ANPD Brazil: LGPD Enforcement 2024
Brazil's privacy regulator, the ANPD, started issuing fines in 2024. These were the first major fines under LGPD — Law No. 13,709/2018. Brazil has 215 million people covered by this law. It also has 180 million internet users — the largest digital economy in Latin America. LGPD compliance is now real and active.
LGPD: Brazil's Privacy Law
LGPD is based on GDPR but has key differences.
Maximum fines: Up to 2% of Brazilian annual revenue. The cap is R$50 million (≈€9M) per violation. GDPR uses global revenue at 4%. LGPD's Brazil-only basis means lower caps for multinationals. But it means higher relative risk for Brazil-only companies.
Sensitive categories: LGPD's list is close to GDPR Article 9. It covers race, political views, religion, health records, genetic data, biometrics, and sexual orientation. The ANPD's 2024 guidance extended these rules under Article 11.
Data subject rights: People can access, correct, delete, and port their records. They can also ask about data sharing. LGPD adds one right not in GDPR: the right to know if AI was used in a decision about them.
Enforcement start: ANPD issued first sanctions in 2024. Main targets were telecoms, financial firms, and healthcare providers. Multinationals in Brazil are the 2025 focus.
For a broader view, see our guide on global PII compliance.
Brazilian PII Identifiers
Brazil's ID system is complex. It is a federal republic. Some documents vary by state.
CPF: An 11-digit taxpayer number (format: XXX.XXX.XXX-XX). It has two check digits using modular math. The CPF is Brazil's main ID for banking, tax, health, and government. All 215 million Brazilians have one.
CNPJ: A 14-digit company number (format: XX.XXX.XXX/XXXX-XX). It has two check digits. It appears in business records tied to company officers.
RG: A state-issued civil ID card. Format varies by state. São Paulo's RG differs from Rio de Janeiro's, and so on across 26 states plus the Federal District. A tool that only knows one state's format will miss most Brazilian RG numbers.
CNH: An 11-digit driver's license number with one check digit.
Título de Eleitor: A 12-digit voter ID. It encodes the voter's registration zone.
PIS/PASEP: An 11-digit social program number. It appears in payroll and employment records.
SUS number: A 15-digit health system ID. Every Brazilian has one. It appears in all health documents.
Our global PII identifier guide covers CPF next to SSN, Aadhaar, and other national IDs.
LGPD vs. GDPR: Key Differences
Both frameworks protect personal records, but they differ in important ways.
Legal bases: LGPD has 10 legal bases. GDPR has 6. LGPD includes "protection of credit" — a basis tied to Brazil's fintech culture. No GDPR match exists for this.
No EU adequacy for Brazil: The EU has not given Brazil an adequacy decision. EU–Brazil transfers need Standard Contractual Clauses or Binding Corporate Rules — the same as for the US.
Consent rules: LGPD consent must be specific, informed, free, and clear — much like GDPR. For sensitive records, LGPD allows broader consent than GDPR's per-purpose standard, as long as the purpose is stated.
ANPD's 2025 Enforcement Focus
ANPD has published its 2025 priorities based on 2024 case outcomes.
Healthcare Records
Article 11 requires explicit consent — or a clear legal basis — to process health records. ANPD found many healthcare apps and providers lacked this basis for SUS numbers and medical files.
Financial Services
CPF numbers in loan files, credit reports, and insurance policies are top targets. ANPD is checking whether retention periods match stated purposes.
Tech Platform Compliance
Social media, e-commerce, and streaming platforms in Brazil are a 2025 focus. ANPD is looking at profiling and cross-border transfers.
What to Do Now
The baseline for Brazilian compliance is CPF and CNPJ detection with check-digit validation. Add RG detection with per-state format logic. Include CNH, Título de Eleitor, and SUS number support for full coverage. See our LGPD anonymization guide for step-by-step detail.