--- title: "Brazil Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/brazil/ source_html: /jurisdictions/brazil/index.html description: "Brazil data protection and privacy regulation: 10 categories, 133 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: ce25ad6f9fd5f10b397edc3aa02aaa3c9effea6024a8ceff58296311caf049df generator: "fe-fleet/md-twin@1.0" --- # Brazil Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/brazil/), [World Payments](https://payments.gi/jurisdictions/brazil/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 133 claims · 112 sources in the cumulative register Download report (PDF) Expand all Brazil and the European Union adopted mutual adequacy decisions on 26 January 2026, Brazil's first-ever adequacy decision. Data collected 2026-11-02 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Cross-Border & Adequacy, Enforcement & Redress (5 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=BRAZIL)[Build Report](/reports/?j=BRAZIL)[Compare](/compare/?j=BRAZIL) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Agência Nacional de Proteção de Dados (ANPD) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) 2026-10-26 ANPD fiscalização-regulation public consultation closes Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 133 Claims 0 Tier-1 sources Traffic-light mix 4 green 6 amber (sums to 10 rendered categories; click to filter) No red categories; 10 sub-modules are flagged red. ## Jurisdiction brief Jurisdiction lead brief 1,143 Full executive summary 819 ###### Latest update · 18 October 2026 #### Lead Signal Brazil's Autoridade Nacional de Proteção de Dados is actively recalibrating its own sanctions methodology in the aftermath of its largest enforcement action to date. ANPD published Aviso de Audiência Pública nº 3/2026 in the Diário Oficial da União on 15 October 2026, announcing a virtual public hearing scheduled for 29 October 2026, with enrolment running 15 to 24 October 2026, on a draft Resolution amending the Regulamento de Dosimetria e Aplicação de Sanções Administrativas, the methodology by which the regulator calculates per-infraction fines. The timing follows closely on ANPD's 25 August 2026 decision against ByteDance, operator of TikTok, which applied the LGPD's simple-fine cap, up to 2 percent of gross revenue, limited to R$50 million per infraction, separately to five distinct infractions, producing a combined sanction of R$153,769,671.33 alongside a data-elimination order. The sequence suggests the regulator intends to formalise and defend its dosimetry approach going forward, following public attention to how the fine was calculated. #### Other Developments ANPD's institutional status remains unchanged but structurally significant. Lei nº 15,352/2026, published 25 February 2026, converted the ANPD into an autarquia de natureza especial linked to the Ministério da Justiça e Segurança Pública, with functional, technical, decision-making, administrative and financial autonomy and its own staffing career structure. This institutional conversion is not a this-cycle development but remains the operative framework underlying the regulator's current enforcement and rulemaking activity, including the sanctions-dosimetry hearing described above. A separate consultation would broaden ANPD's investigative powers. ANPD opened a public consultation running from 9 September to 26 October 2026, conducted exclusively via the Brasil Participativo platform, on a draft Resolution amending the Regulamento do Processo de Fiscalização e do Processo Administrativo Sancionador, the regulation governing ANPD's inspection and sanctioning processes. The draft is reported to propose broadening the regulator's investigative instruments and expanding the universe of firms it actively supervises. The primary consultation text was not independently opened this cycle, so the precise scope of the proposed changes is not yet confirmed. #### Cross-Monitor Connections The ANPD sanctions-dosimetry recalibration and the TikTok decision's data-elimination order carry commercial-privacy and adtech-adjacent significance that a dedicated adtech-and-commercial-privacy reading would develop further; this brief does not analyse that dimension directly and flags it for the relevant monitor to pick up where evidence supports it. #### Outlook The ANPD public hearing on the sanctions-dosimetry Resolution is scheduled for 29 October 2026, following enrolment from 15 to 24 October 2026; its outcome will determine whether the methodology applied in the TikTok decision, treating multiple infractions as separately subject to the per-infraction fine cap, becomes formalised regulatory practice. The parallel consultation on ANPD's inspection and sanctioning process regulation runs until 26 October 2026. Both processes, together, point toward an enforcement architecture that is actively being strengthened and formalised rather than one that has settled into a stable, unchanging posture. 3 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Brazil and the European Union adopted mutual adequacy decisions on 26 January 2026, Brazil's first-ever adequacy decision. Legal commentary describes it as the most comprehensive adequacy decision adopted by the EU under the GDPR. ANPD Resolution CD/ANPD No. 32/2026 recognises the European Union as providing an adequate level of personal-data protection for the purposes of LGPD Article 33(I), permitting Brazil-to-EU transfers without additional safeguards. European Commission Implementing Decision (EU) 2026/179 found Brazil's LGPD-based data-protection framework essentially equivalent to the GDPR, permitting EU-to-Brazil transfers without additional transfer tools. The mutual arrangement excludes transfers made exclusively for public security, national defense, state security, or criminal investigation and prosecution, and imposes no restrictions on categories of personal data eligible for simplified transfer nor any mandated technical or contractual mechanism. #### Other Developments Brazil's data protection authority, ANPD, became a fully independent regulatory agency in February 2026 under Law 15.352, having previously operated under the Presidency and then the Ministry of Justice. Constitutional Amendment EC 115/2022 elevated personal data protection to a fundamental right under Article 5, LXXIX of Brazil's Federal Constitution. The LGPD applies to any organisation that processes personal data of individuals located in Brazil, regardless of where the organisation is based. Enforcement activity has escalated sharply through 2024 and 2025, moving from an educational stance toward active sanctioning. Named actions include a Meta fine running at BRL 50,000 per day, a Worldcoin-related action, and the ANPD's first-ever fine in 2023 of BRL 14,400 over telemarketing and political-data misuse. Under LGPD Article 52, the ANPD may impose fines of up to 2% of a company's Brazilian revenue for the prior fiscal year, capped at BRL 50 million per infraction, alongside warnings, corrective-measure orders, daily fines, public disclosure, and database blocking, deletion, or processing suspension or prohibition. LGPD controllers face a 15-day statutory window to respond to data-subject requests, and ANPD's 2025/early-2026 enforcement activity flagged failure to meet this window among foreign publishers. Under LGPD Article 18, individuals hold nine distinct rights, including access, correction, anonymisation, portability, deletion, and information about third-party data sharing. ANPD enforcement in the adtech and commercial-privacy space has clustered around ambiguous or absent consent banners and the absence of a Portuguese-language privacy notice, with foreign publishers cited. Cross-border data transfers lacking a valid mechanism have also been cited among foreign publishers as a recurring violation, a gap now partly addressed by the newly adopted EU-Brazil adequacy decision. ANPD published a Report on Generative AI analysing the implications, risks and challenges of generative-AI technologies for LGPD compliance, with enforcement in this area anticipated. Standard Contractual Clauses remain the central transfer mechanism for Brazil-linked international transfers falling outside the scope of a granted or received adequacy decision. #### Cross-Monitor Connections BACEN Resolution 4.658/2019 sets specific data-security requirements for financial institutions processing data in cloud environments, including requirements for data stored abroad — a provision that intersects with the financial-integrity monitor's coverage of VASP and AML architecture; readers