LGPD Sanctions & Dosimetry (Lei 13.709/2018, Arts. 52-54)

Last verified against official sources: 2026-07-10

When to Use

• Evaluating the severity of a data protection violation
• Conducting compliance audits or risk assessments
• Estimating potential fines and sanctions exposure
• Preparing defense in ANPD enforcement proceedings
• Advising on remediation priorities based on sanction risk
• Reviewing incident response plans for regulatory impact
• Assessing whether a data breach requires escalation

How to Respond

Types of Administrative Sanctions (Art. 52)

Sanctions are applied progressively, individually or cumulatively, based on the specifics of each case:

Escalation Rule (Art. 52, S6)

Sanctions X, XI, and XII (suspension/prohibition) can ONLY be applied:

1. After at least one sanction from items II, III, IV, V, or VI has already been imposed for the same case
2. For controllers subject to other sanctioning bodies, those bodies must be consulted first

Public Entities (Art. 52, S3)

Public entities are subject to sanctions I, IV, V, VI, X, XI, and XII only. They cannot receive monetary fines (items II and III).

Dosimetry Criteria (Art. 52, S1)

ANPD evaluates the following parameters when determining sanctions:

Fine Calculation (Arts. 52-54)

Simple Fine (Art. 52, II)

Fine = min(Revenue_Brazil * 2%, R$ 50,000,000.00) per infraction

• Revenue base: Gross revenue of the legal entity, group, or conglomerate in Brazil in the last fiscal year, excluding taxes
• Fallback (Art. 52, S4): If branch-specific revenue is unavailable, incomplete, or unreliable, ANPD may use total company/group revenue
• Destination (Art. 52, S5): Fine proceeds go to the Fundo de Defesa de Direitos Difusos (Fund for the Defense of Diffuse Rights)

Daily Fine (Art. 54)

• Must be proportional to the severity of the violation and extent of damage
• Subject to the same R$ 50M total cap
• Notification must include: description of obligation, reasonable deadline for compliance, daily fine amount

Methodology (Art. 53)

ANPD publishes dosimetry methodologies via regulation (Resolucao CD/ANPD no 4/2023). These must:

• Be published in advance for transparency
• Present objective calculation forms and dosimetry criteria
• Contain detailed reasoning for all elements
• Establish conditions for choosing simple vs. daily fine

Dosimetry Methodology (Resolucao CD/ANPD no 4/2023)

Infraction Classification (Art. 8 of the Regulation)

Base Fine Value (Art. 11 of the Regulation)

The base value is calculated (methodology in Apendice I of the Regulation) from three elements:

1. Infraction classification (leve/média/grave)
2. Revenue of the infractor in the business segment where the infraction occurred, last fiscal year, excluding taxes — total company/group revenue is used when segment revenue is unavailable; with no documented revenue, ANPD applies absolute value ranges or presumed caps (Simples Nacional/startup limits)
3. Degree of damage

Aggravating Percentages (Art. 12 of the Regulation)

Cumulative — percentages are summed when more than one applies:

Mitigating Percentages (Art. 13 of the Regulation)

Cumulative; burden of proof on the infractor. Cessation/mitigation done merely to comply with an administrative or judicial order does not count:

Final Limits (Arts. 15 and 18 of the Regulation)

• Result cannot be below the minimum values of Apendice II — except when the advantage obtained is estimable, in which case the fine is at least double the economic advantage
• Result capped at 2% of revenue in Brazil / R$ 50 million per infraction
• Express waiver of the right to appeal + payment within the deadline grants an extra −25% on the final fine
• Late payment: Selic interest + 0.33%/day penalty capped at 20%

Aggravating and Mitigating Factors (Resolucao CD/ANPD no 4/2023)

Aggravating Factors

Mitigating Factors

ANPD Enforcement Statistics

Complaints Received

Key Enforcement Insight

All sanctioning proceedings conducted by ANPD to date were initiated due to non-cooperative behavior by the regulated entity. Cooperation is the single most important factor in avoiding escalation from investigation to sanctions.

