Portuguese 
English 
Spanish 
3 min of reading 
0 comments 
More than 100 pieces of information per client would have been shared in a partnership analyzed by the agency, which now investigates transparency, necessity, and legal limits.
The National Data Protection Agency opened an administrative sanctioning process against Claro after identifying signs of problems in the sharing of consumers’ personal data with Serasa.
The measure was confirmed by the ANPD on June 8, 2026, and also involves Serasa, which will undergo a supervision procedure.
According to the agency, the investigation originated from a supervision of a partnership established between the two companies.
-
Starting January 1, 2027, a new tax will be levied on soft drinks, alcoholic beverages, and cigarettes: the government aims to reduce the consumption of harmful products and may directly affect the consumer price.
-
STF overturns minimum age for special retirement and historic decision could benefit thousands of workers exposed to harmful agents across Brazil
-
Court denies compensation to young man who lost his arm in a shark attack in Pernambuco: decision cites notorious risk area at Praia de Piedade, points to “exclusive fault of the victim” and reignites debate on signage, public responsibility, and swimming in Jaboatão dos Guararapes.
-
Pharmacy giant is fined R$ 10 million by the Maranhão Court for requiring CPF to grant discounts, pressuring consumers at the checkout, and raising a national alert about the collection of personal data in pharmaceutical retail.
Through this agreement, Claro provided customer data to Serasa to develop credit analysis methods and assess market conditions.
However, the ANPD pointed out signs of non-compliance with the General Data Protection Law, known as LGPD.
Supervision reveals possible excess in sharing
The ANPD’s investigation identified that Claro would have shared consumer information in a manner considered irregular.
In addition, the agency pointed out a lack of clarity in the information provided to customers.
There were also cited difficulties in accessing the operator’s data protection officer.
According to the ANPD’s Superintendent of Supervision, Fabrício Guimarães, more than 100 pieces of information from each client were shared by Claro with Serasa.
According to Guimarães, there is a limit for this type of operation, which should not be excessive.
Still according to him, the sharing needs to respect the principles of necessity, relevance, and transparency.
Partnership between Claro and Serasa came under LGPD scrutiny
The analyzed partnership provided for the use of data for credit analysis and market evaluations.
The ANPD understood that there were problems in the way this information was handled.
The agency requested clarifications from the companies during the supervision.
After these requests for information, according to Fabrício Guimarães, the companies terminated the contract.
Even so, the process against Claro will continue to investigate whether there were violations of the LGPD.
Fine can reach R$ 50 million per infraction
If the irregularities are confirmed, Claro may receive sanctions provided for in the LGPD.
Among the possible penalties is a fine of up to R$ 50 million per infraction.
The legislation also allows a fine of up to 2% of the company’s revenue.
ANPD issued guidelines to Claro regarding data sharing contracts.
These guidelines must be observed in existing agreements and also in future partnerships of the company.
Serasa will also be monitored by the agency
Meanwhile, Serasa will be analyzed in a specific monitoring procedure.
ANPD will verify the level of transparency offered to data holders.
The agency will also observe which tools the company provides for exercising the rights provided for in the LGPD.
It will also be evaluated whether the privacy policy informs which entities share data with Serasa.
Similarly, the monitoring will verify if the document clarifies with which third parties these data are shared.
Complaints put Serasa in the spotlight in monitoring
According to the most recent monitoring cycle of ANPD, Serasa led the number of complaints received by the agency.
The survey considers the period between the second half of 2023 and the first half of 2025.
The company also appears in second position in the number of complaints registered with ANPD.
If new irregularities are identified, Serasa’s case may advance to a sanctions phase.
Defense period has already started
Claro and Serasa have 10 business days, counted from the receipt of the notification, to present their statements.
The absence of a response within the deadline may be interpreted as obstruction.
Therefore, the case highlights the limits of using personal data in commercial partnerships.
At the same time, it reinforces the importance of transparency, necessity, and clarity in handling consumer information.
Do you believe that companies should have even stricter rules for sharing customers’ personal data with commercial partners?
Be the first to react!