LGPD in Practice: What the Feira de Santana Data Breach Teaches Businesses

Estimated reading time: 12 to 15 minutes. Research updated on October 28, 2026.

A person provides information about their health to obtain a public transport benefit. They expect those data to be used to assess their eligibility and provide the service. When their name appears publicly alongside a diagnosis, they lose control over information they may have chosen to share with very few people.

It was this kind of exposure that brought the Municipal Government of Feira de Santana, in Bahia, under investigation by Brazil’s National Data Protection Agency (ANPD). The episode provides a concrete example for discussing how compliance with Brazil’s General Personal Data Protection Law (LGPD) needs to be part of administrative decisions and everyday business operations.

For anyone running a business, the question is a practical one: what controls prevent information about customers, patients, or employees from reaching people who should not receive it? A sound answer involves people, processes, technology, and the ability to demonstrate what has been done.

What happened in Feira de Santana

On September 20, 2025, the municipal Official Gazette published information about beneficiaries of free public transport passes, as part of a procedure related to suspending the benefit following a court decision. The municipality itself acknowledged that information concerning people with HIV, sickle cell anemia, and fibromyalgia had been improperly disclosed. 1

According to the ANPD, the exposure affected 1,241 people, and the publication was removed the same day, after remaining accessible for a few hours. 2

The episode occurred in the process of publishing an administrative act. It illustrates a risk that also deserves attention in businesses: a document intended for the public may contain information that should remain within an internal procedure. Prevention needs to cover the selection of fields, preparation of the file, and approval for its release.

The LGPD classifies health data as sensitive personal data, subject to the specific conditions in Article 11. Law No. 14,289/2022 adds confidentiality protections for the status of people living with HIV and the other conditions it lists, including within public administration. Fibromyalgia and sickle cell anemia are not on that specific list, but data concerning them remain protected by the LGPD. 34

The human impact emerged in a statement by the Association of Relatives, Friends, and People Living with HIV/AIDS, which called for redress before the City Council. 5 Publicly associating someone with a diagnosis can affect their family, professional, and social relationships. Care for that information must begin before any discussion of the amount of a penalty.

In my view, this is the point that should guide management: every record represents a person with legitimate expectations about how the information they provided will be used.

What the municipality disclosed publicly

The municipality did make the incident public. There are official statements that need to be considered in an accurate account of the case:

Date	Municipal statement
September 21, 2025	The Municipal Urban Mobility Department published a statement acknowledging the improper disclosure, attributed the incident to a “system failure,” and announced a corrected edition of the Official Gazette. This was the department’s explanation, not an independent technical finding. 6
September 22, 2025	The municipality announced an internal administrative inquiry to investigate the breach, establish responsibility, and propose preventive measures. 1
October 26, 2026	The Municipal Attorney General’s Office published a statement about the proceedings and the ANPD’s recent decision. It said it was awaiting formal notification before analyzing the terms and assessing administrative and legal steps, including the measures and deadlines. 7

These publications establish that the municipality addressed the public. However, three situations need to be distinguished: informing the public about an episode, reporting the incident as required by regulation, and complying with a sanction requiring public disclosure of the infringement.

The regulatory notification has specific recipients, content, format, and deadlines. Resolution CD/ANPD No. 15/2024 requires direct, individualized notification to identifiable data subjects; it permits public announcements in the specified circumstances where individual contact or identification of those affected is impossible. It also expressly distinguishes widespread disclosure of the incident from the sanction requiring public disclosure of the infringement. 8

In this case, the ANPD identified a failure to fulfill the duty to notify the agency and the data subjects. 2 This should be reported as a finding of the investigation, without treating the existence of the public statements as proof of compliance or asserting, beyond the documents reviewed, that nobody received any contact whatsoever.

