On December 20, 2019, the Brazilian Congress amended the
Brazilian General Data Protection Law (Law No. 13,853/2019, the
"LGDP") to include new provisions related to the
so-called administrative sanctions.
In case of violations, the LGPD provides that the National Data
Protection Authority ("ANPD") must notify the data
processing agents of the violation and determine a deadline for
adopting remediation actions, such as deleting or blocking the
personal data. The data processing agent may also be subject of a
daily fine (limited to BRL 50,000,000) if the agent does not take
the required measures within the deadline, and the ANDP may also
impose additional fines (up to 2% of the revenues of the legal
entity in its last fiscal year, limited to BRL 50,000,000 per
violation) and require public disclose of the violation.
