Brazilian General Data Protection Law (“LGPD”) came into force just over 10 months ago, in September 2020. However, under the argument of ensuring an adequate adaptation period, the entry into force of administrative sanctions was postponed and occurred only recently, on August 1, 2021.

The penalties provided for by the LGPD are strict and range from a warning, with an indication, by the National Data Protection Authority ("ANPD"), of the deadline for the adoption of corrective measures, to a fine of up to 2% of the incomes of the legal entity or its economic group in Brazil in the previous year, limited to BRL 50,000,000.00 per infraction (approximatelly USD 10,000,000.00), and even the suspension of personal data processing activities and the publication of the infraction, which has the potential to cause reputational damages greater than the amount of the established fine by law.

Even though the administrative penalties, which are of the exclusive competence of the ANPD, came into force only on August 1, 2021 and still depend on the approval of the ANPD Regulation for Inspection and Application of Administrative Sanctions, which should take place in the coming weeks, there are already more than 600 lawsuits filed based on the determinations provided for by the LGPD, with potential to result in liability for breaches of the law.

The need to adapt to and comply with the LGPD is essential and unavoidable. It is expected that ANPD, at least initially, will act in a thoughtful manner, aiming to create a culture of personal data protection and helping data processing agents to adapt to the law. However, its capacity as a regulatory and sanctioning body, combined with the possibility of applying severe administrative sanctions, provides to the ANPD the prerogative of rigorous action.

We will continue to follow up the matter and soon we hope to be able to bring new information regarding ANPD's performance in relation to the administrative sanctions.