As of this article’s update, the statements examined do not allow us to confirm full compliance with the public disclosure sanction, when its duration began to run, or whether any opportunities to appeal have ended. The municipality’s October 26 statement should be read within those limits. 7

The sanctions announced and the corrective measures required

On October 26, 2026, the ANPD announced a warning and public disclosure of the infringement, with the latter to appear on the municipal website’s home page for six months. It reported six infringements and obstruction of oversight through a failure to respond to requests. 2

The requirements included a data protection officer; privacy and information security policies; an incident response plan and impact assessments; rules and records for data sharing; assessments before publication; training; deletion of data processed without a legal basis or valid purpose; and transparency about processing operations and rights. 2

This set of measures has a clear management implication: the organization needs to assign responsibilities, review procedures, and produce evidence that the changes work. Approving a policy is one step; ensuring that it guides people who publish documents, administer systems, or serve the public requires follow-up.

It is also important to understand what public disclosure means. The regulation requires the infringer to disclose the infringement under the conditions defined by the ANPD. The content, medium, duration, and compliance deadline form part of the measure. 9 An old news item about the breach therefore does not, by itself, demonstrate compliance with this specific obligation.

Public bodies and businesses: which sanctions are possible?

Article 52, paragraph 3, of the LGPD excludes ordinary and daily fines from the set of sanctions applicable to public bodies and entities. A municipal government can therefore be subject to other administrative sanctions under the LGPD. 3

The table below sets out the legal possibilities. Their application depends on the proceedings and the requirements for each measure; it does not mean that all were imposed on Feira de Santana. 11

Administrative sanction	Public bodies, such as municipal governments	Private companies
Warning, with a deadline for corrective action	Yes	Yes
Ordinary fine	No	Yes
Daily fine	No	Yes
Public disclosure of the infringement	Yes	Yes
Blocking of data related to the infringement	Yes	Yes
Deletion of data related to the infringement	Yes	Yes
Partial suspension of database operations	Yes, subject to legal requirements	Yes, subject to legal requirements
Suspension of processing activities	Yes, subject to legal requirements	Yes, subject to legal requirements
Partial or total prohibition of processing activities	Yes, subject to legal requirements	Yes, subject to legal requirements

Both forms of suspension may last up to six months, renewable for the same period. Suspensions and prohibitions require the prior application, in the same case, of one of the sanctions specified in Article 52, paragraph 6. For public bodies, that prior step may be public disclosure, blocking, or deletion; a warning alone is not sufficient. Where a sectoral regulator has sanctioning powers, it must also be consulted. 9

There is a qualification concerning state-owned enterprises: Article 24 treats public enterprises and mixed-capital companies operating in competition as private legal entities. When they implement public policies, the law provides for their treatment as public authorities within that activity. Their classification needs to take the activity into account. 14

The scope of fines in the private sector

An ordinary fine can reach 2% of the Brazilian revenue of the private legal entity, group, or conglomerate in the preceding financial year, excluding taxes, capped at R$50 million per infringement. A daily fine is also subject to the statutory overall limit. 10

The amount depends on an assessment of the case. Sanction calculation takes into account factors such as severity, harm, repeat offenses, cooperation, governance, and corrective measures, with due regard for administrative proceedings and the right to a defense. 11 The ceiling quoted in headlines is a limit, not an automatic charge for any failure.

It would also be inaccurate to state that fines apply exclusively to commercial businesses: the regulation covers private agents such as nonprofit entities and natural persons, depending on their classification. 9

Operational risk also deserves attention in a business. Consider a service that relies on a customer database and must stop a particular use of those data. Even without assigning a monetary value to that interruption, it is possible to see why organizing operations and correcting unlawful processing before it becomes a larger problem matters.

Other forms of liability remain possible

The absence of an administrative fine under the LGPD for a municipality does not eliminate potential consequences in other areas. The ANPD itself explains that its sanctioning framework operates alongside liability established by other laws. 10

Law No. 14,289/2022, for example, provides for compensation for material and nonmaterial harm resulting from breaches of its confidentiality rules. 4 Any liability of public officials requires investigation and satisfaction of the requirements of the applicable regime. A fine is not automatically transferred to the mayor or a public employee, and not every incident is, in itself, a crime or an act of administrative misconduct.

What to do when an incident occurs

Removing an exposed file is a containment measure. To organize the response, I recommend working on three fronts at once: stopping the exposure, understanding its scope, and assessing the notifications required.

