Summary
Eight years after the passage of the Lei Geral de Proteção de Dados (LGPD), Brazil’s regulatory landscape has reached a decisive turning point. Data protection is no longer viewed as a paper-based compliance requirement or an isolated IT checklist, but as a core operational discipline backed by rigorous administrative enforcement. Spearheaded by the National Data Protection Authority (ANPD), Brazil’s regulatory framework now demands demonstrable accountability, penalizing organizations not just for security breaches, but for structural design flaws, inadequate incident response, and an inability to technically substantiate their privacy safeguards.
This new regulatory reality is defined by a distinct enforcement pattern that spans both global tech giants and domestic entities. Major actions against platforms like TikTok—for processing children’s personal data without a valid legal basis and conducting unauthorized behavioral profiling—demonstrate the ANPD’s willingness to mandate sweeping platform changes alongside severe administrative sanctions. Concurrently, proceedings against healthcare organizations like the Health and Citizenship Institute (Isac) signal that failure to properly communicate security incidents, maintain transparent Data Protection Officer (DPO) governance, or provide technical proof of data containment will draw equal scrutiny. Coupled with an expanding regulatory agenda covering Generative AI governance, algorithmic bias, and the strict rules governing minors’ data under Article 14 of the LGPD alongside the Child and Adolescent Statute (ECA) and the Digital Statute of the Child and Adolescent, the message to the market is absolute: privacy by design, active incident readiness, and proven governance are now baselines for operating in Brazil.
This Content Is Only For Subscribers
To unlock this content, subscribe to INTERLIRA Reports.
The TikTok Case
The TikTok sanction is, by scale and by substance, the defining data protection case of 2026 in Brazil. It followed an investigation by the ANPD’s Enforcement Superintendence, formalized in Technical Note No. 50/2024, which examined two distinct ways users experience the platform: the feed available without any account, open to any visitor, and the feed tied to a registered profile. In both scenarios, the agency concluded that the platform processed minors’ personal data without a valid legal basis under the LGPD, and it ultimately identified five separate infractions. On the no-login side, investigators found no real mechanism to prevent minors from consuming and generating data through the platform; on the registered side, the company relied essentially on self-declared birth dates as its age control tool was considered trivial to circumvent.
ByteDance’s own figures tell the story: TikTok’s parent company reported deleting 7.75 million underage accounts in Brazil over a single year. Rather than viewing this as proof that safeguards were working, the ANPD interpreted the vast volume as evidence of systemic failure— estimating that roughly 20% of all children’s accounts on the platform during that period belonged to underage users who had bypassed age controls to have their personal data processed.
The case also turned on a more technical dispute that carries broader implications for the industry: ByteDance argued that its content-recommendation system merely calculated relevance and did not amount to “profiling.” The ANPD’s technical staff rejected that distinction, concluding that personalizing content based on collected data constitutes behavioral profiling, including children, and that this profiling may have continued, alongside sharing with commercial partners, even after underage accounts were removed. The agency also noted it had initially pursued a responsive, corrective approach with the company, but concluded that TikTok’s conduct throughout the inquiry seemed less aimed at fixing the problem than at prolonging the failure.
Beyond the fine, the ANPD ordered ByteDance to delete irregularly collected data, deactivate the no-login feed entirely, suspend advertising and block livestreams and direct messages for users who have not created an account, implement reliable age-verification mechanisms, apply the most restrictive privacy settings by default to accounts of users under 16, and submit to a compliance plan, an order ByteDance may still contest before the agency’s governing board. Regulators highlighted similar investigations into TikTok across the European Union, the United States, and Canada. They also linked the case to the ANPD’s recent decision to suspend Discord’s livestreaming features following the tragic death of a 13-year-old—framing both measures as key strikes in a broader regulatory crackdown on social media platforms operating in Brazil.
Isac’s Case
A second case, smaller in scale but similar in logic, involves the Health and Citizenship Institute (Isac), a nonprofit that manages public healthcare units across several Brazilian states. In January 2025, Isac’s administrative headquarters in Brasília suffered a ransomware attack attributed to the LockBit 4.0 group, which encrypted files and overwrote synchronized backups, crippling the institution’s ability to recover data independently. The ANPD’s investigation which spanned 18 months, cited aproximately 500,000 affected records, including roughly 78,772 records belonging to children and adolescents and 47,921 to elderly patients, categories that receive heightened protection under Brazilian law.
