Brazil's National Data Protection Authority (ANPD) became a full regulatory agency in February 2026. The educational grace period is over. If you're processing Brazilian data, your compliance approach must align with the new enforcement reality.
The Claro case highlights this shift. The ANPD initiated enforcement against one of Brazil's largest telecom carriers for transferring over one hundred pieces of customer information to Serasa under a data-sharing partnership. The potential fine: R$50 million per infraction or 2 percent of revenue, whichever is greater. The Authority now has six superintendencies, 200 regulatory specialists, and a public Enforcement Dashboard broadcasting proceedings in real time.
Here's what teams are getting wrong, why it keeps happening, and how to fix it before you're on that dashboard.
Why These Mistakes Keep Happening
Most companies treat the LGPD as a GDPR compliance checkbox. You map the overlaps, copy your European playbook, and assume you're covered. That worked when the ANPD was issuing guidance documents. It doesn't work now that the Authority has dedicated enforcement capacity and is running sector-wide sweeps against dozens of companies simultaneously.
Another issue: teams wait for a formal notice before building documentation. By then, you're defending a case instead of preventing one. The ANPD's penalty calculation under Board Resolution 4/2023 explicitly weighs whether you had an operational privacy governance program before the infraction occurred. A policy you wrote after receiving a complaint doesn't count.
Mistake 1: Assuming GDPR Compliance Covers You
Your European data protection impact assessment template doesn't satisfy LGPD requirements. The legal bases, incident notification timelines, and Data Protection Officer (DPO) designation rules differ.
Why it happens: Legal teams see 80 percent overlap between GDPR and LGPD and assume the remaining 20 percent is trivial. It's not. The ANPD explicitly rejected Tools for Humanity's iris-scanning program even though similar biometric processing operates in Europe. The Authority applies Brazilian principles of necessity and purpose limitation, not European interpretations.
The consequence: You document consent when you should be documenting legitimate interest. You notify an incident to your EU supervisory authority and miss Brazil's window. Your European DPO covers Brazil as a secondary responsibility, and the ANPD treats that as not having a DPO at all.
The fix: Run a gap analysis specifically against LGPD Articles 7-11 (legal bases), Article 48 (incident notification), and Article 41 (DPO requirements). Map your actual processing activities to the LGPD's definitions of necessity, adequacy, and transparency. If you're processing health or biometric data in Brazil, those categories are under the highest scrutiny tier under the current Priority Topics Map covering 2026 and 2027.
Mistake 2: Treating the DPO Role as a Formality
The ANPD's first monetary fine, against Telekall Infoservice in 2023, established that the absence of a Data Protection Officer is a standalone infraction. You get sanctioned for not having one, regardless of whether any other violation occurred. In December 2024, the Authority opened simultaneous investigations against 20 large companies for failing to properly disclose their DPO.
Why it happens: Teams assign the DPO role to someone in legal or compliance who already has a full-time job. The designation goes on the website. The person has no budget, no direct reports, and no time to maintain records of processing activities or run internal audits.
The consequence: When the ANPD requests documentation, your DPO can't produce it because they don't have it. The Authority doesn't see that as an under-resourced compliance function. They see it as obstruction, which carries its own penalty under Board Resolution 1/2021.
The fix: If you're designating a DPO for Brazilian operations, give them actual operational capacity. That means time, budget, and access to senior decision-makers. Your DPO needs to maintain a current inventory of processing activities, not a static document from 2022. They need to respond to an ANPD information request within ten business days with evidence of what you're processing, why, and under which legal basis. If your DPO can't do that today, you don't have a functional DPO.
Mistake 3: Ignoring Extraterritorial Reach Until You Have a Brazilian Entity
The LGPD applies to any company offering goods or services to individuals in Brazil or processing data collected in the country. You don't need a subsidiary. You don't need a physical presence. If you're a U.S. SaaS company with Brazilian users and you're processing their data from Virginia, you're under ANPD jurisdiction.
Why it happens: Teams assume data protection laws are territorial. They wait until they're setting up a Brazilian office to think about LGPD compliance. By then, they've been processing Brazilian data for years without proper legal bases, without incident response procedures, and without a DPO.
The consequence: The ANPD opens a proceeding based on a complaint from a Brazilian data subject. Your defense is that you didn't know the law applied to you. That's not a defense. It's evidence that you had no governance program at all.
The fix: If you have any Brazilian customers, run the jurisdictional test now. Are you offering goods or services to people in Brazil? Are you processing data collected in Brazil? If yes to either, you're in scope. That means you need a legal basis for every processing activity, a designated DPO, an incident response plan that includes ANPD notification, and records proving you can honor data subject rights requests. Don't wait for revenue thresholds or headcount targets. The law doesn't have a small-company exemption.
