#
Comprehensive omnibus statute in force since 2020 with an increasingly empowered, independent regulator; core scope/authority questions are settled.
Sub-modules (5)
Regulator And AuthorityGreen
ANPD, created by LGPD Art. 55-A and structured by Decree 10.474/2020, was converted into an independent regulatory agency by Provisional Measure 1.317/2025, aligning it with other Brazilian regulatory agencies and granting police-style enforcement powers.
Claims (2):
- Provisional Measure No. 1.317/2025 transformed ANPD into the National Data Protection Agency, guaranteeing functional, technical, decision-making, administrative and financial autonomy.
- The provisional measure grants ANPD strengthened enforcement powers, including ordering establishments to cease operations, seizing goods, and requesting police assistance in cases of obstruction.
Act And InstrumentsGreen
The LGPD (65 articles) is the primary instrument, heavily influenced by GDPR, supplemented by numerous ANPD resolutions (DPO, breach notification, international transfers, dosimetry, small agents) and sector rules.
Claims (1):
- The LGPD comprises 65 articles and was greatly influenced by the EU GDPR, providing legal bases authorizing personal data use across all economic sectors.
Material ScopeGreen
LGPD applies to processing of personal data by any natural or legal person, public or private, online or offline, with limited exceptions (journalistic/artistic/academic purposes, public safety, national defense, criminal investigation).
Claims (1):
- LGPD applicability is not limited by business size; exceptions apply only to journalistic, artistic, academic, public-safety and national-defense purposes.
Territorial ScopeGreen
Article 3 gives the LGPD extraterritorial reach: any processing carried out in Brazil, or aimed at offering goods/services to individuals in Brazil, triggers applicability regardless of the controller's country of establishment.
Claims (1):
- Under Article 3, a personal data processor is subject to the LGPD when data are collected or processed in Brazil, or processed to offer goods/services to individuals in Brazil, irrespective of where the controller is headquartered.
Regulator Registration And FilingAmber
There is no general controller-registration regime, but ANPD Resolution 02/2022 (small-scale agents) and a simplified ROPA template create lighter-touch filing/record obligations for small processing agents.
Claims (1):
- ANPD developed a simplified ROPA (record of processing activities) template for small-scale processing agents under the small-agents regulation approved by Resolution CD/ANPD No. 02/2022.
Regulator & Framework
The Autoridade Nacional de Proteção de Dados operates under its institutional structure established by Lei nº 15,352/2026, published 25 February 2026, which converted the ANPD into an autarquia de natureza especial, linked to the Ministério da Justiça e Segurança Pública, with functional, technical, decision-making, administrative and financial autonomy and its own career structure for staff. This institutional status is unchanged as at this cycle and remains the operative framework underlying the regulator's current activity.
Against that stable institutional backdrop, ANPD published Aviso de Audiência Pública nº 3/2026 in the Diário Oficial da União on 15 October 2026, grounded in article 10 of Lei nº 13,848/2019, announcing a virtual public hearing on 29 October 2026, with enrolment open from 15 to 24 October 2026. The hearing concerns a draft Resolution amending the Regulamento de Dosimetria e Aplicação de Sanções Administrativas, the instrument governing how the regulator calculates administrative sanctions. The full text and scope of the Aviso was not directly opened this cycle; this account relies on a news aggregator's report of the Diário Oficial notice rather than the primary gazette text itself.
Outlook
The public hearing on the sanctions-dosimetry Resolution is scheduled for 29 October 2026, with enrolment closing 24 October 2026. Whether the resulting Resolution changes the per-infraction fine-calculation approach applied in ANPD's recent enforcement decisions is the item to watch.
3 earlier distinct update(s)
Regulator & Framework
Lei nº 15.352/2026, in force since 25 February 2026, transformed the ANPD from a body linked to the Presidency of the Republic into an autonomous regulatory agency possessing its own legal personality and financial autonomy, with an expanding staff. This is understood to represent a significant structural shift in the regulator's institutional standing, moving it toward the model of other autonomous Brazilian regulatory agencies rather than the presidentially-linked structure it previously held.
