Brazil Strengthens ANPD, Tightens LGPD

Brazil’s ANPD is going through an institutional consolidation process that is strengthening its position as the country’s central data protection regulator. Among the most recent changes is its formal conversion into a federal regulatory agency with its own career track for regulation and data protection specialists, created by Provisional Measure 1,315/2025.

What oversight powers did the ANPD gain?

That new career track makes it possible to hold public competitions for at least 50 specialists and comes with functional, technical, decision-making, administrative and financial autonomy, according to Provisional Measure 1,315/2025. The move is meant to expand the authority’s operational capacity to enforce compliance with the LGPD, beyond what is already established in Law 15,352/2026.

At the same time, the ANPD completed in 2026 the first phase of a targeted monitoring effort focused on a key internal governance obligation, the appointment of the Data Protection Officer and the maintenance of channels for data subject communication. A total of 56 entities were monitored, and 21 were left open to a possible administrative sanction proceeding for failing to respond. The figure shows that enforcement is no longer limited to security incidents or breaches, but also extends to the structural obligations imposed by the LGPD.

How is the ANPD extending its reach beyond Brazil?

The ANPD’s expanding role is also visible outside Brazil, through its inclusion in the Global Online Safety Regulators Network as the first South American regulatory authority in that international cooperation network on online safety. That step strengthens its international profile in data protection and related digital security matters, including compliance with the Digital Statute for Children and Adolescents.

The ANPD also signed Technical Cooperation Agreement No. 4/2026 in July 2026 with the Agência Nacional de Águas e Saneamento Básico. The agreement, published in the Diário Oficial da União, provides for information sharing and coordination on personal data protection in water resources and basic sanitation. It also consolidates the ANPD as a cross-sector authority with the ability to impose sanctions when data processing does not comply with the LGPD.

What impact does the institutional strengthening have on compliance?

The institutional reinforcement comes at a sensitive moment for the agency’s leadership, since Waldemar Gonçalves Ortunho Júnior is expected to leave the presidency in November 2026 and Miriam Wimmer’s term as director ends in December 2026. Even so, specialized analysis considers that the new responsibilities and structural strengthening would allow regulatory and sanctioning action to continue through temporary appointments, without a leadership vacuum slowing enforcement.

Against that backdrop, the ANPD is becoming more closely integrated into a broader oversight framework, with greater capacity to demand internal compliance, coordinate with other authorities and project itself into international forums.