tracking that beat should note the overlap rather than expect duplicated analysis here. The LGPD's extraterritorial application to any organisation processing personal data of individuals located in Brazil is also flagged as relevant to the world-payments monitor's payments-specific tracking; that connection is noted for cross-reference rather than analysed in depth in this brief. No crypto- or on-chain-specific personal-data finding surfaced this cycle beyond the general LGPD extraterritorial-scope baseline already covered above. #### Outlook The concurrent arrival of full regulatory independence for ANPD, an escalating enforcement record, and a landmark mutual adequacy arrangement with the EU points toward a maturing and increasingly assertive Brazilian data-protection regime that is simultaneously liberalising cross-border data flows and tightening domestic enforcement. ANPD's recent Report on Generative AI signals anticipated enforcement interest in AI-adjacent processing as a next area of regulatory attention. Coverage gaps remain around DPIA, ROPA, and joint-controller specifics, and around children-and-vulnerable-groups developments, which were not independently re-sourced this cycle. Read full brief · 1143 words ###### Latest update · 4 November 2026 #### Regulatory Status Brazil's data protection landscape this period is defined by institutional consolidation at the regulatory authority rather than by change to the substantive data protection law text. The authority is understood to have been converted into a full regulatory agency with special-nature autarky status and a dedicated enforcement career track, and to have received delegated competence over two adjacent digital-governance regimes — internet application providers' duties under the Marco Civil da Internet and the digital-violence-against-women protection framework — via separate decrees. Neither decree is reported as altering the General Personal Data Protection Law's substantive obligations. On cross-border transfers, the authority is understood to have recognised the European Union as offering an adequate level of protection for international personal data transfers, which — if the scope holds as reported — would allow EU-bound transfers without an additional transfer mechanism. The precise conditions attached to that recognition, including any sectoral limits or review date, remain to be confirmed against the underlying resolution text. On enforcement, a public consultation on revising the authority's fiscalização and sanctioning regulation closed on 26 October 2026, with the reported direction being to expand investigative instruments and accelerate enforcement timelines. No replacement regulation has yet been adopted. #### Outlook The combination of institutional expansion, broadened supervisory competence and a pending enforcement-procedure overhaul suggests Brazil's data protection authority is moving toward a more assertive regulatory posture heading into 2027, even as the core substantive data protection law remains unchanged this period. A revised enforcement regulation is anticipated in the final quarter of 2026, and the scope of the European Union adequacy recognition should be treated as provisional pending confirmation of the underlying instrument's full text. 3 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 #### Regulatory Status Brazil's data protection authority, ANPD, became a fully independent regulatory agency in February 2026 under Law 15.352, having previously operated under the Presidency and then the Ministry of Justice, against a constitutional backdrop in which Constitutional Amendment EC 115/2022 elevated personal data protection to a fundamental right under Article 5, LXXIX of Brazil's Federal Constitution. The LGPD applies to any organisation that processes personal data of individuals located in Brazil, regardless of where the organisation is based, and recognises ten lawful bases for processing, including a unique 'credit protection' basis not found in the GDPR. Under LGPD Article 18, individuals hold nine distinct rights, including access, correction, anonymisation, portability, deletion, and information about third-party data sharing, and controllers face a 15-day statutory window to respond to data-subject requests. Controllers must appoint a Data Protection Officer (Encarregado) and publish the DPO's contact information in an accessible privacy notice, and LGPD compliance guidance identifies a 2-day ANPD breach-notification standard. In the financial sector, BACEN Resolution 4.658/2019 sets specific data-security requirements for financial institutions processing data in cloud environments, including requirements for data stored abroad. Brazil and the European Union adopted mutual adequacy decisions on 26 January 2026, Brazil's first-ever adequacy decision. ANPD Resolution CD/ANPD No. 32/2026 recognises the European Union as providing an adequate level of personal-data protection for the purposes of LGPD Article 33(I), and European Commission Implementing Decision (EU) 2026/179 found Brazil's LGPD-based framework essentially equivalent to the GDPR — described by legal commentary as the most comprehensive adequacy decision adopted by the EU under the GDPR. The arrangement excludes transfers made exclusively for public security, national defense, state security, or criminal investigation and prosecution, and outside its scope, Standard Contractual Clauses remain the central transfer mechanism. ANPD enforcement activity has escalated sharply through 2024 and 2025, moving from an educational stance toward active sanctioning, including a Meta fine running at BRL 50,000 per day, a Worldcoin-related action, and the ANPD's first-ever fine in 2023 of BRL 14,400 over telemarketing and political-data misuse. Under LGPD Article 52, the ANPD may impose fines of up to 2% of a company's Brazilian revenue for the prior fiscal year, capped at BRL 50 million per infraction, alongside warnings, corrective-measure orders, daily fines, public disclosure, and database blocking, deletion, or processing suspension or prohibition. ANPD enforcement has also clustered around ambiguous or absent consent banners, the absence of a Portuguese-language privacy notice, and cross-border transfers lacking a valid mechanism, with foreign publishers repeatedly cited. Separately, ANPD published a Report on Generative AI analysing the implications, risks and challenges of generative-AI technologies for LGPD compliance, with enforcement in this area anticipated. #### Outlook Brazil's data-protection posture this cycle is simultaneously liberalising and tightening: cross-border data flows with the EU are now materially simplified under the mutual adequacy arrangement, while ANPD's own institutional independence and enforcement activity both escalate. This combination signals a maturing, increasingly assertive regulator whose forward agenda includes generative-AI-adjacent processing. Coverage gaps remain around DPIA, ROPA, and joint-controller specifics, and around children-and-vulnerable-groups developments, which were not independently re-sourced this cycle. Read full brief · 819 words Key regulatory facts for Brazil Regulatory Dimension Brazil Standing Position Jurisdiction Brazil (BR) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 133 sourced findings) Regulator & Framework Comprehensive omnibus statute in force since 2020 with an increasingly empowered, independent regulator; core scope/authority questions are settled. Lawful Processing & Special Data Legal basis and sensitive-data regimes are well-settled statutory provisions with several years of ANPD/court interpretation. Data Subject Rights Rights catalogue is comprehensive and in force, though some response-timeline specifics are left to case-by-case ANPD regulation. Controller/Processor Duties Core duties are legislated and increasingly detailed by ANPD resolutions (DPO, breach, dosimetry), but explicit statutory retention/disposal timelines remain unresolved and enforcement of Art. Primary Instruments Cited IAPP, IAPP, OneTrust DataGuidance, togetherprivacy.tech, confidata.com.br Last Confirmed / Updated 2026-11-04 (112 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Brazil: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Comprehensive omnibus statute in force since 2020 with an increasingly empowered, independent regulator; core scope/authority questions are settled. Primary framework Lei Geral de Proteção de Dados Pessoais (LGPD) — Law No. 13.709/2018, as amended by Law No. 13.853/2019 and Provisional Measure No. 