The ANPD’s guidance is that incidents capable of causing significant risk or harm must be reported to the agency and the affected individuals. The general deadline is three business days, counted from when the controller becomes aware that the incident affected personal data. Information provided to the ANPD may be supplemented, with justification, within twenty business days of the notification. 812

This requires preparation. If nobody knows who makes the decisions, where the records are, or how to locate the data subjects, the organization will spend part of that period trying to get organized. A useful plan should identify responsible individuals, alternates, contacts, assessment criteria, and a method for recording the steps taken.

Not every incident requires notification to the ANPD: the assessment depends on the data involved, the context, and the risk to data subjects. 12 The decision whether to notify must be documented; the regulation requires records of incidents, including those that are not reported. 8

In practice, a useful notification must enable the individual to understand what happened and know where to seek guidance. Generic statements about a commitment to privacy are of little help when information about which data were affected and what measures are being taken is missing.

How to make compliance part of everyday operations

In its compliance guidance, the ANPD emphasizes mapping and recording processing operations, identifying legal bases and purposes, implementing security measures and internal policies, and providing a channel for data subjects. 13 Based on these guidelines, I propose organizing the work around the areas below, adapting the depth of the assessment to each company’s size and risks.

1. Understand how data move

Start with a specific activity: hiring employees, serving customers, registering patients, or sending campaigns. Identify what information comes in, where it is stored, who uses it, whom it is shared with, and when it is no longer needed.

This review needs to cover how work actually happens. Include spreadsheets, paper documents, shared folders, forms, messages, and contracted systems. At the end, management should be able to say who is responsible for each operation and where intervention is needed.

The inventory is a management tool. When a new tool is purchased or a process changes, it should help identify what needs to be reassessed. 13

2. Review purpose, access, and publication

Each use needs to be linked to its purpose and the appropriate legal basis. Consent is one of the bases provided for by the LGPD; it does not serve as blanket authorization for any use, and sensitive data have their own rules. 3

For publications, I propose separating the complete internal document from the version intended for release and adding a review before publication. The team should check unnecessary fields, attachments, filenames, and information that indirectly reveals a sensitive condition.

The ANPD’s guide for public authorities recommends reconciling transparency with data protection and limiting disclosure to what is necessary. 14 This consideration also helps companies prepare reports, selection results, and group communications: the fact that information is available internally calls for a fresh assessment before making it public.

3. Implement controls proportionate to the risk

The security guide for small-scale processing agents addresses access control, multifactor authentication, system updates, backups, training, and precautions concerning suppliers. 15 These provide references for defining what needs to work in practice, with assigned responsibilities and evidence of implementation.

Implementation can begin by reviewing old accounts, eliminating shared access credentials, defining permissions by role, and protecting environments that store more sensitive information. For backups, I also propose verifying whether recovery works and who can perform it.

The ANPD’s checklist brings together security measures and training guidance. 16 It can support the initial assessment. Its use needs to be accompanied by analysis: marking an item as complete should correspond to a verifiable practice.

4. Organize responsibilities and requests from data subjects

Define who receives requests from data subjects, how identity will be verified, who locates the information, and who responds. Also clarify the responsibilities of suppliers that store or process data on the company’s behalf. The ANPD’s guidance includes service channels and contract management. 1315

My proposal is to connect these responsibilities to the way the organization operates. Management approves priorities and resources; teams carry out routines; technology professionals implement controls; and legal advisers take part in matters that require legal analysis. This division needs to support collaboration and clear decisions.

5. Assess impact and monitor improvements

The Personal Data Protection Impact Assessment (RIPD) describes processing operations, risks, and safeguards. The ANPD recommends preparing one in high-risk contexts and may require it. There is no blanket obligation for every company to publish a RIPD; the requirement and its disclosure depend on the situation. 17

To monitor the compliance plan, I propose simple indicators: operations mapped, access rights reviewed, overdue actions, people trained, and incidents handled. They help management assess progress and keep the subject in view as systems, suppliers, or staff change.

