The regulatory landscape in Latin America has undergone a seismic shift. In June 2026, Brazil’s National Data Protection Authority (ANPD) formally launched an administrative enforcement proceeding against Claro—one of the nation’s telecommunications giants—marking a definitive transition from the Authority’s “educational” infancy to a period of rigorous, high-stakes regulatory oversight.
This development is not merely a localized legal dispute; it is a signal to every multinational corporation with exposure to the Brazilian market that the era of passive compliance is over. With the backing of new legislative autonomy and a permanent, specialized workforce, the ANPD has signaled its intent to hold industry titans to the same, if not higher, standards as smaller entities. For U.S. and global firms, the message is clear: the General Data Protection Law (LGPD) is now being enforced with teeth.
Main Facts: The Claro-Serasa Nexus
The investigation centers on the data-sharing practices between Claro, a subsidiary of the Mexico-based América Móvil, and Serasa, the preeminent credit bureau in Latin America, majority-owned by the London-listed Experian.
Claro, which provides mobile, broadband, and pay-TV services to over 75 million subscribers in Brazil, is alleged to have transferred excessive volumes of sensitive customer data to Serasa. According to Fabrício Guimarães, the ANPD’s Superintendent of Enforcement, the scope of this data exchange—involving more than one hundred distinct data points per customer—violates the fundamental LGPD principles of necessity, transparency, and purpose limitation.
The stakes are immense. Under the current regulatory framework, the ANPD has the authority to impose fines of up to 50 million Brazilian Reais (approximately $9 million USD) per infraction, or 2% of the company’s revenue, whichever figure is higher. By targeting such a massive entity, the ANPD has effectively neutralized the "size immunity" narrative, proving that no market share is too large to shield a company from regulatory scrutiny.
Chronology: From Educational Guidance to Regulatory Autonomy
To understand the gravity of the current enforcement, one must look at the evolution of the ANPD over the last half-decade.
- 2021–2025: The Educational Phase. Following the implementation of the LGPD, the ANPD spent its initial years focused on capacity building, issuing technical guidance, and providing warnings rather than punitive sanctions.
- December 2024: The Authority signaled its intent to move toward proactive enforcement by notifying 20 major corporations simultaneously for failing to properly appoint and disclose a Data Protection Officer (DPO).
- Early 2025: The ANPD made headlines by blocking the iris-scanning operations of Tools for Humanity (Worldcoin), demonstrating a willingness to issue preliminary orders to halt operations before a full investigation is even concluded.
- February 2026: A critical turning point occurred when Provisional Measure 1.317/2025 was converted into Law 15.352. This granted the ANPD full, functional, and financial autonomy, establishing it as a top-tier regulatory agency with six dedicated superintendencies and a permanent staff of 200 regulatory experts.
- June 2026: The formal enforcement action against Claro was initiated, utilizing the newfound powers and the recently launched Enforcement Dashboard, which tracks proceedings in real-time to ensure public transparency.
Supporting Data: The Anatomy of an Investigation
The ANPD’s methodology for identifying and investigating infractions is sophisticated, relying on three distinct vectors of oversight:
- Direct Complaints: A public-facing portal allows data subjects to report potential violations, which the Authority processes through periodic monitoring cycles.
- Priority Topics Maps: Every two years, the ANPD publishes a roadmap of its enforcement priorities. The 2026–2027 map explicitly targets biometric data, health data, financial data, and the processing of information regarding children and adolescents.
- Sector-Wide Sweeps: The ANPD routinely launches simultaneous investigations into specific industry verticals to force compliance across entire segments of the economy.
Once an investigation begins, the process follows the protocols established in ANPD Board Resolution 1/2021. Companies are subject to a sequence of information requests and, if necessary, preliminary orders. A defense must be submitted within ten business days; failure to respond is treated as obstruction, leading to compounding penalties. When fines are calculated, the ANPD utilizes the criteria in Resolution 4/2023, which assesses the severity of the breach, the economic benefit derived from the illegal data processing, and the existence—or lack—of a robust privacy governance program.
Official Responses and Judicial Precedents
While the Claro case is the most high-profile to date, it follows a series of precedents that have shaped the current environment.
The first-ever fine issued by the ANPD, a relatively modest R$14,400 against Telekall Infoservice in 2023, established the "standalone infraction" principle: a company can be fined for missing a DPO, even if no other data breach occurred. This was a direct warning to small and medium enterprises that technical compliance is mandatory.
The Tools for Humanity case (2025) further solidified the ANPD’s role as an activist regulator. By ordering the immediate cessation of biometric data collection, the ANPD proved it could act as an injunction-granting body, preventing mass-scale potential damage before a formal ruling. Similarly, the sanctioning of the Santa Catarina Health Secretariat regarding a public health data leak signaled that the public sector enjoys no special protection—sensitive health data is the highest priority for the Authority.
Implications for Multinationals
For American and European companies, the extraterritorial nature of the LGPD cannot be overstated. The law applies to any organization that processes data of individuals located in Brazil, regardless of whether the company maintains a physical office in the country.
The Compliance Gap
Many multinational corporations mistakenly believe that a robust GDPR compliance program is sufficient for Brazil. While there is significant overlap between the GDPR and the LGPD, the latter contains unique requirements regarding:
- Legal Bases for Processing: The nuances of when and how data can be processed differ significantly.
- DPO Requirements: The LGPD has specific expectations for the visibility and role of the DPO.
- Incident Notification: The timelines and reporting thresholds under the LGPD are distinct.
The "Substantive" Test
The ANPD has made it clear that they are not interested in "paper compliance." A privacy policy posted on a website, if not backed by thorough data mapping, regular records of processing activities, and an empowered DPO, will likely fail the Authority’s assessment.
For the U.S. compliance officer, the lesson is clear: the ANPD is now an agency with the mandate, the structure, and the political will to enforce its regulations. The transition from an educational body to an aggressive regulator is complete. Companies that fail to adapt their Brazilian operations to this new reality risk not only massive financial penalties but also the severe reputational damage of being publicly named on the ANPD’s Enforcement Dashboard.
As the Brazilian market continues to digitize, the ANPD will only increase its surveillance. Compliance is no longer an item for the back-office; it is now a fundamental requirement for maintaining a license to operate in one of the world’s largest consumer markets.
Gustavo Aguiar is a municipal attorney in Brazil and the developer of Lici Govtech, an AI-driven platform for public procurement oversight. He specializes in bridging the gap between operational infrastructure realities and compliance frameworks like the U.S. FCPA and Brazil’s Anti-Corruption Law.
