Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Agência Nacional de Proteção de Dados (ANPD), Superintendência de Fiscalização €25.6m 100 % · 1 case
- Autoridade Nacional de Proteção de Dados (ANPD), Coordenação-Geral de Fiscalização €2,720 0 % · 3 cases
- Autoridade Nacional de Proteção de Dados (ANPD), Conselho Diretor – 0 % · 1 case
What for?
by topicWho?
by sectorAll sectors
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2023 | 1 | €2,720 |
| 2024 | 3 | – |
| 2025 | 0 | – |
| 2026 | 1 | €25.6m |
5 cases
24 Aug 2026 ByteDance Brasil Tecnologia Ltda. (TikTok)ANPD fines TikTok operator 153.77 million BRL over data of minors €25.6m
The Agência Nacional de Proteção de Dados (ANPD, Brazilian data protection authority) imposed three fines totalling 153,769,671.33 BRL on ByteDance Brasil Tecnologia Ltda., which operates TikTok in Brazil (63,176,686.67 BRL each for breaches of Art. 7 and Art. 6 VIII LGPD, and 27,416,297.99 BRL for Art. 6 X LGPD). According to the decision, data of children and adolescents were processed without a valid legal basis both in the feed available without registration and when accounts were created, and effective preventive and accountability measures were lacking. The authority also ordered the deletion of data of registered adolescents aged 13 to 18 whose legal representation is not regularised within 60 working days, backed by a daily penalty of 137,081.49 BRL for each day of delay.
Platforms that reach minors need a sound legal basis and demonstrably effective safeguards – including for services used without registration.
Protecting the data of children and adolescents on online platforms
- Authority / court
- Agência Nacional de Proteção de Dados (ANPD), Superintendência de Fiscalização
- Area of law
- Data protection
- Legal basis
- Art. 6 VIII, Art. 6 X und Art. 7 LGPD (Lei nº 13.709/2018); Sanktionen nach Art. 52 LGPD; Resolução CD/ANPD nº 4/2023 (Regulamento de Dosimetria)
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Published
- 25 Aug 2026
Original amount 153,769,671.33 BRL, converted at the ECB reference rate of 24 Aug 2026.
- ANPD – Despacho Decisório nº 27/2026/CGS/SFI, Processo nº 00261.006648/2024-02 (ByteDance Brasil) Decision of an authority
- ANPD – ANPD multa TikTok em R$ 153,7 milhões por falhas na proteção de dados de crianças e adolescentes (25.08.2026) Press release of an authority
- Diário Oficial da União, 25.08.2026 – Despacho Decisório nº 27/2026/CGS/SFI Official register or notice
- ANPD – Decisões em Processos Sancionadores (Übersicht) Enforcement database of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
9 Aug 2024 a Brazilian federal ministryANPD: two reprimands for a federal ministry over security flaw in an access system Reprimand or warning
The ANPD issued two reprimands to a Brazilian federal ministry because, through a vulnerability in an application programming interface of its access and permissions system, personal data such as name, date of birth, mother's name and address could be retrieved when valid CPF numbers were queried: one for inadequately informing data subjects about the security incident (Art. 48 LGPD) and one for insufficient security of the systems (Art. 49 LGPD). Corrective measures were attached, including correcting the notice on the website regarding data categories, risks and the reasons for the delayed information, and a timetable for technical measures; the Board of Directors rejected the appeal in December 2025 and confirmed the final implementation deadline of 31 December 2025 set by the enforcement unit.
After a security incident, data subjects must be fully informed about the data potentially exposed, the risks and the reasons for any delay in notification.
Informing data subjects after breaches and securing interfaces
- Authority / court
- Autoridade Nacional de Proteção de Dados (ANPD), Coordenação-Geral de Fiscalização
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 48 und 49 Lei nº 13.709/2018 (LGPD); Art. 55 § 2 I Regulamento de Fiscalização (Resolução CD/ANPD nº 1/2021)
- Action
- Reprimand or warning
- Status of proceedings
- final
- Sector
- Public sector
- Published
- 9 Aug 2024
Checked against the official source on 7 Oct 2026 · Company name anonymised since 9 Aug 2026 · Direct link
Report an error
2 Jul 2024 an international social media groupANPD provisionally halts a social media group’s AI training on Brazilian users’ data Order
The Conselho Diretor (board of directors) of the Autoridade Nacional de Proteção de Dados (ANPD, Brazilian data protection authority) ordered, as a preventive measure, that the group suspend in Brazil the part of its new privacy policy on using personal data to train generative AI and immediately stop this processing across all of the group’s products, including for people without a user account; a daily penalty of 50,000 BRL was set for each day of non-compliance. The authority saw indications of a missing appropriate legal basis, insufficient transparency, obstacles to exercising data subject rights and a lack of safeguards for data of children and adolescents. Following a request for reconsideration, the ANPD upheld the measure in July 2024 and suspended it at the end of August 2024 after approving a compliance plan submitted by the group.
Anyone wishing to use existing user data for AI training must settle the legal basis, information and opt-out options robustly beforehand.
Data protection when training generative AI on user data
- Authority / court
- Autoridade Nacional de Proteção de Dados (ANPD), Conselho Diretor
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- Art. 52 III und Art. 54 LGPD (Lei nº 13.709/2018); Art. 45 Lei nº 9.784/1999; Art. 26 IV Decreto nº 10.474/2020 (Präventivmaßnahme)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Published
- 2 Jul 2024
Checked against the official source on 7 Oct 2026 · Company name anonymised since 2 Jul 2026 · Direct link
Report an error
31 Jan 2024 a Brazilian regional education authorityANPD: reprimands for a regional education authority after security incident Reprimand or warning
The ANPD issued four reprimands to a regional education authority, among other things because it had not notified the persons affected by a security incident (Art. 48 LGPD), and for breaches of Arts. 37 and 38 LGPD and of the supervision regulation. On appeal, the Board of Directors upheld the reprimand for failure to notify in August 2024 and replaced the other three with a single reprimand for obstructing supervision, because the authority had not produced the requested evidence of its security measures.
Failing to provide the data protection authority with requested evidence risks an additional sanction on top of the underlying infringement.
Notifying data subjects and cooperating with the supervisory authority
- Authority / court
- Autoridade Nacional de Proteção de Dados (ANPD), Coordenação-Geral de Fiscalização
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 37, 38 und 48 Lei nº 13.709/2018 (LGPD); Art. 5 I Regulamento de Fiscalização (Resolução CD/ANPD nº 1/2021)
- Action
- Reprimand or warning
- Status of proceedings
- reduced
- Sector
- Public sector
- Published
- 31 Jan 2024
Checked against the official source on 7 Oct 2026 · Company name anonymised since 31 Jan 2026 · Direct link
Report an error
5 Jul 2023 a Brazilian micro-enterprise offering contact listsFirst LGPD fine: ANPD sanctions micro-enterprise over voter contact lists €2,720
In its first sanction under the Brazilian data protection act LGPD, the Autoridade Nacional de Proteção de Dados (ANPD, Brazilian data protection authority) imposed two fines of 7,200 BRL each (14,400 BRL in total) and a warning on the micro-enterprise. The case arose from a complaint that the company was offering lists of voters’ WhatsApp contacts for campaign messages in the 2020 municipal election in a municipality in the state of São Paulo; the ANPD found no legal basis for this processing, objected to the failure to appoint a data protection officer and sanctioned the failure to answer its requests for information. Because of the company’s micro-enterprise status, each fine was capped at 2% of gross revenue.
Anyone marketing contact lists containing personal data needs a demonstrable legal basis and must answer the regulator’s requests on time – even as a micro-enterprise.
Legal basis for trading contact data and cooperation with the regulator
- Authority / court
- Autoridade Nacional de Proteção de Dados (ANPD), Coordenação-Geral de Fiscalização
- Area of law
- Data protection · Marketing and consent
- Legal basis
- Art. 7 und Art. 41 LGPD (Lei nº 13.709/2018); Art. 5 Resolução CD/ANPD nº 1/2021 (Regulamento de Fiscalização); Art. 52 II LGPD
- Action
- Fine
- Status of proceedings
- final
- Sector
- Other
- Employees
- Under 50
- Published
- 6 Jul 2023
Original amount 14,400 BRL, converted at the ECB reference rate of 5 Jul 2023.
Checked against the official source on 7 Oct 2026 · Company name anonymised since 5 Jul 2025 · Direct link