1.317/2025 Supervisory authority [Agência Nacional de Proteção de Dados (ANPD)](https://www.gov.br/anpd/) Traffic-light rationale — Green Comprehensive omnibus statute in force since 2020 with an increasingly empowered, independent regulator; core scope/authority questions are settled. #### Sub-modules (5) #### Regulator And AuthorityGreen ANPD, created by LGPD Art. 55-A and structured by Decree 10.474/2020, was converted into an independent regulatory agency by Provisional Measure 1.317/2025, aligning it with other Brazilian regulatory agencies and granting police-style enforcement powers. Claims (8): - Provisional Measure No. 1.317/2025 transformed ANPD into the National Data Protection Agency, guaranteeing functional, technical, decision-making, administrative and financial autonomy. - The provisional measure grants ANPD strengthened enforcement powers, including ordering establishments to cease operations, seizing goods, and requesting police assistance in cases of obstruction. - ANPD — Converted into regulatory agency - ANPD — Transformed into a special-nature autarky and regulatory agency with a dedicated Carreira de Regulação e Fiscalização de Proteção de Dados career track - Lei nº 15.352/2026 — Sanctioned 25 February 2026, converts ANPD's independent-agency status (first conferred by MP 1.317/2025, Sept 2025) into permanent law, with strengthened enforcement powers including the ability to order businesses to cease operations. - A single trade-press source reports that Lei nº 15.352/2026 transformed ANPD from a special agency into a full regulatory agency; this is unverified against a primary source. - Autoridade Nacional de Proteção de Dados (ANPD) — Lei nº 15.352/2026 (published 25 Feb 2026) converted the ANPD into an autarquia de natureza especial, vinculada ao Ministério da Justiça e Segurança Pública, with functional, technical, decision-making, administrative and financial autonomy and its own staffing career. - Autoridade Nacional de Proteção de Dados (ANPD) — The February 2026 conversion of Provisional Measure 1.317/2025 into Law 15.352 gave ANPD full functional, technical, decisional, administrative and financial autonomy as a regulatory agency. #### Act And InstrumentsGreen The LGPD (65 articles) is the primary instrument, heavily influenced by GDPR, supplemented by numerous ANPD resolutions (DPO, breach notification, international transfers, dosimetry, small agents) and sector rules. Claims (3): - The LGPD comprises 65 articles and was greatly influenced by the EU GDPR, providing legal bases authorizing personal data use across all economic sectors. - Decreto nº 12.975/2026 and Decreto nº 12.976/2026 — Decreto 12.975/2026 assigns ANPD regulatory/supervisory/investigative functions over internet-application providers' duties under the Marco Civil da Internet; Decreto 12.976/2026 assigns equivalent competence over the digital-violence-against-women protection regime - ANPD (Conselho Diretor) — Published Aviso de Audiência Pública nº 3/2026 in the DOU on 15 October 2026, announcing a virtual public hearing on 29 October 2026 (enrolment 15-24 October 2026) on a draft Resolution amending the Regulamento de Dosimetria e Aplicação de Sanções Administrativas. #### Material ScopeGreen LGPD applies to processing of personal data by any natural or legal person, public or private, online or offline, with limited exceptions (journalistic/artistic/academic purposes, public safety, national defense, criminal investigation). Claims (1): - LGPD applicability is not limited by business size; exceptions apply only to journalistic, artistic, academic, public-safety and national-defense purposes. #### Territorial ScopeGreen Article 3 gives the LGPD extraterritorial reach: any processing carried out in Brazil, or aimed at offering goods/services to individuals in Brazil, triggers applicability regardless of the controller's country of establishment. Claims (3): - Under Article 3, a personal data processor is subject to the LGPD when data are collected or processed in Brazil, or processed to offer goods/services to individuals in Brazil, irrespective of where the controller is headquartered. - LGPD (Lei nº 13.709/2018) — LGPD applies to any processing in Brazilian territory, aimed at offering/supplying goods or services to individuals in Brazil, or involving personal data collected in Brazil, regardless of means, controller seat or storage location. - LGPD (Lei nº 13.709/2018) — LGPD does not require a foreign controller/processor without establishment in Brazil to appoint a local representative; a Brazilian branch/office, where it exists, is the valid recipient of notifications, but this does not fill the absence of a GDPR-style representative duty. #### Regulator Registration And FilingAmber There is no general controller-registration regime, but ANPD Resolution 02/2022 (small-scale agents) and a simplified ROPA template create lighter-touch filing/record obligations for small processing agents. Claims (3): - ANPD developed a simplified ROPA (record of processing activities) template for small-scale processing agents under the small-agents regulation approved by Resolution CD/ANPD No. 02/2022. - Open Finance participants must appoint a DRC officer who prepares semi-annual data-sharing reports under arts 16-17 of Resolução Conjunta BCB/CMN nº 1/2020, as at 2020-06-01. - Resolução Conjunta BCB/CMN nº 21/2026, published 2026-10-27, requires Open Finance institutions with existing Art 36 partnership contracts to send the Central Bank the list of partner entities by 1 December 2026. Brazil's data protection framework is anchored in the LGPD (Law 13.709/2018, as amended by Law 13.853/2019), enforced by ANPD, which in September 2025 was upgraded from a transitional federal-administration body into an autonomous 'National Data Protection Agency' via Provisional Measure 1.317/2025, gaining functional, technical, decision-making, administrative and financial autonomy. The law applies extraterritorially and covers virtually all sectors and processing operations with narrow carve-outs. Periodic update · new data 2026-11-04 #### Regulator & Framework Brazil's data protection authority is understood to have been converted into a full regulatory agency of special-nature autarky status, with a dedicated career track for regulation and enforcement staff created under the legislation attributed to Lei nº 15.352/2026. This is reported with qualified confidence rather than fully confirmed sourcing, but it marks a structural shift from the authority's earlier footing: the move cements its institutional independence and resourcing in a way that is likely to support a more assertive posture across its mandate going forward. The change also touches the authority's own legal nature as addressed within the General Personal Data Protection Law framework, rather than amending the substantive obligations that controllers and processors face. Alongside this institutional change, two decrees reported for this period extend the authority's reach into areas adjacent to its core mandate. One decree is understood to assign it regulatory, supervisory and investigative functions over internet application providers' duties under the Marco Civil da Internet (Brazil's internet civil rights framework); a second is understood to give it equivalent competence over the digital-violence-against-women protection regime. Neither decree is reported as amending the General Personal Data Protection Law's substantive text itself, so the practical effect is an expansion of the authority's supervisory footprint into neighbouring digital-governance regimes rather than a change to data processing obligations themselves. Reporting on both decrees carries only hedged confidence at this point, reflecting that the underlying instruments were not directly reviewed this period. #### Outlook Taken together, the agency conversion and the two competence-expanding decrees point to an authority consolidating its institutional standing and broadening its remit beyond the strict data protection law context into general internet governance and online safety enforcement. Organisations operating platforms or applications reachable from Brazil should expect the authority's institutional weight — and the range of regimes it can be asked to supervise — to grow rather than contract over the near term. The scope and practical mechanics of the two decrees' delegated competence remain to be clarified in implementing guidance. 