Small businesses also need to comply

Resolution CD/ANPD No. 2/2022 provides accommodations for eligible small-scale processing agents, such as simplified records and an exemption from appointing a data protection officer, accompanied by a communication channel for data subjects. It also establishes different deadlines, including twice the usual period for incident notification when the applicable classification allows it. 18

These accommodations do not remove the principles, legal bases, and rights established by the LGPD. The regime depends on revenue, corporate group, and risk criteria; certain high-risk operations make an organization ineligible. 18

A small business can start with a focused assessment and a plan of priorities. The size of the team helps determine how the work will be organized, while the nature of the data and operations guides the level of care required.

How I can support your company’s compliance

LGPD compliance is a service I can provide to businesses, connecting management, processes, and technology. My proposal is to organize the work around the realities of the operation, with clear priorities and deliverables whose progress can be tracked.

Support can include an initial assessment, a data inventory, review of data flows and access, implementation of controls, organization of responses to data subjects, an incident response plan, and team training. Specific legal matters can be addressed together with the company’s legal advisers.

An initial project can deliver a map of operations, a list of priority risks, and an action plan with assigned responsibilities and deadlines. Continued work makes it possible to check implementation, adjust controls, and incorporate changes in the business.

If your company needs to structure this work, contact me to assess your situation and define a compliance plan.

The Feira de Santana case provides a concrete reference for that conversation: anyone receiving personal data makes decisions that affect other people’s lives. Responsible management makes that care visible in routines, systems, and the way the organization responds when something goes wrong.

Bibliographic references

Sources accessed on October 28, 2026. Information about the decision against Feira de Santana was taken from the ANPD’s official statement; this article does not assume full access to the case files or a final administrative decision with no further right of appeal.

1. FEIRA DE SANTANA. Prefeitura de Feira abrirá sindicância para apurar vazamento de dados. September 22, 2025.
2. ANPD. ANPD estabelece medidas corretivas à Prefeitura de Feira de Santana pelo vazamento de dados médicos de 1.200 pessoas. October 26, 2026.
3. BRASIL. Lei nº 13.709, de 14 de agosto de 2018 — LGPD. Updated text, particularly Articles 5, 7, 11, 24, and 52.
4. BRASIL. Lei nº 14.289, de 3 de janeiro de 2022. Confidentiality concerning the health conditions specified in the law.
5. CÂMARA MUNICIPAL DE FEIRA DE SANTANA. Associação de Pessoas Vivendo com HIV pede reparação, devido a divulgação de nomes. September 24, 2025.
6. FEIRA DE SANTANA. Secretaria Municipal de Mobilidade Urbana. Nota. September 21, 2025.
7. FEIRA DE SANTANA. Procuradoria-Geral do Município. Nota oficial. October 26, 2026.
8. ANPD. Resolução CD/ANPD nº 15, de 24 de abril de 2024. Security Incident Notification Regulation.
9. ANPD. Resolução CD/ANPD nº 4, de 24 de fevereiro de 2023. Regulation on the Calculation and Application of Administrative Sanctions.
10. ANPD. Sanções administrativas: o que muda após 1º de agosto de 2021?. July 30, 2021; updated October 31, 2022.
11. ANPD. ANPD publica regulamento de aplicação de sanções administrativas. February 27, 2023.
12. ANPD. Comunicação de Incidente de Segurança. Guidance and frequently asked questions; updated August 26, 2026.
13. ANPD. Perguntas frequentes. Section 5: LGPD compliance; updated September 9, 2026.
14. ANPD. Guia orientativo: tratamento de dados pessoais pelo Poder Público. Version 2.0. Brasília, June 2023.
15. ANPD. Guia orientativo sobre segurança da informação para agentes de tratamento de pequeno porte. Version 1.0, October 2021.
16. ANPD. Checklist de medidas de segurança para agentes de tratamento de pequeno porte.
17. ANPD. Relatório de Impacto à Proteção de Dados Pessoais — perguntas e respostas. Updated September 23, 2026.
18. ANPD. Resolução CD/ANPD nº 2, de 27 de janeiro de 2022. Regulation for small-scale processing agents, as subsequently amended.