The practical consequence of this institutional change is still unfolding. An expanded staff complement is understood to support the kind of large-scale investigative and sanctioning activity the ANPD has demonstrated this cycle, including its record fine against ByteDance (TikTok). The ANPD's own fiscalização-sanctioning regulation is separately under public consultation (Consulta Pública nº 1/2026, open through 26 October 2026), proposing to incorporate enforcement of the ECA Digital framework and Decreto nº 12.975/2026 provider duties, and to expand the regulator's investigative powers. Together, the institutional autonomy granted by Lei nº 15.352/2026 and the proposed procedural expansion under consultation point toward a regulator consolidating both independence and practical enforcement reach.
Outlook
The consultation revising the ANPD's fiscalização regulation closes 26 October 2026. Whether the proposed procedural changes, including investigative powers and cautionary measures without prior notice, are adopted will determine how far the regulator's newly autonomous status translates into expanded practical authority.
Regulator & Framework
Lei no 15.352/2026, sanctioned 25 February 2026, converts the Autoridade Nacional de Protecao de Dados's independent-agency status into permanent law. That status had first been conferred on a provisional basis by Medida Provisoria 1.317/2025 in September 2025, meaning the question of ANPD's institutional durability sat unresolved by ordinary legislation for roughly five months before this conversion. The new law is understood to carry strengthened enforcement powers, including the ability for ANPD to order a business to cease operations as a supervisory measure, though the precise staging of these new powers has not been verified against ANPD's own text this cycle.
This institutional settlement arrives at a moment when ANPD has also issued its largest enforcement figure to date, a BRL 153.7 million fine against ByteDance for minors'-data violations, suggesting the agency is moving to exercise its strengthened mandate actively rather than treating the legislative conversion as a purely formal milestone.
Outlook
Whether Lei 15.352/2026 altered any substantive data protection officer, data protection impact assessment, or breach-notification threshold, as distinct from institutional and governance status alone, has not been established in sourcing available this cycle and is a gap worth monitoring as implementation guidance or ANPD commentary clarifies the law's practical scope.
Regulator & Framework
Brazil's data-protection regulator underwent a structural institutional change this cycle. The February 2026 conversion of Provisional Measure 1.317/2025 into Law 15.352 gave the Autoridade Nacional de Proteção de Dados full functional, technical, decisional, administrative and financial autonomy as a regulatory agency. This is understood, per secondary legal-press reporting, to end approximately five years during which ANPD's enforcement posture had been largely educational rather than punitive in character. The finding is assessed at probable confidence: no gov.br or planalto.gov.br primary text of Law 15.352 was reached this cycle, and sourcing rests on legal-press coverage rather than the statute itself.
The practical significance of this conversion is that it removes structural constraints, tied to ANPD's prior status, that had limited its capacity to act with full regulatory independence, including budgetary and administrative autonomy from the broader federal executive structure. This institutional change sits alongside, and plausibly helps explain, the marked escalation in enforcement activity landing in the same period, including the large children's-data fine and the newly opened Claro/Serasa proceeding described elsewhere in this cycle's findings.
Outlook
The clearest indicator to watch is whether ANPD's enforcement tempo, evident in the fines and proceedings recorded this cycle, continues at pace now that the institutional-autonomy conversion is complete, and whether a primary-source text of Law 15.352 becomes available to confirm the specific scope of the new autonomy.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (6)
- ConfirmedIAPP — Provisional Measure No. 1.317/2025 transformed ANPD into the National Data Protection Agency, guaranteeing functional, technical, decision-making, administrative and financial autonomy.observed
- ConfirmedIAPP — The provisional measure grants ANPD strengthened enforcement powers, including ordering establishments to cease operations, seizing goods, and requesting police assistance in cases of obstruction.observed
- ConfirmedIAPP — The LGPD comprises 65 articles and was greatly influenced by the EU GDPR, providing legal bases authorizing personal data use across all economic sectors.observed
- ConfirmedIAPP — LGPD applicability is not limited by business size; exceptions apply only to journalistic, artistic, academic, public-safety and national-defense purposes.observed
- ConfirmedIAPP — Under Article 3, a personal data processor is subject to the LGPD when data are collected or processed in Brazil, or processed to offer goods/services to individuals in Brazil, irrespective of where the controller is headquartered.observed
- ProbableOneTrust DataGuidance — ANPD developed a simplified ROPA (record of processing activities) template for small-scale processing agents under the small-agents regulation approved by Resolution CD/ANPD No. 02/2022.observed