Brazil ANPD updates sanctions rules

Update October 16, 2026: ANPD opened a public consultation to review its Dosimetry and Administrative Sanctions Regulation, scheduled a virtual public hearing for Oct. 29, 2026, and set Nov. 30 as the deadline for contributions. The proposal also adds new responsibilities tied to the Digital Statute for Children and Adolescents and Decrees 12,975 and 12,976.

Brazil’s National Data Protection Authority has opened a public consultation to shape its 2027-2028 regulatory agenda, while also announcing another review of its dosimetry and administrative sanctions rules. At the same time, the agency has launched a new channel for reporting social media platforms and apps, which ANPD will use to guide enforcement, identify patterns of noncompliance, and decide whether to broaden oversight or open investigations.

What topics did ANPD put out for consultation?

ANPD’s public consultation covers artificial intelligence, biometric data processing, protection of children and adolescents in digital environments, and the exercise of data subjects’ rights. The goal is to organize the regulatory agenda for the 2027-2028 biennium, according to the agency’s communication and reporting by Lefosse Advogados.

What other review did the regulator open?

ANPD also announced a new public consultation to update the Dosimetry and Administrative Sanctions Regulation. The proposal incorporates the agency’s new powers linked to the Digital Statute for Children and Adolescents, along with Decrees 12,975 and 12,976, which updated the regulation of Brazil’s Civil Rights Framework for the Internet.

Along with that, the authority called a virtual public hearing for Oct. 29, 2026, and opened registration for oral presentations at the session. Those who wanted to participate in that format had until Oct. 24, 2026, to sign up, according to information released by ANPD and MLex.

What changes in enforcement?

ANPD’s complaints channel allows reports about social media platforms and applications to feed its enforcement work. According to the announcement, those reports can help identify patterns of noncompliance, assess whether controls should be expanded, or trigger specific investigations.

What other initiatives remain on the agenda?

Brazil’s Ministry of Justice and Public Security said ANPD’s regulatory agenda also includes projects on public-sector data sharing, data aggregators, and enforcement and sanctions mechanisms. The same communication mentioned Decrees 12,975 and 12,976 of 2026, which redesigned how the Civil Rights Framework for the Internet is enforced, and placed the debate within a broader discussion about risk prevention and institutional capacity in the digital environment.

On the legislative front, Senate Bill 2524/2024 remains ready to be considered by a temporary committee, with its deadline extended to December 2026, while proposals linked to data used by AI systems and digital platforms continue to move forward.