Brazil's ANPD tightens LGPD enforcement in 2026

Brazil’s ANPD moved in 2026 to revise its inspection rules and administrative sanctions framework, while stepping up compliance efforts across several fronts. At the same time, it ordered Paraná to stop collecting biometric data from children and teenagers for school attendance through facial recognition, opened 19 new sanction cases in June, and kept health, biometrics, financial data, artificial intelligence and public-sector processing under scrutiny.

What changed in ANPD's regulatory agenda?

The authority included the review of its inspection and sanction rules in a broader agenda of supervision and regulatory adjustment, according to its 3º Relatório Semestral de Acompanhamento e Execução da Agenda Regulatória do Biênio 2025/2026. The report, published in August 2026, also tracks rulemaking projects tied to data subject rights, international data transfers, public-sector processing and transparency in the use of emerging technologies.

ANPD also said in its first-half 2026 follow-up report, published on August 18, that this regulatory review is one of the major actions currently underway. In practical terms, the signal points to tighter oversight work, not just a list of abstract priorities.

What happened with facial recognition in Paraná schools?

ANPD ordered the suspension of biometric data collection from children and adolescents for school attendance through facial recognition, and set a 10-day deadline to show compliance with the measure, according to specialized coverage. Data Privacy Brasil described the move as preventive rather than punitive, citing Despacho Decisório nº 2/2026/SFI and Nota Técnica nº 4/2026/CPDP/CGF/SFI/ANPD.

Biometric Update reported that the order affects school attendance practices in Paraná. Tech Policy Press framed it as a landmark case for protecting the data of children and adolescents in Brazil, and as a precedent for addressing systemic risks in other sensitive data uses tied to fundamental rights, including social welfare programs.

What other signs of tougher enforcement did ANPD show?

The 2026 agenda also points to closer scrutiny of specific sectors. LHLaw said ANPD's Mapa de Temas Prioritários 2026-2027 includes four pillars, data subject rights with a focus on biometric, health and financial data, protection of children and adolescents in digital environments, public-sector data processing, and artificial intelligence and automated decisions.

The same legal coverage said ANPD opened 19 new sanction proceedings in June 2026 alone. LexLegal agreed that the map reflects a more active ANPD with greater pressure on companies, turning those topics into concrete supervision and compliance priorities.

In health, Medicinasa said resolutions CD/ANPD nº 30 and 31/2025 set an explicit 2026 goal of at least 10 inspection actions focused on health, biometric and financial data processing. That reading fits the broader picture of a more demanding supervision agenda.

What signals emerged on international transfers and AI?

On the international front, TozziniFreire reported that in 2026 ANPD issued an adequacy decision recognizing European Union countries as suitable destinations for data sent from Brazil. The same publication said the adequacy is reciprocal from the European perspective.

Legal coverage also placed artificial intelligence among the enforcement priorities, with emphasis on transparency and explainability in automated decisions even without a specific AI rule. In that area, the 2025-2026 regulatory agenda and the Mapa de Temas Prioritários 2026-2027 place the issue among the authority's operational priorities.