Brazil's ANPD consults on how it sizes LGPD fines until 30 November

Brazil's ANPD consults on how it sizes LGPD fines until 30 November

13 November 2026: Brazil's National Data Protection Authority, the ANPD, is taking comments until 30 November on an update to the rule that decides how large a penalty is for each infringement of the LGPD, the country's data protection law. Companies that process personal data in Brazil, and the software vendors that sell them compliance tools, have 17 days left to say how the new criteria should work.

Not yet independently verified. We have read the authority's announcements but not the draft text itself, so the penalty bands and criteria in the proposal are not summarised here. We will update this when it can be confirmed, and remove this note.

What the dosimetry rule does

The Regulamento de Dosimetria e Aplicação de Sanções Administrativas, adopted in 2023, is the ANPD's method for turning a finding of breach into a sanction: how an infringement is classified, which aggravating and mitigating factors count, and how the fine is calculated. It is the rule that decides whether a lapse costs a warning or a large daily fine.

The authority opened the consultation on 15 October. It says the draft has been updated to cover powers it gained since 2023, including enforcement of the ECA Digital, Brazil's statute on children's digital rights, and Decrees 12.975 and 12.976, which update the regulation of the Marco Civil da Internet.

What came up at the hearing

The ANPD held an online public hearing on 29 October. Its own write-up says two topics dominated: how infringements are classified by seriousness, and cumulativeness, meaning how sanctions add up when a company commits several infringements at once. Both matter to any business with more than one processing activity in Brazil, because they decide whether related failings are treated as one case or several.

How to take part, and what follows

Contributions go through the federal Brasil Participativo platform, on the page for the dosimetry regulation, until 30 November. After the consultation closes, the ANPD's Regulation Superintendency will analyse the comments and consolidate a final text. No date for adoption has been announced.

For multinational groups, the practical step is to check who in the business follows ANPD rulemaking. Companies now in scope of the ECA Digital, such as app stores, social platforms and online services used by children, face the newest sanctioning powers and have the most reason to comment.

Related reading and our catalogue

We covered the ANPD's ECA Digital guide for suppliers earlier this autumn. Our GDPR compliance software category lists 11 products; several also map LGPD duties, which is worth checking directly with each vendor because LGPD sanctions are calculated under this Brazilian method, not the European one.

Sources

• ANPD: ANPD abre consulta pública sobre dosimetria e sanções, 15 October 2026
• ANPD: Classificação e cumulatividade de infrações são destaques em audiência pública, 29 October 2026
• Brasil Participativo: Regulamento de Dosimetria consultation, 15 October 2026