5 earlier distinct update(s) Periodic update · new data 2026-11-03 #### Regulator & Framework The Autoridade Nacional de Proteção de Dados operates under its institutional structure established by Lei nº 15,352/2026, published 25 February 2026, which converted the ANPD into an autarquia de natureza especial, linked to the Ministério da Justiça e Segurança Pública, with functional, technical, decision-making, administrative and financial autonomy and its own career structure for staff. This institutional status is unchanged as and remains the operative framework underlying the regulator's current activity. Against that stable institutional backdrop, ANPD published Aviso de Audiência Pública nº 3/2026 in the Diário Oficial da União on 15 October 2026, grounded in article 10 of Lei nº 13,848/2019, announcing a virtual public hearing on 29 October 2026, with enrolment open from 15 to 24 October 2026. The hearing concerns a draft Resolution amending the Regulamento de Dosimetria e Aplicação de Sanções Administrativas, the instrument governing how the regulator calculates administrative sanctions. The full text and scope of the Aviso was not directly opened this cycle; this account relies on a news aggregator's report of the Diário Oficial notice rather than the primary gazette text itself. #### Outlook The public hearing on the sanctions-dosimetry Resolution is scheduled for 29 October 2026, with enrolment closing 24 October 2026. Whether the resulting Resolution changes the per-infraction fine-calculation approach applied in ANPD's recent enforcement decisions is the item to watch. Periodic update · new data 2026-10-18 #### Regulator & Framework The Autoridade Nacional de Proteção de Dados operates under its institutional structure established by Lei nº 15,352/2026, published 25 February 2026, which converted the ANPD into an autarquia de natureza especial, linked to the Ministério da Justiça e Segurança Pública, with functional, technical, decision-making, administrative and financial autonomy and its own career structure for staff. This institutional status is unchanged as at this cycle and remains the operative framework underlying the regulator's current activity. Against that stable institutional backdrop, ANPD published Aviso de Audiência Pública nº 3/2026 in the Diário Oficial da União on 15 October 2026, grounded in article 10 of Lei nº 13,848/2019, announcing a virtual public hearing on 29 October 2026, with enrolment open from 15 to 24 October 2026. The hearing concerns a draft Resolution amending the Regulamento de Dosimetria e Aplicação de Sanções Administrativas, the instrument governing how the regulator calculates administrative sanctions. The full text and scope of the Aviso was not directly opened this cycle; this account relies on a news aggregator's report of the Diário Oficial notice rather than the primary gazette text itself. #### Outlook The public hearing on the sanctions-dosimetry Resolution is scheduled for 29 October 2026, with enrolment closing 24 October 2026. Whether the resulting Resolution changes the per-infraction fine-calculation approach applied in ANPD's recent enforcement decisions is the item to watch. Periodic update · new data 2026-10-11 #### Regulator & Framework Lei nº 15.352/2026, in force since 25 February 2026, transformed the ANPD from a body linked to the Presidency of the Republic into an autonomous regulatory agency possessing its own legal personality and financial autonomy, with an expanding staff. This is understood to represent a significant structural shift in the regulator's institutional standing, moving it toward the model of other autonomous Brazilian regulatory agencies rather than the presidentially-linked structure it previously held. The practical consequence of this institutional change is still unfolding. An expanded staff complement is understood to support the kind of large-scale investigative and sanctioning activity the ANPD has demonstrated this cycle, including its record fine against ByteDance (TikTok). The ANPD's own fiscalização-sanctioning regulation is separately under public consultation (Consulta Pública nº 1/2026, open through 26 October 2026), proposing to incorporate enforcement of the ECA Digital framework and Decreto nº 12.975/2026 provider duties, and to expand the regulator's investigative powers. Together, the institutional autonomy granted by Lei nº 15.352/2026 and the proposed procedural expansion under consultation point toward a regulator consolidating both independence and practical enforcement reach. #### Outlook The consultation revising the ANPD's fiscalização regulation closes 26 October 2026. Whether the proposed procedural changes, including investigative powers and cautionary measures without prior notice, are adopted will determine how far the regulator's newly autonomous status translates into expanded practical authority. Periodic update · new data 2026-10-04 #### Regulator & Framework Lei no 15.352/2026, sanctioned 25 February 2026, converts the Autoridade Nacional de Protecao de Dados's independent-agency status into permanent law. That status had first been conferred on a provisional basis by Medida Provisoria 1.317/2025 in September 2025, meaning the question of ANPD's institutional durability sat unresolved by ordinary legislation for roughly five months before this conversion. The new law is understood to carry strengthened enforcement powers, including the ability for ANPD to order a business to cease operations as a supervisory measure, though the precise staging of these new powers has not been verified against ANPD's own text this cycle. This institutional settlement arrives at a moment when ANPD has also issued its largest enforcement figure to date, a BRL 153.7 million fine against ByteDance for minors'-data violations, suggesting the agency is moving to exercise its strengthened mandate actively rather than treating the legislative conversion as a purely formal milestone. #### Outlook Whether Lei 15.352/2026 altered any substantive data protection officer, data protection impact assessment, or breach-notification threshold, as distinct from institutional and governance status alone, has not been established in sourcing available this cycle and is a gap worth monitoring as implementation guidance or ANPD commentary clarifies the law's practical scope. Periodic update · new data 2026-09-21 #### Regulator & Framework Brazil's data-protection regulator underwent a structural institutional change this cycle. The February 2026 conversion of Provisional Measure 1.317/2025 into Law 15.352 gave the Autoridade Nacional de Proteção de Dados full functional, technical, decisional, administrative and financial autonomy as a regulatory agency. This is understood, per secondary legal-press reporting, to end approximately five years during which ANPD's enforcement posture had been largely educational rather than punitive in character. The finding is assessed at probable confidence: no gov.br or planalto.gov.br primary text of Law 15.352 was reached this cycle, and sourcing rests on legal-press coverage rather than the statute itself. The practical significance of this conversion is that it removes structural constraints, tied to ANPD's prior status, that had limited its capacity to act with full regulatory independence, including budgetary and administrative autonomy from the broader federal executive structure. This institutional change sits alongside, and plausibly helps explain, the marked escalation in enforcement activity landing in the same period, including the large children's-data fine and the newly opened Claro/Serasa proceeding described elsewhere in this cycle's findings. #### Outlook The clearest indicator to watch is whether ANPD's enforcement tempo, evident in the fines and proceedings recorded this cycle, continues at pace now that the institutional-autonomy conversion is complete, and whether a primary-source text of Law 15.352 becomes available to confirm the specific scope of the new autonomy. