Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Autoridade Nacional de Proteção de Dados (ANPD), Coordenação-Geral de Fiscalização – 0 % · 2 cases
What for?
by area of lawAll areas of law
Who?
by company- Anonymised companies – 0 % · 2 cases
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2024 | 2 | – |
| 2025 | 0 | – |
| 2026 | 0 | – |
2 cases
9 Aug 2024 a Brazilian federal ministryANPD: two reprimands for a federal ministry over security flaw in an access system Reprimand or warning
The ANPD issued two reprimands to a Brazilian federal ministry because, through a vulnerability in an application programming interface of its access and permissions system, personal data such as name, date of birth, mother's name and address could be retrieved when valid CPF numbers were queried: one for inadequately informing data subjects about the security incident (Art. 48 LGPD) and one for insufficient security of the systems (Art. 49 LGPD). Corrective measures were attached, including correcting the notice on the website regarding data categories, risks and the reasons for the delayed information, and a timetable for technical measures; the Board of Directors rejected the appeal in December 2025 and confirmed the final implementation deadline of 31 December 2025 set by the enforcement unit.
After a security incident, data subjects must be fully informed about the data potentially exposed, the risks and the reasons for any delay in notification.
Informing data subjects after breaches and securing interfaces
- Authority / court
- Autoridade Nacional de Proteção de Dados (ANPD), Coordenação-Geral de Fiscalização
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 48 und 49 Lei nº 13.709/2018 (LGPD); Art. 55 § 2 I Regulamento de Fiscalização (Resolução CD/ANPD nº 1/2021)
- Action
- Reprimand or warning
- Status of proceedings
- final
- Sector
- Public sector
- Published
- 9 Aug 2024
Checked against the official source on 7 Oct 2026 · Company name anonymised since 9 Aug 2026 · Direct link
Report an error
31 Jan 2024 a Brazilian regional education authorityANPD: reprimands for a regional education authority after security incident Reprimand or warning
The ANPD issued four reprimands to a regional education authority, among other things because it had not notified the persons affected by a security incident (Art. 48 LGPD), and for breaches of Arts. 37 and 38 LGPD and of the supervision regulation. On appeal, the Board of Directors upheld the reprimand for failure to notify in August 2024 and replaced the other three with a single reprimand for obstructing supervision, because the authority had not produced the requested evidence of its security measures.
Failing to provide the data protection authority with requested evidence risks an additional sanction on top of the underlying infringement.
Notifying data subjects and cooperating with the supervisory authority
- Authority / court
- Autoridade Nacional de Proteção de Dados (ANPD), Coordenação-Geral de Fiscalização
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 37, 38 und 48 Lei nº 13.709/2018 (LGPD); Art. 5 I Regulamento de Fiscalização (Resolução CD/ANPD nº 1/2021)
- Action
- Reprimand or warning
- Status of proceedings
- reduced
- Sector
- Public sector
- Published
- 31 Jan 2024
Checked against the official source on 7 Oct 2026 · Company name anonymised since 31 Jan 2026 · Direct link