The first sanctions applied by the National Agency for the Protection of Personal Data (ANPD) were a wake-up call for companies: the LGPD is a serious law and must be complied with.
The General Personal Data Protection Law - Law no. 13.709/18 (LGPD) was published in 2018 and came into force in 2020. This deadline was given to public and private legal entities (processing agents) that collect, store or process personal data of individuals, in Brazil or abroad, to comply with the new regulations.
Initially, sanctions and administrative fines were imposed by consumer protection agencies (PROCON), the Public Prosecutor's Office, as well as labor and civil lawsuits, until the National Data Protection Authority (ANPD) began its inspection activities in 2021.
At first, the ANPD worked to raise awareness and educate data processors about the importance of applying good practices in the processing of personal data, in the pursuit of the fundamental right to informational self-determination (EC No. 115/22).
The personal data protection system was put into effect when the first administrative sanctions were applied by the regulatory agency.
The first company fined is a provider of telephony services, such as telemarketing and self-service via the messaging service WhatsApp. Because it is a micro-enterprise, the amount for each infraction was limited to 2% of its gross revenue, totaling R$7,200.00 per infraction.
The company was fined for failing to appoint the person responsible for processing personal data, as required by art. 41 of the LGPD, and for processing personal data without a legal basis: the company processed voters' personal data for the purposes of an election campaign, without the express consent of the data subjects, as required by art. 7, II, of the LGPD.
The Santa Catarina State Health Department (SES-SC) was the second public company to receive sanctions from the ANPD. Four warning sanctions were imposed for leaking personal data.
SES-SC infringed art. 49 of the General Personal Data Protection Act (LGPD) by neglecting the security of systems for storing and processing personal data, and by the lack of clarity, inadequacy and timeliness of the notice to data subjects, which was considered an infringement of art. 48 of the LGPD. In addition, the agency failed to submit the Personal Data Protection Impact Report (RIPD) requested by the Authority.
It should be noted that the sanctions imposed on companies are attributed to the lack of proper documents and procedures.
Thus, contractual compliance and the creation of standardized documents, without the implementation of effective practices, are not enough to guarantee compliance with the law and avoid sanctions.
The application of sanctions by the ANPD is an important instrument for the protection of personal data in Brazil. Companies must be vigilant in complying with the legislation to avoid the risk of administrative sanctions.
In a recent decision, the Third Panel of the Superior Court of Justice (STJ) upheld the extrajudicial exclusion of a partner based on a private instrument signed by all members of the company, even without registration with the Board of Trade.[1]
In the case under review, after the company's formation and registration, the partners signed a document called a "statute," [...]
The Supreme Federal Court (STF) has decided to suspend, nationwide, all legal proceedings that question the legality of service provision contracts, commonly known as “pejotização”. The decision, issued by Justice Gilmar Mendes, aims to standardize the interpretation on the matter and ensure legal certainty. The STF recognized the general repercussion of the issue when it […]
Uma importante decisão proferida recentemente pelo Supremo Tribunal Federal (STF), a partir de atuação da equipe trabalhista Cesar Peres Dulac Müller Advogados, trouxe novamente à tona a relevância da observância aos precedentes vinculantes da Corte em matéria trabalhista, especialmente quanto à licitude de formas alternativas de contratação, como a prestação de serviços por pessoa jurídica — prática […]
The annual holding of the Ordinary General Meeting (OGM) for the accountability of the administrators is a legal requirement provided for in Law No. 6,404/1976 (Brazilian Corporations Law), specifically in Articles 132 and following. This provision establishes that the OGM must take place within the first four (4) months following the end of the fiscal year, usually by […]
The Full Bench of the Superior Labor Court, in a session held this Monday (24), established legal theses on new topics, as part of a procedure to reaffirm its jurisprudence. These are matters that, as they are already settled, were submitted to the repetitive appeals procedure to define a binding legal thesis. The establishment of qualified precedents has a direct impact […]
On March 18, 2025, at the Hotel Laghetto Stilo Higienópolis, Thomas Dulac Müller, a lawyer and expert in corporate restructuring, participated in the panel "Third-Party Liability in Bankruptcy", sharing his expertise alongside top industry specialists. The discussion provided strategic insights into the legal implications of bankruptcy for third parties involved in insolvency proceedings. […]
This website uses cookies to improve your experience as you browse the website. Cookies that are categorized as necessary are stored in your browser as they are essential for the basic functionality of the website to function. We also use third-party cookies, which help us analyze and understand how you use this website. Cookies will be stored on your browser only with your consent. You also have the option to opt out of cookies. However, disabling some cookies may affect your browsing experience.
Functional cookies help in performing certain functionality such as sharing website content on social media platforms, collecting feedback and other third-party features.
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information about the metrics of the number of visitors, bounce rate, traffic source, etc.
Advertising cookies are used to provide visitors with relevant advertisements and marketing campaigns. These cookies track visitors to websites and collect information to deliver personalized advertisements.
Necessary cookies are those that are absolutely essential for the proper functioning of the website. These cookies guarantee basic functionality and security features of the website, anonymously.