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (18) - [IAPP](https://iapp.org/news/a/anpd-becomes-regulatory-agency-a-turning-point-for-brazilian-data-protection-compliance) — Provisional Measure No. 1.317/2025 transformed ANPD into the National Data Protection Agency, guaranteeing functional, technical, decision-making, administrative and financial autonomy. - [IAPP](https://iapp.org/news/a/anpd-becomes-regulatory-agency-a-turning-point-for-brazilian-data-protection-compliance) — The provisional measure grants ANPD strengthened enforcement powers, including ordering establishments to cease operations, seizing goods, and requesting police assistance in cases of obstruction. - [IAPP](https://iapp.org/news/a/an-overview-of-brazils-lgpd) — The LGPD comprises 65 articles and was greatly influenced by the EU GDPR, providing legal bases authorizing personal data use across all economic sectors. - [IAPP](https://iapp.org/news/a/an-overview-of-brazils-lgpd) — LGPD applicability is not limited by business size; exceptions apply only to journalistic, artistic, academic, public-safety and national-defense purposes. - [IAPP](https://iapp.org/news/a/an-overview-of-brazils-lgpd) — Under Article 3, a personal data processor is subject to the LGPD when data are collected or processed in Brazil, or processed to offer goods/services to individuals in Brazil, irrespective of where the controller is headquartered. - [OneTrust DataGuidance](https://www.dataguidance.com/news/brazil-anpd-requests-public-comments-draft-ropa) — ANPD developed a simplified ROPA (record of processing activities) template for small-scale processing agents under the small-agents regulation approved by Resolution CD/ANPD No. 02/2022. - [togetherprivacy.tech](https://togetherprivacy.tech/blog/consulta-publica-da-anpd-fiscalizacao) — ANPD — Converted into regulatory agency - [confidata.com.br](https://confidata.com.br/blog/lgpd-atualizada-2026-o-que-mudou) — Decreto nº 12.975/2026 and Decreto nº 12.976/2026 — Decreto 12.975/2026 assigns ANPD regulatory/supervisory/investigative functions over internet-application providers' duties under the Marco Civil da Internet; Decreto 12.976/2026 assigns equivalent competence over the digital-violence-against-women protection regime - [togetherprivacy.tech](https://togetherprivacy.tech/blog/consulta-publica-da-anpd-fiscalizacao) — ANPD — Transformed into a special-nature autarky and regulatory agency with a dedicated Carreira de Regulação e Fiscalização de Proteção de Dados career track - [confidata.com.br](https://confidata.com.br/blog/lgpd-atualizada-2026-o-que-mudou) — Lei nº 15.352/2026 — Sanctioned 25 February 2026, converts ANPD's independent-agency status (first conferred by MP 1.317/2025, Sept 2025) into permanent law, with strengthened enforcement powers including the ability to order businesses to cease operations. - [Tribunal de Justiça do Distrito Federal e dos Territórios](https://www.tjdft.jus.br/institucional/imprensa/campanhas-e-produtos/direito-facil/edicao-semanal/lei-geral-de-protecao-de-dados-lgpd) — LGPD (Lei nº 13.709/2018) — LGPD applies to any processing in Brazilian territory, aimed at offering/supplying goods or services to individuals in Brazil, or involving personal data collected in Brazil, regardless of means, controller seat or storage location. - [Consultor Jurídico (Conjur)](https://www.conjur.com.br/2023-abr-01/opiniao-lgpd-ausencia-figura-representante/) — LGPD (Lei nº 13.709/2018) — LGPD does not require a foreign controller/processor without establishment in Brazil to appoint a local representative; a Brazilian branch/office, where it exists, is the valid recipient of notifications, but this does not fill the absence of a GDPR-style representative duty. - [Silva Lopes Advogados](https://silvalopes.adv.br/open-finance-e-lgpd-regras-que-participantes-devem-observar/) — Open Finance participants must appoint a DRC officer who prepares semi-annual data-sharing reports under arts 16-17 of Resolução Conjunta BCB/CMN nº 1/2020, as at 2020-06-01. - [Carmelitas Contabilidade](https://carmelitas.com.br/2026/10/27/open-finance-tem-novas-regras-em-2026-entenda-o-consentimento-de-dados-e-os-impactos-para-empresas/) — Resolução Conjunta BCB/CMN nº 21/2026, published 2026-10-27, requires Open Finance institutions with existing Art 36 partnership contracts to send the Central Bank the list of partner entities by 1 December 2026. - [Turivius](https://turivius.com/portal/multas-da-lgpd/) — A single trade-press source reports that Lei nº 15.352/2026 transformed ANPD from a special agency into a full regulatory agency; this is unverified against a primary source. - [fcm.law](https://fcm.law/en/regulamento-de-fiscalizacao-da-anpd/privacidade-protecao-de-dados/) — ANPD (Conselho Diretor) — Published Aviso de Audiência Pública nº 3/2026 in the DOU on 15 October 2026, announcing a virtual public hearing on 29 October 2026 (enrolment 15-24 October 2026) on a draft Resolution amending the Regulamento de Dosimetria e Aplicação de Sanções Administrativas. - [confidata.com.br](https://confidata.com.br/blog/lgpd-atualizada-2026-o-que-mudou) — Autoridade Nacional de Proteção de Dados (ANPD) — Lei nº 15.352/2026 (published 25 Feb 2026) converted the ANPD into an autarquia de natureza especial, vinculada ao Ministério da Justiça e Segurança Pública, with functional, technical, decision-making, administrative and financial autonomy and its own staffing career. - [Compliance Week](https://www.complianceweek.com/best-practices/brazils-national-data-protection-authority-how-regulators-investigate-and-enforce-its-data-protection-law/) — Autoridade Nacional de Proteção de Dados (ANPD) — The February 2026 conversion of Provisional Measure 1.317/2025 into Law 15.352 gave ANPD full functional, technical, decisional, administrative and financial autonomy as a regulatory agency. ### Brazil: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Legal basis and sensitive-data regimes are well-settled statutory provisions with several years of ANPD/court interpretation. Primary framework LGPD Arts. 7–13 Supervisory authority [Agência Nacional de Proteção de Dados (ANPD)](https://www.gov.br/anpd/) Traffic-light rationale — Green Legal basis and sensitive-data regimes are well-settled statutory provisions with several years of ANPD/court interpretation. D2 · Lawful Processing — Full Module Record 4 sub-modules · 70 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Brazil: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Rights catalogue is comprehensive and in force, though some response-timeline specifics are left to case-by-case ANPD regulation. Primary framework LGPD Arts. 9, 18–20 Supervisory authority [Agência Nacional de Proteção de Dados (ANPD)](https://www.gov.br/anpd/) Traffic-light rationale — Green Rights catalogue is comprehensive and in force, though some response-timeline specifics are left to case-by-case ANPD regulation. #### Sub-modules (5) #### Access RightGreen Data subjects have the right to confirmation of the existence of processing and facilitated access to their data (Arts. 9, 19). Claims (2): - Data subjects have the right to facilitated access to information about the processing of their data, to be made available in a clear, adequate and ostensible manner. - LGPD Art 18 §1 gives data subjects the right to petition the controller and the right to petition ANPD regarding their personal data, alongside the ordinary civil-damages route under Art 42. #### Rectification And ErasureGreen Article 18 grants rights to correct incomplete/inaccurate/outdated data and to anonymise, block, or delete unnecessary, excessive, or unlawfully processed data. Claims (1): - Article 18 rights include correcting incomplete, inaccurate or out-of-date data, and anonymising, blocking or deleting unnecessary or excessive data or data processed in noncompliance with the law. #### Restriction And ObjectionGreen Data subjects may petition against the controller before ANPD, and may oppose processing carried out under a consent-waiver ground if the LGPD is not being complied with. Claims (1): - The data subject has the right to petition regarding her/his data against the controller before the national authority, and may oppose processing carried out under a consent-waiver ground if there is noncompliance with the LGPD. #### Data PortabilityAmber Article 18(V) grants a right to data portability; sectoral implementation (e.g., Central Bank open-banking/open-finance rules) has been used to operationalise portability in the financial sector ahead of general ANPD guidance. Claims (1): - The Central Bank and Monetary Council's open banking regulation implemented consent-based data portability among financial institutions ahead of general ANPD portability guidance. #### Deadlines And Response WindowsAmber Where immediate compliance with a rights request is impossible, the controller must respond indicating either that it is not the processing agent or the factual/legal reasons preventing immediate action (Art. 19 §4); a fixed 15-day deadline applies specifically to requests for the text of international-transfer contractual instruments. Claims (1): - Upon a data subject's request for the full text of contractual instruments used in an international transfer, controllers have 15 days to provide it, excluding trade secrets. Article 18 grants a GDPR-like bundle of rights (confirmation/access, correction, anonymisation/blocking/deletion, portability, information about sharing and about consequences of refusing consent, and review of automated decisions under Article 20). Rights must first be exercised directly against the controller before escalation to ANPD. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (8) - [DataGuidance](https://www.dataguidance.com/sites/default/files/lgpd_translation.pdf) — Data subjects have the right to facilitated access to information about the processing of their data, to be made available in a clear, adequate and ostensible manner. - [IAPP](https://iapp.org/news/a/processing-rights-and-dsars-under-brazils-lgpd) — Article 18 rights include correcting incomplete, inaccurate or out-of-date data, and anonymising, blocking or deleting unnecessary or excessive data or data processed in noncompliance with the law. - [IAPP](https://prod.iapp.org/resources/article/brazilian-data-protection-law-lgpd-english-translation/) — The data subject has the right to petition regarding her/his data against the controller before the national authority, and may oppose processing carried out under a consent-waiver ground if there is noncompliance with the LGPD. - [OneTrust DataGuidance](https://www.dataguidance.com/opinion/brazil-new-open-banking-rules) — The Central Bank and Monetary Council's open banking regulation implemented consent-based data portability among financial institutions ahead of general ANPD portability guidance. - [IAPP](https://iapp.org/news/a/brazils-new-regulation-on-international-data-transfers) — Upon a data subject's request for the full text of contractual instruments used in an international transfer, controllers have 15 days to provide it, excluding trade secrets. - [MSPA Compliance](https://compliance.mspa.com.br/regulamentos/lgpd/artigo-20/) — LGPD Art 20 gives data subjects the right to request review of decisions taken solely on automated processing of personal data that affect their interests. - [Confidata Blog](https://confidata.com.br/blog/decisoes-automatizadas-lgpd-direitos-obrigacoes) — ANPD's Nota Técnica nº 12/2025, published May 2025, consolidates public consultation on AI and LGPD Art 20 automated decisions and is a preliminary, non-binding step. - [Presidência da República (mirror)](https://bkpsitecpsnew.blob.core.windows.net/uploadsitecps/sites/27/2024/05/4.-Lei-n.-13709-de-14-de-agosto-de-2018-Lei-Geral-de-Protecao-de-Dados-LGPD.pdf) — LGPD Art 18 §1 gives data subjects the right to petition the controller and the right to petition ANPD regarding their personal data, alongside the ordinary civil-damages route under Art 42. ### Brazil: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core duties are legislated and increasingly detailed by ANPD resolutions (DPO, breach, dosimetry), but explicit statutory retention/disposal timelines remain unresolved and enforcement of Art. 48/49 duties shows continuing public-sector immaturity. Primary framework LGPD Arts. 37–50; ANPD Resolutions CD/ANPD 15/2024, 18/2024, 02/2022 Supervisory authority [Agência Nacional de Proteção de Dados (ANPD)](https://www.gov.br/anpd/) Traffic-light rationale — Amber Core duties are legislated and increasingly detailed by ANPD resolutions (DPO, breach, dosimetry), but explicit statutory retention/disposal timelines remain unresolved and enforcement of Art. 48/49 duties shows continuing public-sector immaturity. D4 · Controller & Processor — Full Module Record 7 sub-modules · 57 words · 15 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Brazil: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ A full transfer-mechanism toolkit is now operative and the landmark 2026 mutual adequacy determination substantially de-risks EU-Brazil data flows, though SCC/BCR implementation details remain partly unresolved. Primary framework LGPD Arts. 33–36; ANPD International Data Transfer Regulation (Aug. 2024); Resolution No. 32/2026 Supervisory authority [Agência Nacional de Proteção de Dados (ANPD)](https://www.gov.br/anpd/) Traffic-light rationale — Green A full transfer-mechanism toolkit is now operative and the landmark 2026 mutual adequacy determination substantially de-risks EU-Brazil data flows, though SCC/BCR implementation details remain partly unresolved. Periodic update · new data 2026-11-04 #### Cross-Border & Adequacy Brazil's data protection authority is understood to have recognised the European Union as an adequate destination for international personal data transfers under the cross-border transfer provisions of the General Personal Data Protection Law, by way of a resolution reported as Resolução CD/ANPD nº 32/2026. If this recognition stands as reported, it would permit transfers of personal data from Brazil to the European Union without the need for an additional transfer mechanism such as standard contractual clauses or binding corporate rules — placing EU-bound transfers on the most permissive available footing under Brazilian law. This is reported with qualified rather than fully confirmed sourcing: the finding rests on a single secondary report, and the underlying authority resolution was not directly reviewed this period, so the precise scope of the recognition — whether it covers all transfers unconditionally, carries sectoral limits or carve-outs, or includes a built-in review or sunset date — is not yet established. This development sits alongside the authority's broader standard-contractual-clause framework for international transfers, under which transfers to destinations without an adequacy finding generally require a recognised transfer mechanism. An adequacy finding for the European Union would meaningfully simplify compliance for organisations moving personal data between Brazil and EU member states, removing the administrative burden of contractual safeguards for flows that would otherwise need them. #### Outlook The practical significance of this adequacy recognition for organisations with EU-Brazil data flows will depend on confirmation of its precise scope and conditions, including whether the authority has attached any time limit or review mechanism. Until the underlying resolution text is confirmed in detail, organisations relying on the recognition should treat its boundaries as provisional rather than settled. Periodic update · new data 2026-09-21 #### Cross-Border & Adequacy Brazil received its first-ever adequacy decision this cycle. Following reciprocal decisions adopted 26 to 27 January 2026, personal data may flow between Brazil and the EU/EEA, including Iceland, Liechtenstein and Norway, without additional transfer safeguards such as Standard Contractual Clauses or Binding Corporate Rules. This is a confirmed, high-materiality development affecting the transfer mechanism landscape in both directions. On the EU side, the European Commission adopted its adequacy decision on 26 January 2026 under GDPR Article 45, finding Brazil's LGPD-based framework essentially equivalent to EU data protection, and permitting EU-to-Brazil transfers without additional safeguards. On the Brazilian side, ANPD's Resolução CD/ANPD 32/2026, adopted 26 to 27 January 2026, formally recognises the European Union, covering all Member States plus Iceland, Liechtenstein and Norway, as providing adequate personal-data protection under LGPD Article 33(I). This recognition is subject to review every four years from the adoption date, and carries an explicit carve-out preserving the need for additional safeguards on transfers related to public security, national defence, or criminal investigation. This reciprocal pairing of decisions is a structural, not episodic, development: it establishes for the first time a bilateral adequacy relationship that eliminates the routine transfer-mechanism burden for the large volume of EU-Brazil personal-data flows, while preserving a defined and narrow carve-out for security-sensitive categories. #### Outlook The adequacy decisions are due for review every four years from the January 2026 adoption date, placing the first formal review point in 2030. In the nearer term, watch for any sector-specific guidance clarifying how the public-security and criminal-investigation carve-out will be applied in practice. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 72 words · 16 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Brazil: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial and health overlays are documented and active; telecoms/ePrivacy, education and insurance sub-areas lack dedicated sectoral DP instruments in the sources reviewed. Primary framework LGPD (general) plus BACEN/CMN Open Finance regulation and FEBRABAN self-regulation (financial sector) Supervisory authority [ANPD (general); Banco Central do Brasil (BACEN) for financial-sector conduct](https://www.bcb.gov.br/) Traffic-light rationale — Amber Financial and health overlays are documented and active; telecoms/ePrivacy, education and insurance sub-areas lack dedicated sectoral DP instruments in the sources reviewed. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 92 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Brazil: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ One concrete enforcement precedent (Meta AI-training suspension) exists, but most adtech sub-areas lack dedicated Brazilian instruments identified in this pass. Primary framework LGPD general provisions (Arts. 7, 18, 20) plus ANPD enforcement practice; no dedicated adtech statute identified Supervisory authority [Agência Nacional de Proteção de Dados (ANPD)](https://www.gov.br/anpd/) Traffic-light rationale — Amber One concrete enforcement precedent (Meta AI-training suspension) exists, but most adtech sub-areas lack dedicated Brazilian instruments identified in this pass. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 80 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Brazil: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ ADM transparency right is in force but implementation guidance is nascent; the horizontal AI statute remains unconfirmed as fully enacted; state-surveillance carve-outs are statutorily defined but ANPD's practical oversight role there is limited. Primary framework LGPD Art. 20 (ADM); LGPD Art. 4 §3 (state-surveillance carve-out); Brazilian AI Bill (PL 2338/2023, status uncertain) Supervisory authority [Agência Nacional de Proteção de Dados (ANPD)](https://www.gov.br/anpd/) Traffic-light rationale — Amber ADM transparency right is in force but implementation guidance is nascent; the horizontal AI statute remains unconfirmed as fully enacted; state-surveillance carve-outs are statutorily defined but ANPD's practical oversight role there is limited. Periodic update · new data 2026-09-21 #### Algorithmic, Biometric & Surveillance Governance Two distinct developments define this module's material content this cycle. First, ANPD published a Report on Generative AI, understood to analyse the implications, risks and challenges associated with generative-AI technologies, representing the regulator's move into active engagement with AI-specific governance questions ahead of any dedicated AI-processing rule. Second, and providing important enforcement-precedent context, in 2025 ANPD issued a preliminary order prohibiting Tools for Humanity, the operator of Worldcoin, from collecting iris scans in exchange for cryptocurrency in Brazil, backed by a daily fine of R$50,000 for non-compliance. This action is understood to demonstrate ANPD's willingness to halt biometric-data operations at a preliminary, pre-merits stage where mass-impact risk is present, notably occurring ahead of any dedicated biometric-data regulation, which remains a later-phase item on ANPD's 2025-2026 Regulatory Agenda, following data subject rights, DPIAs, government data-sharing and minors' data in the agenda's sequencing. Read together, the generative-AI report and the Worldcoin biometric enforcement precedent indicate that ANPD is building governance capacity and enforcement precedent in the algorithmic and biometric space ahead of, rather than through, dedicated statutory rules specific to those categories. #### Outlook Dedicated biometric-data regulation remains a later-phase Regulatory Agenda item with an expected multi-year horizon; watch for whether the Worldcoin enforcement precedent is followed by further preliminary orders against other biometric-data operations pending that dedicated rule. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 109 words · 13 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Brazil: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Statutory protection is strong and rapidly maturing (Digital ECA now in force), but implementing age-verification technical standards remain under active public consultation as of mid-2026. Primary framework LGPD Art. 14; Digital Child and Adolescent Statute (Law No. 15.211/2025) and Decree No. 12.881/2026 Supervisory authority [Agência Nacional de Proteção de Dados (ANPD)](https://www.gov.br/anpd/) Traffic-light rationale — Amber Statutory protection is strong and rapidly maturing (Digital ECA now in force), but implementing age-verification technical standards remain under active public consultation as of mid-2026. Periodic update · new data 2026-10-11 #### Children & Vulnerable Groups The ANPD's Consulta Pública nº 1/2026, open for comment from 9 September to 26 October 2026, proposes revising the fiscalização and sanctioning regulation specifically to incorporate enforcement of the ECA Digital framework and the provider duties established under Decreto nº 12.975/2026. This is a proposal under public consultation and has not yet become a final rule, but it is understood to reflect the ANPD's intention to align its enforcement architecture with Brazil's child-specific digital-protection regime rather than relying solely on the LGPD's general lawful-processing requirements for children's data. This consultation-stage development sits alongside the ANPD's September 2026 fine against ByteDance (TikTok), understood to have been imposed specifically for processing children's and adolescents' data without a lawful basis. Read together, the fine and the consultation point in the same direction: a regulator actively using its existing enforcement powers against children's-data violations while simultaneously seeking to formalise and expand those powers for future cases. #### Outlook The consultation closes 26 October 2026. Its outcome will determine whether ECA Digital and Decreto nº 12.975/2026 enforcement become formally incorporated into the ANPD's binding sanctioning regulation, which would give the regulator a more explicit procedural basis for children's-data enforcement actions going forward. Periodic update · new data 2026-10-04 #### Children & Vulnerable Groups ANPD fined ByteDance, operator of TikTok, BRL 153.7 million for violations of the Lei Geral de Protecao de Dados connected to the processing of minors' data. This is understood to be the largest single enforcement figure ANPD has issued to date, and it concentrates specifically on the children's-data area rather than on general LGPD compliance. Alongside the fine, digital platforms that target children are required to publish their first transparency report by 17 September 2026, a new disclosure obligation specific to platforms operating in this space. The scale of the ByteDance fine, considered against ANPD's historical enforcement record, signals that children's-data processing has become a concentrated area of supervisory attention, consistent with the agency's broader institutional strengthening achieved through Lei 15.352/2026 earlier in the year. #### Outlook The 17 September 2026 transparency-report deadline has, as at this cycle, already passed; whether platforms targeting children in Brazil met that deadline, and how ANPD responds to any that did not, is the immediate development to watch in this area. D9 · Children's Privacy — Full Module Record 5 sub-modules · 131 words · 14 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Brazil: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Statutory penalty and powers framework is robust and has just been substantially strengthened, but actual enforcement volume remains modest and concentrated in the public sector, and ANPD's historic capacity constraints are only now being addressed. Primary framework LGPD Arts. 52, 55-A to 55-L; Provisional Measure No. 1.317/2025; ANPD Dosimetry Regulation (Resolution of 27 Feb. 2023) Supervisory authority [Agência Nacional de Proteção de Dados (ANPD)](https://www.gov.br/anpd/) Traffic-light rationale — Amber Statutory penalty and powers framework is robust and has just been substantially strengthened, but actual enforcement volume remains modest and concentrated in the public sector, and ANPD's historic capacity constraints are only now being addressed. Periodic update · new data 2026-11-04 #### Enforcement & Redress A public consultation on a draft resolution amending Brazil's enforcement and sanctioning regulation — the Regulamento de Fiscalização, which traces back to the authority's