Brazil’s ANPD tightens sanctions

Brazil’s ANPD stepped up its LGPD enforcement framework in September, reviewing sanction and oversight rules, issuing new precautionary measures for digital platforms, and building on recent cases involving TikTok and Discord. The move raises the compliance bar for companies that process data from Brazilian residents, including regional operations with users in Peru.

What is the ANPD reviewing?

The authority said on September 4, 2026, that it is reviewing the Regulation on Dosimetry and Application of Administrative Sanctions, set out in Resolução CD/ANPD nº 4/2023, and the Regulation on the Inspection Process, under Resolução CD/ANPD nº 1/2021. DPOExpert added that on September 9 it opened a public consultation to review the inspection process and the administrative sanctioning process.

That regulatory package affects how sanctions are calculated and how oversight works under the LGPD. DPL News also reported that the Superintendence of Inspection could adopt precautionary measures before or during proceedings, even without the regulated party first making a statement, when there is a risk of harm or of interfering with the investigation.

What kind of sanctions is it applying?

The ANPD has been using warnings, database blocking, and fines that can reach R$ 50 million per violation, the cap set by the LGPD, according to De Paula e Nadruz and the INTA Data Committee. AdvTechPro.ai added that the ANPD’s conversion into a special-purpose autonomous agency in 2024 expanded its enforcement capacity and allowed for more substantial sanctions starting in 2026.

That same analysis, citing official data without linking to the primary report, said 2026 saw roughly a 280% increase in administrative sanction proceedings and collections close to R$ 85 million in the first half of the year. Because that figure is not backed there by a linked primary document, it should be treated as the outlet’s own reference, not as a closed number.

What do the TikTok and Discord cases show?

The most visible sanction was the one imposed on ByteDance over TikTok, with five monetary penalties totaling R$ 153,769,671.33 and an order to delete data processed unlawfully, according to the ANPD’s August 25, 2026 official statement cited by GRCX3. DataPrivacyBR and Migalhas said the case also required a specific compliance plan to strengthen protection for children and adolescents, along with technical and organizational improvements.

According to Migalhas, the case was based on Article 7 of the LGPD for processing without a valid legal basis, Article 6, item VIII, for a lack of preventive measures, and Article 6, item X, for failure to prove compliance. A later Migalhas analysis added that the administrative case was opened in November 2024, and that the company must delete data from adolescents without regular legal representation, notify third parties that received that data, and technically demonstrate compliance.

In Discord’s case, the ANPD ordered on August 12, 2026, that live streaming and other video features be suspended until effective measures were taken to protect children and adolescents. Es Hoje said the platform complied with the order on August 17, while challenging the authority’s competence, and G1 added that the measure responded to repeated use of the tool in cases involving violence, harassment, and encouragement of self-harm and suicide.

What changes for companies with users in Brazil?

The requirements now go beyond reacting to incidents. Companies must document, report, and prove controls. DPOExpert said Resolução nº 15/2024 requires keeping records of security incidents involving personal data for at least five years, including the date the incident was learned of, the circumstances, the categories of affected data, the risk assessment, the measures taken, and the justification for any decision not to notify.

That same framework generally sets a three-business-day deadline to notify the ANPD and data subjects of incidents that could create relevant risk or harm. TechPolicy.Press added that after the TikTok sanction, the ANPD also ordered platforms with more than 1 million users under 18 to publish their first semiannual transparency report by mid-September 2026.

Where does artificial intelligence fit in?

The ANPD chose artificial intelligence as a priority enforcement area for 2026 and 2027, according to LCF Consulting, which said that since August 21, 2026, it has been monitoring 22 market actors, including social networks, app stores, and generative AI tools. StartSe added that under Edital nº 2/2025, the authority selected Metatext, Synapse AI, and Prevvine Tecnologia for a regulatory sandbox that began in March 2026 alongside the CIAAM group at the University of São Paulo.

AdvTechPro.ai also said, citing official data without a link to the primary report, that the largest sanctioning volume in 2026 was tied to personal data processing in artificial intelligence systems. The same report said the ANPD is in a more rigorous regulatory phase, while Vlibras noted that its guidance and resolutions form the basis for complying with international data transfer rules under the LGPD.