Brazil Data Protection Agency (ANPD) Issues Its First Sanction Against A Non-Compliant Company

On July 6, 2023, the first sanction imposed by the Brazilian Data Protection Agency ("ANPD") against a company (controller) in Brazil was published in the official gazette. The ANPD is the agency charged with enforcing Brazil's General Data Protection Law ("LGPD").

The publication does not provide the details about the results of the investigation conducted by the ANPD against a company, but the sanctions provide a glimpse of the underlying circumstances.

The sanctions included:

1. A Warning, without the imposition of corrective measures, for violation of article 41 of the LGPD (appointment of a Data privacy Officer (DPO);
2. A "Simple Fine" of R$ 7,200 (~$1,480 USD) for violation of article 7 of the LGPD (legal basis for processing personal data);