Compliance and Sanctions under the Brazilian Data Protection Law

Abstract

Since its entry into force, the General Personal Data Protection Law (LGPD) has posed a significant challenge for Brazilian organizations — as much public as private — with regards to adequacy with its guidelines,resulting in a growing number of violations and administrative proceedings. In this context, this article aims to analyze the application and compliance with the LGPD in Brazil, focusing on violations and regulatory processes established, based on the APDados database, from 2020 to 2023, depending on the availability of consolidated data in the analyzed database. This is applied and quantitative research that examines the processes related to the application of the LGPD in Brazil. The analysis uses public records of processes, sanctions, and infractions extracted from APDados, allowing us to map the temporal evolution of cases and the actions of the different agencies involved. Among the indicators explored are the type of sanction, the most cited LGPD articles, and the most frequently used economic segments, which enables the identification of trends and compliance gaps. By quantifying and categorizing these violations, the article identifies patterns of non-compliance, the most vulnerable sectors, and the main challenges in monitoring and applying sanctions.