Brazil's ANPD sanctions Feira de Santana

Brazil's ANPD closed an administrative enforcement case against the Prefeitura de Feira de Santana, in Bahia, after the municipality exposed the names of 1,241 people linked to HIV, sickle cell anemia and fibromyalgia diagnoses in its official gazette in September 2025. The authority issued a warning, ordered publication of the violation and imposed corrective measures, after receiving a complaint 48 hours after the incident.

What did the ANPD determine in the case?

The authority identified six violations of Brazil's LGPD and said the municipality failed in its handling of sensitive personal data. According to the ANPD, the proceeding also examined the steps the prefeitura took to reduce the impact of the exposure.

Bahia.ba reported that the violations included the purpose principle, failure to notify the ANPD and the data subjects about the incident, and shortcomings in transparency, governance and security. An independent legal analysis by Cescon Barrieu added that the investigative report individualized six conduct findings, all classified as serious violations because they involved sensitive data and produced discriminatory effects.

What measures were imposed and what do they mean?

The ANPD ordered a warning, publication of the violation and corrective measures, but clarified that public bodies are not subject to the administrative fines provided by law. The decision and the public records from the inspection and enforcement process are available in the SEI-ANPD system.

G1 reported that one of the measures requires publishing a notice about the violation on the front page of the institutional website for six months. Feira de Santana's prefeitura, according to that report, said it was waiting for official notification of the decision.

What other recent decisions has the ANPD taken?

The agency published a guidance document on the Digital ECA that explains which companies and digital services must comply with the statute and what their responsibilities are in protecting children and adolescents. According to the ANPD, providers must adopt preventive measures, demonstrate the effectiveness of the actions implemented and, in the cases provided for by law, publish transparency reports.

It also released translated versions of the LGPD and Brazilian decrees No. 12,975 and 12,976. The authority said those decrees gave it regulatory, monitoring and oversight powers over obligations related to platforms, transparency, risk management and measures to guarantee user rights.

Mobile Time broadened the scope of the guide and listed social networks, apps, app stores, adult content platforms, video games, operating systems, messaging services and e-commerce, among other technologies covered by the legal criteria.