Brazil's ANPD revises LGPD sanctions rules

Brazil's ANPD has opened a public consultation to revise the Regulamento do Processo de Fiscalização and the Processo Administrativo Sancionador under the LGPD. A virtual hearing is scheduled for September 24, 2026, and comments will be accepted through October 26. The draft introduces new criteria for supervising digital platforms, broadens investigative powers, and allows immediate precautionary measures in risk situations.

What changes in enforcement?

The proposal reorganizes and expands the tools ANPD can use to demand information, investigate, and adopt urgent measures. According to specialized coverage, it also adds specific rules for overseeing digital platforms and adjusts procedures to reflect new powers tied to protecting children and adolescents online.

According to ANPD, the review is meant to align the process with responsibilities linked to the ECA Digital and with application provider duties set out in Decree No. 12.975/26. Atlas Público reported that the draft was put out for public consultation so the public can weigh in on the rules the authority uses to enforce the LGPD and apply sanctions.

What does it foresee for precautionary measures and fines?

The draft would let ANPD impose precautionary measures without a prior response from the regulated party when there is a risk of harm. It also provides for a daily fine for noncompliance with those measures, capped at a cumulative R$ 50 million, according to TeleSíntese and other specialized coverage.

That cap adds to the sanctions regime already in place under the LGPD, which in 2026 produced one of its harshest cases with ByteDance, TikTok's parent company. The authority fined it R$ 153.7 million for irregularities in the processing of children's and adolescents' personal data, a penalty described by multiple outlets as the largest monetary sanction in ANPD's history.

What happened in the TikTok case?

The penalty against ByteDance came from an administrative sanctioning proceeding ANPD opened in November 2024 after inspecting two ways of accessing the platform, the no-registration feed and the registered-user feed. The case identified five LGPD violations, including processing minors' data without a valid legal basis and failing to prove compliance.

Data Privacy Brasil said that in 2024 ANPD ordered the suspension of the sem cadastro feed, required a compliance plan, and opened the sanctioning proceeding against ByteDance. In 2026, the Board approved that compliance plan on appeal in a supplementary resolution published the same day as the sanction, while independent coverage also reported the deletion of improperly collected data.

Legal analysis described the fine as one of the toughest penalties in Brazil's contemporary digital regulatory law and as a sign that the authority is consolidating criteria that take into account the offender's financial size, the volume of affected data subjects, and the vulnerability of the data when applying the LGPD's Article 52 cap. Araujo Policastro said the total reached R$ 153,769,671.33.

What deadlines are in effect now?

ANPD's public consultation was published on September 9, 2026, in the DOU, with a virtual public hearing on September 24 and comments accepted through October 26. At the same time, technical coverage of the TikTok case said the authority ordered the deletion of data from adolescents ages 13 to 18 whose legal representation is not regularized within 60 business days and set a daily fine of R$ 137,081 for noncompliance.

Neoteo added that ByteDance's sanction came with a 10-business-day appeal period starting from the August 24, 2026 notification. Processei, for its part, placed the case among the toughest sanctions under the LGPD and linked it to the consolidation of administrative criteria on the size of the offender, the number of affected people, and the sensitivity of the data.