDC for data; CDC remedies still apply |
| Marco Civil da Internet (MCI) | MCI governs internet intermediaries; LGPD applies to personal data |
| LGPD for financial sector | Central Bank regulations + LGPD | 
| Health Sector | ANVISA/ANS rules + LGPD (stricter for health/sensitive data) |
| Credit reporting (Cadastro Positivo) | Art. 7, X — specific legal basis for credit protection |