original 2021 enforcement procedure rules — ran from 9 September to 26 October 2026 and has now closed. The direction of travel reported from that consultation is toward expanding the investigative instruments available to the authority and accelerating the pace of enforcement action, though no adopted replacement regulation has been issued as of the close of the consultation: this remains a proposal under consideration rather than a binding change. This closure is reported with high confidence as to the fact and timing of the consultation itself, though the eventual content of any adopted text is not yet knowable from what has been reviewed. This enforcement-reform process runs concurrently with the broader institutional expansion of the authority described elsewhere this period — its conversion into a full regulatory agency and its acquisition of competence over adjacent digital-governance regimes. Read together, these developments point toward an authority positioning itself for a more active enforcement posture: more investigative tools, potentially faster procedural timelines, and a wider institutional base from which to pursue cases, including in areas beyond the core data protection law. #### Outlook A revised fiscalização and sanctioning regulation is expected to be adopted within the final quarter of 2026, though the timing carries meaningful uncertainty and the adopted text may differ from the consultation draft. Organisations subject to Brazilian jurisdiction should expect investigations and enforcement actions to become more frequent and more procedurally efficient once any revised regulation takes effect, even though no new regulation is yet in force. Periodic update · new data 2026-10-18 #### Enforcement & Redress ANPD's 25 August 2026 decision against ByteDance, operator of TikTok, applied the LGPD's simple-fine cap under article 52, II, up to 2 percent of gross revenue limited to R$50 million per infraction, separately to five distinct LGPD infractions. The result was a combined sanction of R$153,769,671.33, alongside an order requiring data elimination. The decision is appealable to ANPD's Conselho Diretor within ten working days. This is reported as the operative benchmark for ANPD's enforcement reach to date. Two regulatory processes have followed in the weeks since. First, ANPD published Aviso de Audiência Pública nº 3/2026 on 15 October 2026, opening a public hearing for 29 October 2026 on a draft Resolution amending the Regulamento de Dosimetria e Aplicação de Sanções Administrativas, currently Resolução CD/ANPD nº 4/2023, the methodology by which per-infraction fines such as the TikTok decision are calculated. This is a direct procedural follow-on from the visibility the TikTok decision generated. Second, and separately, ANPD opened a public consultation running 9 September to 26 October 2026, conducted exclusively through the Brasil Participativo platform, on a draft Resolution amending the Regulamento do Processo de Fiscalização e do Processo Administrativo Sancionador, currently Resolução CD/ANPD nº 1/2021. This draft is reported to propose broadening ANPD's investigative instruments and expanding the universe of firms it actively supervises; the primary consultation text was not independently opened this cycle, so the precise scope remains unconfirmed. #### Outlook The sanctions-dosimetry public hearing on 29 October 2026 and the inspection-process consultation closing 26 October 2026 are the two items to track. Together they indicate the regulator is actively formalising both how it calculates fines and how broadly it investigates, in the period immediately following its largest enforcement action to date. Periodic update · new data 2026-10-11 #### Enforcement & Redress The ANPD is understood to have fined ByteDance (TikTok) R$153.7 million in September 2026 for processing children's and adolescents' data without a lawful basis, accompanied by a data-elimination order and a compliance plan. This figure and date rest on secondary legal commentary; the exact ANPD decision or process number was not independently retrieved this cycle, so the fine amount and date should be read as reported rather than as directly confirmed against the primary ANPD decision. Separately, the ANPD's Consulta Pública nº 1/2026, open through 26 October 2026, proposes expanded investigative powers for the regulator, including cautionary measures that may be applied without prior notice, through a revision of Resolução CD/ANPD nº 1/2021. This is a draft proposal under public consultation, not yet a final binding rule. Taken together with the ByteDance fine and the institutional autonomy granted to the ANPD under Lei nº 15.352/2026, the consultation suggests the regulator is seeking to formalise procedural tools that would support the kind of large-scale enforcement action it has already demonstrated the capacity to bring. #### Outlook The consultation on expanded investigative powers closes 26 October 2026. Given the regulator's demonstrated willingness to impose a record fine this cycle, the adoption of cautionary measures without prior notice would materially strengthen its practical enforcement toolkit going forward. Periodic update · new data 2026-10-04 #### Enforcement & Redress ANPD enforces LGPD with fines of up to BRL 50 million per violation and, following Lei no 15.352/2026, can now also order a business to cease operations as a supervisory measure. This cessation power sits on top of ANPD's existing fining authority and represents a materially stronger enforcement tool than monetary sanction alone. The agency's largest fine to date, BRL 153.7 million against ByteDance for minors'-data violations, demonstrates the scale at which ANPD is prepared to act even before accounting for the new cessation power. Separately, ANPD opened a public consultation on 29 September 2026 reviewing its own administrative enforcement and sanctioning procedures, following a public hearing with 43 registered participants. This procedural review follows directly from, and may formalise, the practical exercise of the agency's strengthened powers described above. #### Outlook The procedural-review consultation's outcome will determine whether ANPD's sanctioning-regulation dosimetry methodology changes, and whether the agency's cessation power is accompanied by specific procedural safeguards or exercised under general statutory discretion. This is the clearest near-term indicator of how assertively ANPD intends to use its strengthened mandate going forward. Periodic update · new data 2026-09-21 #### Enforcement & Redress ANPD's enforcement activity escalated markedly this cycle across two concurrent matters. ANPD opened a supervisory proceeding against Claro, with Serasa notified for a parallel proceeding, alleging LGPD violations arising from the transfer of more than one hundred pieces of customer information per partnership. A potential fine of up to R$50 million, or 2 percent of the company's Brazilian revenue for the prior fiscal year, whichever is applicable, is in prospect, consistent with ANPD's standing statutory penalty ceiling under LGPD Article 52; the proceeding remains at a proposed, unresolved stage this cycle. This proceeding lands alongside the separately reported R$153.77 million fine against a social-media platform for children's-data violations, described under Children & Vulnerable Groups, and both sit against the backdrop of ANPD's February 2026 conversion to full institutional autonomy under Law 15.352. ANPD's standing statutory powers include the ability to impose fines of up to 2 percent of Brazilian revenue capped at R$50 million per infraction, and to block databases, delete data, publicise violations, and suspend or prohibit processing activities; these powers pre-date this cycle but provide the statutory basis against which the newly opened Claro/Serasa proceeding and the sanctioned children's-data case should be read. The concurrence of a large resolved fine and a newly opened, unresolved proceeding of comparable potential magnitude is itself a signal of a regulator operating at a materially higher enforcement tempo than in prior periods. #### Outlook The Claro/Serasa proceeding's resolution, whether by settlement, sanction, or dismissal, is the clearest near-term indicator of ANPD's post-autonomy enforcement trajectory; watch for its outcome and for the eventual fine amount relative to the R$50 million or 2 percent statutory ceiling. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 111 words · 31 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties