Brazil Data Protection & Privacy Regulation

Cross-Border & Adequacy

Brazil's data protection authority is understood to have recognised the European Union as an adequate destination for international personal data transfers under the cross-border transfer provisions of the General Personal Data Protection Law, by way of a resolution reported as Resolução CD/ANPD nº 32/2026. If this recognition stands as reported, it would permit transfers of personal data from Brazil to the European Union without the need for an additional transfer mechanism such as standard contractual clauses or binding corporate rules — placing EU-bound transfers on the most permissive available footing under Brazilian law. This is reported with qualified rather than fully confirmed sourcing: the finding rests on a single secondary report, and the underlying authority resolution was not directly reviewed this period, so the precise scope of the recognition — whether it covers all transfers unconditionally, carries sectoral limits or carve-outs, or includes a built-in review or sunset date — is not yet established.

This development sits alongside the authority's broader standard-contractual-clause framework for international transfers, under which transfers to destinations without an adequacy finding generally require a recognised transfer mechanism. An adequacy finding for the European Union would meaningfully simplify compliance for organisations moving personal data between Brazil and EU member states, removing the administrative burden of contractual safeguards for flows that would otherwise need them.

Outlook

The practical significance of this adequacy recognition for organisations with EU-Brazil data flows will depend on confirmation of its precise scope and conditions, including whether the authority has attached any time limit or review mechanism. Until the underlying resolution text is confirmed in detail, organisations relying on the recognition should treat its boundaries as provisional rather than settled.

Cross-Border & Adequacy

Brazil received its first-ever adequacy decision this cycle. Following reciprocal decisions adopted 26 to 27 January 2026, personal data may flow between Brazil and the EU/EEA, including Iceland, Liechtenstein and Norway, without additional transfer safeguards such as Standard Contractual Clauses or Binding Corporate Rules. This is a confirmed, high-materiality development affecting the transfer mechanism landscape in both directions.

On the EU side, the European Commission adopted its adequacy decision on 26 January 2026 under GDPR Article 45, finding Brazil's LGPD-based framework essentially equivalent to EU data protection, and permitting EU-to-Brazil transfers without additional safeguards. On the Brazilian side, ANPD's Resolução CD/ANPD 32/2026, adopted 26 to 27 January 2026, formally recognises the European Union, covering all Member States plus Iceland, Liechtenstein and Norway, as providing adequate personal-data protection under LGPD Article 33(I). This recognition is subject to review every four years from the adoption date, and carries an explicit carve-out preserving the need for additional safeguards on transfers related to public security, national defence, or criminal investigation.

This reciprocal pairing of decisions is a structural, not episodic, development: it establishes for the first time a bilateral adequacy relationship that eliminates the routine transfer-mechanism burden for the large volume of EU-Brazil personal-data flows, while preserving a defined and narrow carve-out for security-sensitive categories.

Outlook

The adequacy decisions are due for review every four years from the January 2026 adoption date, placing the first formal review point in 2030. In the nearer term, watch for any sector-specific guidance clarifying how the public-security and criminal-investigation carve-out will be applied in practice.

Algorithmic, Biometric & Surveillance Governance

Two distinct developments define this module's material content this cycle. First, ANPD published a Report on Generative AI, understood to analyse the implications, risks and challenges associated with generative-AI technologies, representing the regulator's move into active engagement with AI-specific governance questions ahead of any dedicated AI-processing rule.

Second, and providing important enforcement-precedent context, in 2025 ANPD issued a preliminary order prohibiting Tools for Humanity, the operator of Worldcoin, from collecting iris scans in exchange for cryptocurrency in Brazil, backed by a daily fine of R$50,000 for non-compliance. This action is understood to demonstrate ANPD's willingness to halt biometric-data operations at a preliminary, pre-merits stage where mass-impact risk is present, notably occurring ahead of any dedicated biometric-data regulation, which remains a later-phase item on ANPD's 2025-2026 Regulatory Agenda, following data subject rights, DPIAs, government data-sharing and minors' data in the agenda's sequencing.

Read together, the generative-AI report and the Worldcoin biometric enforcement precedent indicate that ANPD is building governance capacity and enforcement precedent in the algorithmic and biometric space ahead of, rather than through, dedicated statutory rules specific to those categories.

Outlook

Dedicated biometric-data regulation remains a later-phase Regulatory Agenda item with an expected multi-year horizon; watch for whether the Worldcoin enforcement precedent is followed by further preliminary orders against other biometric-data operations pending that dedicated rule.

Children & Vulnerable Groups

The ANPD's Consulta Pública nº 1/2026, open for comment from 9 September to 26 October 2026, proposes revising the fiscalização and sanctioning regulation specifically to incorporate enforcement of the ECA Digital framework and the provider duties established under Decreto nº 12.975/2026. This is a proposal under public consultation and has not yet become a final rule, but it is understood to reflect the ANPD's intention to align its enforcement architecture with Brazil's child-specific digital-protection regime rather than relying solely on the LGPD's general lawful-processing requirements for children's data.

This consultation-stage development sits alongside the ANPD's September 2026 fine against ByteDance (TikTok), understood to have been imposed specifically for processing children's and adolescents' data without a lawful basis. Read together, the fine and the consultation point in the same direction: a regulator actively using its existing enforcement powers against children's-data violations while simultaneously seeking to formalise and expand those powers for future cases.

Outlook

The consultation closes 26 October 2026. Its outcome will determine whether ECA Digital and Decreto nº 12.975/2026 enforcement become formally incorporated into the ANPD's binding sanctioning regulation, which would give the regulator a more explicit procedural basis for children's-data enforcement actions going forward.

Children & Vulnerable Groups

ANPD fined ByteDance, operator of TikTok, BRL 153.7 million for violations of the Lei Geral de Protecao de Dados connected to the processing of minors' data. This is understood to be the largest single enforcement figure ANPD has issued to date, and it concentrates specifically on the children's-data area rather than on general LGPD compliance. Alongside the fine, digital platforms that target children are required to publish their first transparency report by 17 September 2026, a new disclosure obligation specific to platforms operating in this space.

The scale of the ByteDance fine, considered against ANPD's historical enforcement record, signals that children's-data processing has become a concentrated area of supervisory attention, consistent with the agency's broader institutional strengthening achieved through Lei 15.352/2026 earlier in the year.

Outlook

The 17 September 2026 transparency-report deadline has, as at this cycle, already passed; whether platforms targeting children in Brazil met that deadline, and how ANPD responds to any that did not, is the immediate development to watch in this area.

Enforcement & Redress

A public consultation on a draft resolution amending Brazil's enforcement and sanctioning regulation — the Regulamento de Fiscalização, which traces back to the authority's original 2021 enforcement procedure rules — ran from 9 September to 26 October 2026 and has now closed. The direction of travel reported from that consultation is toward expanding the investigative instruments available to the authority and accelerating the pace of enforcement action, though no adopted replacement regulation has been issued as of the close of the consultation: this remains a proposal under consideration rather than a binding change. This closure is reported with high confidence as to the fact and timing of the consultation itself, though the eventual content of any adopted text is not yet knowable from what has been reviewed.

This enforcement-reform process runs concurrently with the broader institutional expansion of the authority described elsewhere this period — its conversion into a full regulatory agency and its acquisition of competence over adjacent digital-governance regimes. Read together, these developments point toward an authority positioning itself for a more active enforcement posture: more investigative tools, potentially faster procedural timelines, and a wider institutional base from which to pursue cases, including in areas beyond the core data protection law.

Outlook

A revised fiscalização and sanctioning regulation is expected to be adopted within the final quarter of 2026, though the timing carries meaningful uncertainty and the adopted text may differ from the consultation draft. Organisations subject to Brazilian jurisdiction should expect investigations and enforcement actions to become more frequent and more procedurally efficient once any revised regulation takes effect, even though no new regulation is yet in force.

Enforcement & Redress

ANPD's 25 August 2026 decision against ByteDance, operator of TikTok, applied the LGPD's simple-fine cap under article 52, II, up to 2 percent of gross revenue limited to R$50 million per infraction, separately to five distinct LGPD infractions. The result was a combined sanction of R$153,769,671.33, alongside an order requiring data elimination. The decision is appealable to ANPD's Conselho Diretor within ten working days. This is reported as the operative benchmark for ANPD's enforcement reach to date.

Two regulatory processes have followed in the weeks since. First, ANPD published Aviso de Audiência Pública nº 3/2026 on 15 October 2026, opening a public hearing for 29 October 2026 on a draft Resolution amending the Regulamento de Dosimetria e Aplicação de Sanções Administrativas, currently Resolução CD/ANPD nº 4/2023, the methodology by which per-infraction fines such as the TikTok decision are calculated. This is a direct procedural follow-on from the visibility the TikTok decision generated. Second, and separately, ANPD opened a public consultation running 9 September to 26 October 2026, conducted exclusively through the Brasil Participativo platform, on a draft Resolution amending the Regulamento do Processo de Fiscalização e do Processo Administrativo Sancionador, currently Resolução CD/ANPD nº 1/2021. This draft is reported to propose broadening ANPD's investigative instruments and expanding the universe of firms it actively supervises; the primary consultation text was not independently opened this cycle, so the precise scope remains unconfirmed.

Outlook

The sanctions-dosimetry public hearing on 29 October 2026 and the inspection-process consultation closing 26 October 2026 are the two items to track. Together they indicate the regulator is actively formalising both how it calculates fines and how broadly it investigates, in the period immediately following its largest enforcement action to date.

Enforcement & Redress

The ANPD is understood to have fined ByteDance (TikTok) R$153.7 million in September 2026 for processing children's and adolescents' data without a lawful basis, accompanied by a data-elimination order and a compliance plan. This figure and date rest on secondary legal commentary; the exact ANPD decision or process number was not independently retrieved this cycle, so the fine amount and date should be read as reported rather than as directly confirmed against the primary ANPD decision.

Separately, the ANPD's Consulta Pública nº 1/2026, open through 26 October 2026, proposes expanded investigative powers for the regulator, including cautionary measures that may be applied without prior notice, through a revision of Resolução CD/ANPD nº 1/2021. This is a draft proposal under public consultation, not yet a final binding rule. Taken together with the ByteDance fine and the institutional autonomy granted to the ANPD under Lei nº 15.352/2026, the consultation suggests the regulator is seeking to formalise procedural tools that would support the kind of large-scale enforcement action it has already demonstrated the capacity to bring.

Outlook

The consultation on expanded investigative powers closes 26 October 2026. Given the regulator's demonstrated willingness to impose a record fine this cycle, the adoption of cautionary measures without prior notice would materially strengthen its practical enforcement toolkit going forward.

Enforcement & Redress

ANPD enforces LGPD with fines of up to BRL 50 million per violation and, following Lei no 15.352/2026, can now also order a business to cease operations as a supervisory measure. This cessation power sits on top of ANPD's existing fining authority and represents a materially stronger enforcement tool than monetary sanction alone. The agency's largest fine to date, BRL 153.7 million against ByteDance for minors'-data violations, demonstrates the scale at which ANPD is prepared to act even before accounting for the new cessation power.

Separately, ANPD opened a public consultation on 29 September 2026 reviewing its own administrative enforcement and sanctioning procedures, following a public hearing with 43 registered participants. This procedural review follows directly from, and may formalise, the practical exercise of the agency's strengthened powers described above.

Outlook

The procedural-review consultation's outcome will determine whether ANPD's sanctioning-regulation dosimetry methodology changes, and whether the agency's cessation power is accompanied by specific procedural safeguards or exercised under general statutory discretion. This is the clearest near-term indicator of how assertively ANPD intends to use its strengthened mandate going forward.

Enforcement & Redress

ANPD's enforcement activity escalated markedly this cycle across two concurrent matters. ANPD opened a supervisory proceeding against Claro, with Serasa notified for a parallel proceeding, alleging LGPD violations arising from the transfer of more than one hundred pieces of customer information per partnership. A potential fine of up to R$50 million, or 2 percent of the company's Brazilian revenue for the prior fiscal year, whichever is applicable, is in prospect, consistent with ANPD's standing statutory penalty ceiling under LGPD Article 52; the proceeding remains at a proposed, unresolved stage this cycle.

This proceeding lands alongside the separately reported R$153.77 million fine against a social-media platform for children's-data violations, described under Children & Vulnerable Groups, and both sit against the backdrop of ANPD's February 2026 conversion to full institutional autonomy under Law 15.352. ANPD's standing statutory powers include the ability to impose fines of up to 2 percent of Brazilian revenue capped at R$50 million per infraction, and to block databases, delete data, publicise violations, and suspend or prohibit processing activities; these powers pre-date this cycle but provide the statutory basis against which the newly opened Claro/Serasa proceeding and the sanctioned children's-data case should be read.

The concurrence of a large resolved fine and a newly opened, unresolved proceeding of comparable potential magnitude is itself a signal of a regulator operating at a materially higher enforcement tempo than in prior periods.

Outlook

The Claro/Serasa proceeding's resolution, whether by settlement, sanction, or dismissal, is the clearest near-term indicator of ANPD's post-autonomy enforcement trajectory; watch for its outcome and for the eventual fine amount relative to the R$50 million or 2 percent statutory ceiling.