Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Brazil: ANPD issues first guidance addressing LGPD

The Brazilian data protection authority ('ANPD') issued, on 8 December 2020, frequently asked questions which address various topics under Law No. 13.709 of 14 August 2018, General Personal Data Protection Law (as amended by Law No. 13.853 of 8 July 2019) ('LGPD'). In particular, the FAQs provide guidance on, among other things, the applicability of the LGPD, the legal bases that data controllers may use to process personal data, the rights of data subjects, and certain actions that public and private organisations need to take in order to comply with the LGPD. Furthermore, the FAQs outline the structure of the ANPD and the powers that it has under the LGPD, which include:

  • developing guidelines;
  • carrying out investigations and applying sanctions in case of data processing that is not compliant with the legislation;
  • promoting knowledge of data protection to the public; and 
  • encouraging the adoption of standards for services and products that facilitate the exercise of control of the holders over their personal data. 

In addition, the FAQs remind that the ANPD will only be able to enforce the LGPD after 1 August 2021 by imposing administrative sanctions which include a warning, indicating a deadline for adopting corrective measures, a simple fine of up to 2% of a company's revenues in the last fiscal year, limited in total to BRR 50 million (approx. €8,045,000) or a daily fine, as well as the order of blocking or deletion of the personal data in question. 

You can read the FAQs, only available in Portuguese, here