Brazil's ANPD sanctions Feira de Santana

Update October 31, 2026: Cescon Barrieu said Instruction Report No. 3/2026/CGS/SFI identified six conduct violations and classified them as serious breaches because they involved sensitive data and produced discriminatory effects. It also said the infringement notice must remain on the prefeitura's website for 180 days, and that the absence of an administrative fine is based on article 52, section 3, of the LGPD.

The ANPD concluded an administrative sanctioning process against the Prefeitura de Feira de Santana, in Bahia, for exposing sensitive personal data from 1,241 people in the Diário Oficial do Município. The disclosed information included data related to HIV, sickle cell anemia, and fibromyalgia. The authority issued a warning, ordered public disclosure of the violation, and imposed a set of corrective measures.

How did the case begin?

The case began with a complaint received 48 hours after the incident and later moved from an inspection process to an administrative sanctioning proceeding, according to the ANPD. In its decision, the authority recognized six violations of the LGPD and classified the case as a breach of personal data processing rules.

What did the ANPD order the prefeitura to do?

The ANPD imposed specific governance and compliance obligations. These include appointing a personal data officer, drafting and publishing privacy and information security policies, preparing an incident response plan, and submitting data protection impact reports.

The authority also required measures tied to creating a preliminary assessment step on the impact to data subjects before publishing personal data in the Diário Oficial, along with staff training, rules for information sharing across departments, and risk assessments before new publications. Bahia Notícias reported that the data was removed a few hours after it appeared, but the ANPD found a failure in the incident notification procedure.

What was the scope of the violation?

According to the ANPD, the exposure affected 1,241 people and involved sensitive data, a category that receives special protection under the LGPD. Specialized coverage reported that the conduct was classified as serious and that the original publication included names and transportation card numbers.

G1 also reported that the Prefeitura de Feira de Santana must publish a notice about the violation on its official website for six months. The outlet also noted that public bodies are not subject to the administrative fines provided for under the LGPD.

What did the ANPD say about notifying data subjects?

The ANPD said that a general notice on the website does not replace direct, individualized communication of the incident to the affected people. According to the legal analysis cited by Cescon Barrieu, the prefeitura tried to notify only 22 of the 1,241 affected data subjects by postal mail, or 1.77%.

What does this case show about the ANPD?

The ANPD said it continues monitoring, inspection, and sanctioning activities against companies and platforms for LGPD violations and other data subject protection frameworks, with an approach aimed at bringing regulated entities into compliance and holding them accountable for any harm caused. At the same time, the authority published translated versions of the updated LGPD and Decrees No. 12,975 and No. 12,976, which assign it regulatory, monitoring, and inspection powers related to platform obligations, transparency, risk management, and user rights protection.