Active Investigations (Notable Cases, as of 2025)

Sanction Precedents (Concluded Cases)

Pattern from Precedents

1. Most sanctioned entities are public — because they cannot receive fines, ANPD applied warnings, publicization, and corrective measures
2. Common violations: failure to communicate incidents, missing security measures, failure to respond to ANPD
3. Non-cooperation is decisive — every single case escalated to sanctions involved refusal to cooperate with ANPD

Risk Classification Table

Compliance Checklist to Reduce Sanction Risk

Governance (Mitigating Factors)

• DPO appointed by formal act and published — Written designation act + name and contact info publicly available (Art. 41 + Res. CD/ANPD 18/2024)
• Privacy governance program — Documented policies, procedures, internal controls (Art. 50)
• Processing records (ROPA) — Complete register of all processing activities (Art. 37)
• Data Protection Impact Assessment (DPIA) — For high-risk processing activities (Art. 38)
• Data processing agreements — Contracts with operators covering security and compliance (Art. 39)

Incident Response (Most Common Violation)

• Incident response plan — Documented procedure for detecting and responding to security incidents
• ANPD notification — Process to notify ANPD within 3 business days (Resolucao CD/ANPD no 15/2024)
• Data subject notification — Process to notify affected individuals when risk is significant
• Incident documentation — Record nature of data, affected subjects, measures taken, risks

Cooperation with ANPD (Most Critical Factor)

• Respond to all ANPD requests — Within stated deadlines, without exception
• Designate a contact point — Ensure ANPD can reach your organization at any time
• Preserve evidence — Maintain logs, records, and audit trails for ANPD inspection
• Adopt corrective measures promptly — When ANPD issues determinations, comply immediately

Security Measures (Art. 46)

• Technical safeguards — Encryption, access control, monitoring, vulnerability management
• Administrative safeguards — Security policies, training, access reviews
• Privacy by design — Security measures from the design phase (Art. 46, S2)
• Regular security assessments — Penetration testing, vulnerability scanning, code review

Small-Porte Agents (Resolucao CD/ANPD no 2/2022)

Small businesses, startups, and micro-enterprises may benefit from:

• Simplified processing records
• Simplified incident communication
• Flexible DPO requirements
• Extended deadlines for compliance

Note: ANPD may revoke these benefits based on the nature, volume, or risk of processing (Art. 16, Resolucao 2/2022).

Enforcement Process Overview

Conciliation and Alternatives

Direct Conciliation (Art. 52, S7)

Individual data leaks or unauthorized access may be resolved through direct conciliation between controller and data subject. If no agreement is reached, ANPD sanctions apply.

Term of Conduct Adjustment — TAC (Resolucao 1/2021, Arts. 43-44)

• The regulated entity may propose a TAC to ANPD at any time
• Subject to Conselho Diretor approval
• Suspends the sanctioning process during compliance
• Process is archived upon full TAC compliance
• Strong mitigating factor in sanction dosimetry

References

• Lei 13.709/2018 (LGPD) — Arts. 52-54
• Resolucao CD/ANPD no 4/2023 — Dosimetria e Aplicacao de Sancoes
• Resolucao CD/ANPD no 1/2021 — Regulamento de Fiscalizacao e Processo Sancionador
• Resolucao CD/ANPD no 2/2022 — Agentes de Pequeno Porte
• Resolucao CD/ANPD no 15/2024 — Comunicacao de Incidentes
• ANPD — Sancoes Administrativas
• ANPD — Atividades Fiscalizatorias
• Portal da Transparencia — Sancoes ANPD

See Also

• lgpd-compliance — Use for the full compliance framework. Understanding principles, legal bases, and security requirements helps prevent sanctions in the first place.
• digital-eca-compliance — ECA Digital has its own penalty regime (up to 10% of revenue, R$50M cap). Use when assessing risk for children's data violations.
• lgpd-document-generator — Having proper compliance documents (privacy policy, ROPA, consent forms) is a mitigating factor in ANPD dosimetry.
• marco-civil-compliance — Marco Civil violations (e.g., failing to retain logs, net neutrality breaches) are enforced separately but may compound with LGPD sanctions.