LGPD, civil liability, administrative sanctions and the ANPD

Article 42 makes a controller or operator that causes patrimonial, moral, individual, or collective damage through personal-data processing in violation of the data-protection legislation liable to repair it, holds an operator jointly liable when it breaches the legislation or departs from the controller's lawful instructions, lets a court shift the burden of proof to the controller where the data subject's claim is plausible, and lets the reparation claim proceed collectively in court.

Article 52 subjects a controller or operator to administrative sanctions the ANPD applies after a due process guaranteeing full defense, from a warning with a correction deadline through a simple fine of up to 2% of the private legal entity's, group's, or conglomerate's revenue in Brazil in its last fiscal year, excluding taxes, capped in total at R$50,000,000.00 per infraction, a daily fine observing the same cap, publicity of the confirmed infraction, blocking or deletion of the data at issue, and suspension of the database or the processing activity for up to six months, renewable once.

Articles 53 and 54 require the ANPD to publish, after public consultation, the methodology it uses to calculate a fine's base value and to ground a daily fine's amount in the violation's gravity and the harm caused.

Article 55-A creates the supervisory authority as a special autarchy; its most recent redação, given by Lei nº 15.452, de 2026, names it the Agência Nacional de Proteção de Dados (ANPD) rather than the Autoridade Nacional de Proteção de Dados the LGPD first created in 2018, and links it to the Ministério da Justiça e Segurança Pública with functional, technical, decision-making, administrative, and financial autonomy.

Article 55-J gives the ANPD the power to issue rules, demand information from any controller or operator at any time, receive and act on data-subject complaints, and inspect and sanction noncompliant processing through a process that guarantees the defendant's defense and right of appeal.

Articles 58-A and 58-B create a National Council on Data Protection and Privacy with representatives of government, the legislature, the judiciary, and civil society to advise the ANPD and propose data-protection and privacy policy.

The civil-liability chapter and the ANPD's own creation took effect with the LGPD's general provisions on 18 September 2020, but the administrative-sanctions chapter, articles 52 to 54, did not take effect until 1 August 2021, under article 65, I-A, added by Lei nº 14.010/2020.