What ultimately drew regulatory fire, however, was not the attack itself but what happened afterward: Isac’s communication to affected individuals was limited to a notice on its website, without dates, scope, or remediation steps; the organization claimed only administrative data tied to terminated contracts had been touched but could not produce technical evidence to substantiate that; and its public portal lacked basic information about its designated data protection officer. As with TikTok, the ANPD’s message is structural rather than incidental: it is not punishing Isac for being attacked, but for how it responded, and it is not punishing TikTok merely for a data breach, but for a system built without adequate safeguards from the outset.
The consequences arrived eighteen months later. On July 8, 2026, the ANPD opened Administrative Sanctioning Process No. 2/2026 against Isac, combining Article 52 of the LGPD with the agency’s regulation on Security Incident Communication. Possible sanctions range from a formal warning to a fine of up to 2% of revenue, as well as suspension or outright prohibition of data-processing activities. For balance, Isac has pushed back, arguing that the charges lack the clarity required of administrative sanctioning acts and invoking the presumption of innocence to argue that the burden of proof rests with the regulator. The outcome is not a foregone conclusion, but the mere existence of the process, publicized ahead of any defense being filed, already functions as a signal to the market.
Strengthening Governance
Regulatory maturity is not only about punishment; it is also about building the capacity to comply in the first place, and both cases above are, in practice, applications of a small set of rules that sit at the core of the LGPD. The law is built on foundational principles of information protection and key data protection Governance principles, including purpose limitation, necessity, transparency, security, and accountability, and it requires that any processing of personal data rest on one of the legal bases set out in the statute, such as consent, legitimate interest, or compliance with a legal obligation, none of which TikTok could credibly invoke for the minors’ data at issue. It grants the subjects the rights to access, correct, delete, and port their data and to obtain clear information about how it is used; it requires controllers to appoint a data protection officer and to notify the authority and affected individuals of security incidents within a reasonable timeframe, precisely the requirement Isac failed to meet; and it subjects children’s data to a stricter regime under Article 14, which conditions processing on the child’s best interest and prohibits making a service’s use contingent on the collection of more data than is strictly necessary. Sanctions escalate from a warning to fines of up to 2% of revenue, capped at R$50 million per infraction, and can extend to the blocking, deletion of data, or suspension of the processing activity itself.
In parallel with these enforcement actions, the ANPD held its third annual Meeting of Data Protection Officers on August 19, 2026, under the theme “Protection and Governance in Action.” The program centered on three themes of particular relevance to data protection officers: data protection and the use of generative artificial intelligence in public and private institutions; security incidents and the DPO’s strategic role; and the new challenges arising from Child and Adolescent Statute (ECA – Law No. 8.069/1990), alongside Article 14 of the LGPD (which specifically regulates minors’ data). The panel on generative AI addressed the challenges of AI governance, bias mitigation, and the importance of evaluations and audits throughout the entire lifecycle of AI solutions, alongside the need for multidisciplinary governance oriented toward rights preservation and ethics by design. Across the discussions, panelists emphasized that the DPO role is evolving well beyond formal compliance with LGPD obligations, taking on an increasingly strategic character as organizations adopt new technologies and must prevent, prepare for, and respond to incidents involving personal data. Generative AI and children’s data were not chosen as panel topics by accident; they mirror precisely the areas where the agency has already begun to act.
A Pattern That Is Only Accelerating
Taken together, the TikTok and Isac cases, one involving a global social media giant and the other a mid-sized nonprofit, show that the ANPD’s enforcement posture is neither sector-specific nor limited to headline-grabbing breaches. A recognizable pattern emerges that organizations of every size should study closely: a technical or design failure occurs, the organization cannot substantiate that its safeguards actually worked, and that gap between what was declared and what can be proven becomes the basis for regulatory escalation. This reading is reinforced by the broader arc of 2026: on August 14, the LGPD marked its eighth anniversary since enactment, prompting reflection from legal specialists on how far the compliance landscape has evolved, from formal, paper-based programs toward demonstrable practice. For organizations operating in Brazil, the message from this stretch of 2026 is consistent: data governance is no longer a legal afterthought bolted onto security or product decisions. It is a core operational discipline, subject to real financial and operational consequences, and the ANPD has shown, through its sanctions, its expanding scrutiny of social platforms, and its public agenda, that it intends to keep enforcing it that way.
