Brazil's data protection authority is now a regulator — and fining small businesses

Data protection enforcement just changed gears

Law No. 15.352/2026 turned ANPD (Brazil's National Data Protection Authority) into a full regulatory agency — with more autonomy and structure to enforce the law. In June 2026 alone, ANPD opened 19 new sanctioning cases and launched a public enforcement dashboard where anyone can track which companies are under investigation.

The detail that tends to surprise small business owners: the first-ever LGPD fine in Brazil's history landed on a microenterprise, not a large corporation. The minimum amount seen in published cases was around R$14,000 — small compared to the cap of 2% of revenue (up to R$50 million per infraction), but still a real, avoidable cost.

Why "we're too small to notice" stopped being true

Enforcement happens in three scenarios, according to ANPD's own design: when a sector enters the Priority Themes Map (health, biometrics, financial data, minors' data), when there's a complaint from a customer or former employee, or when a company suffers a leak that goes viral. None of these three triggers depends on company size — a small clinic handling health data, or a shop storing customer ID numbers and addresses, is on the radar just as much as a large chain.

What reduces risk, even without a dedicated legal team

ANPD has already signaled that a company demonstrating good faith, maintaining some data governance structure, cooperating during enforcement, and quickly fixing what's flagged tends to see meaningful fine reductions. That changes the question from "how do we avoid enforcement" (impossible to guarantee) to "what do we have ready if enforcement comes."

Three things help: a simple channel where a customer or employee can request their data be deleted, a basic record of where customer data is stored and who has access, and a defined person (even informally) to make quick decisions if a leak or complaint happens.

Where Diglion comes in

Diglion helps small and mid-sized businesses set up this minimum data governance structure — without requiring an in-house legal department — reducing real fine risk.

Sources consulted

• Turivius, Multas LGPD 2026: quem a ANPD já sancionou e por quê, retrieved 2026-06-15.
• Minotto Contabilidade, ANPD em modo fiscal: o que muda para PMEs em 2026, retrieved 2026-06-15.