Mistake 4: Building Compliance Documentation After You Receive a Notice
The ANPD's penalty calculation under Board Resolution 4/2023 treats the existence of a documented, operational privacy governance program as a mitigating factor. But the program has to exist before the infraction, not after you get caught.
Why it happens: Compliance teams are under-resourced. They prioritize customer-facing work over internal documentation that no one asks for. Until the regulator asks for it.
The consequence: You receive an ANPD information request. You have ten business days to respond. You don't have a data map. You don't have records of processing activities. You don't have evidence of how you determined your legal bases. You scramble to create those documents retroactively, and the Authority sees through it. Your penalty calculation doesn't get the mitigation discount.
The fix: Treat your records of processing activities as a living operational document, not a compliance artifact. Update it every time you onboard a new vendor, launch a new product feature, or change how you use customer data. Your legal basis analysis needs to be contemporaneous with the processing decision, not reconstructed months later. If you're sharing data with third parties, document the necessity, the purpose limitation, and the transparency mechanisms before you start the data flow.
Mistake 5: Assuming Small Violations Won't Trigger Enforcement
The ANPD's first fine was only R$14,400 (about $2,700) against a small company selling WhatsApp contact lists. The amount was modest. The precedent was not. It established that size doesn't grant immunity and that the Authority will pursue small-scale violations to set enforcement patterns.
Why it happens: Teams look at the R$50 million potential fine in the Claro case and think enforcement is reserved for large-scale incidents. They treat minor violations as low-priority.
The consequence: The ANPD opens a proceeding over something you considered trivial. Even if the monetary penalty is small, the reputational damage isn't. Your company appears on the public Enforcement Dashboard. Your customers see it. Your competitors reference it in sales calls.
The fix: Don't tier your compliance program by perceived enforcement risk. The Authority uses complaints and petitions from individual data subjects as one of three enforcement vectors. A single complaint about your privacy policy not disclosing your DPO can trigger a proceeding. Make sure your public-facing disclosures are current, your data subject rights request process actually works, and your incident response plan includes the ANPD as a notification recipient. These aren't optional. They're the baseline the Authority expects from every company in scope.
Mistake 6: Treating Data-Sharing Arrangements as Purely Contractual
The Claro and Serasa case is the first time the ANPD has openly challenged the logic of data-sharing between large private entities. The Authority questioned the volume, purpose, and transparency of disclosures. Your contract with a data partner doesn't make the sharing lawful if it violates necessity or purpose limitation.
Why it happens: Legal teams draft data-processing agreements that allocate liability between parties but don't assess whether the sharing itself complies with LGPD principles. The contract says the partner is responsible for security. It doesn't address whether you have a legal basis to share the data in the first place.
The consequence: You're sharing customer data with a credit bureau, a marketing platform, or an analytics provider under a contract that looks clean. The ANPD opens a proceeding questioning whether the sharing was necessary, whether the purpose was clearly disclosed to data subjects, and whether you're transferring more data than the stated purpose requires. Your contract doesn't answer those questions.
The fix: Before you share data with any third party, document your necessity analysis. Why does this partner need this specific data? Can you accomplish the same purpose with less data or with aggregated data? Did you disclose this sharing clearly in your privacy notice, or is it buried in a clause about "trusted partners"? If you're sharing more than a handful of data fields, prepare to justify each one. The ANPD is now scrutinizing volume as a proxy for necessity. If you can't explain why you're sharing one hundred pieces of information per customer, don't share one hundred pieces.
Prevention Checklist
Use this to audit your current state:
- You've run a gap analysis between your GDPR compliance and LGPD requirements, specifically covering legal bases, incident notification, and DPO designation.
- Your designated DPO has operational capacity (time, budget, access) to maintain records and respond to ANPD requests within ten business days.
- You've confirmed jurisdictional scope: if you have Brazilian users or process data collected in Brazil, you've implemented LGPD controls regardless of physical presence.
- Your records of processing activities are current, updated with every new vendor or product feature, and include documented legal basis analysis.
- Your privacy notice discloses your DPO contact information and clearly describes all data-sharing arrangements.
- Your incident response plan includes ANPD notification procedures and assigns responsibility for the ten-day response window.
- For every third-party data-sharing arrangement, you've documented necessity, purpose limitation, and transparency mechanisms before data flows.
- You've reviewed the current Priority Topics Map (2026-2027) and flagged any processing involving biometric data, health data, financial data, or children's data for heightened scrutiny.
The ANPD is no longer learning how to regulate. It's regulating. Your compliance program needs to reflect that shift before you appear on the Enforcement Dashboard explaining why it didn't.
