Brazil: Implemented ANDP Regulation of Dosimetry and Application of Administrative Penalties

On 27 February 2023, Brazil's National Data Protection Authority (ANDP) published the "Regulation of Dosimetry and Application of Administrative Penalties", which entered into force on the same day of its publication. The Regulation aims to promote the effectiveness in implementing the administrative sanctions provided for in the General Personal Data Protection Law (LGPD) by setting a methodology for the ANDP to apply sanctions based on the principle of proportionality. In particular, the Regulation outlines the criteria and parameters to be considered in the application of sanction, including the gravity and nature of the infractions and the personal rights affected, degree of damage, cooperation of the offender, adoption of good practices and governance policy and the adoption of corrective measures. In addition, the Regulation outlines the sanctions that the ANDP may apply, including warnings, simple fines, daily fines, orders requiring deletion of personal data, suspension of exercising activities related to data processing and partial or total ban on carrying out activities related to data processing, suspension of database operation and publication of the infraction.