ANPD升级为管理局：开启巴西数据保护新篇章

By Sylvio Sobreira Vieira, CEO & Head Consulting at SVX Consultoria

At a time when Brazil is recording unprecedented numbers of cyber incidents and facing growing pressure for greater transparency in the use of personal data, the ANPD (National Data Protection Authority) is gaining more power. Elevated to a regulatory agency by Provisional Measure 1,317, approved on September 17th, the institution now has administrative and financial independence, an essential condition for more rigorous oversight and for keeping pace with the technological evolution of the digital market.

This change had been anticipated since 2022 and addresses the growing need for a more autonomous and structured body to handle challenges related to privacy, information security, and digital rights. In practice, this grants the institution functional, technical, decision-making, administrative, and financial autonomy—fundamental characteristics for a regulatory body to operate independently. Until then, the ANPD operated as a special autarchy linked to the Ministry of Justice and Public Security.

The agency's independence will also favor greater oversight of the federal government itself. In 2024 alone, there were over 9,000 data breaches from federal systems, a surge of more than 21 times compared to 2020, the year the LGPD (General Data Protection Law) came into effect.

Structural Reinforcement and New Responsibilities

In addition to changing the legal nature of the ANPD, Provisional Measure 1,317 introduces a robust plan for structural strengthening. The text creates the career path of Data Protection Regulation Specialist and authorizes the hiring of 200 career civil servants for this purpose. These new permanent positions will be filled through public examinations and designated for oversight, control, and technical analysis activities within the sector. In addition to the specialists, the Provisional Measure provides for the creation of 18 commissioned positions resulting from this internal reorganization, as well as another 26 additional commissioned positions to reinforce the agency's management.  

Consequently, the ANPD gains administrative muscle, breaking the almost exclusive dependence it had on staff seconded from other bodies. Between 2021 and 2024, its personnel grew from just 50 to approximately 141 civil servants, yet still falling short of what is needed given the increasing demand.

In the field of competencies, the agency also takes on new strategic responsibilities. The most emblematic is the assignment to oversee compliance with the newly enacted Digital Child and Adolescent Statute (ECA Digital, Law No. 15,211/2025).  

Oversight, Compliance, and Future Perspectives

From the perspective of the market and society, the conversion of the ANPD into a regulatory agency heralds a phase of more active and rigorous oversight in Brazil.  

With the expansion of the technical staff and reinforced independence, the ANPD is expected to increase the number of on-site inspections, institute more sanctioning proceedings for violations of the LGPD, and enforce its determinations with greater agility. This increase in operational capacity should also accelerate the analysis of security incidents and the response to data subject complaints, reducing the slowness that previously limited the agency's effectiveness.

For companies, the message is clear. The era of a strictly advisory ANPD gives way to a phase of effective compliance enforcement. Organizations of all sizes will need to revisit their data governance and privacy programs, ensuring not only adequacy with the LGPD but also compliance with the most recent norms and guidelines issued by the agency.  

In recent months, for example, the ANPD has issued important regulations on international data transfer (Resolution CD/ANPD No. 19/2024), on the role of the Data Protection Officer (Resolution No. 18/2024), and on security incident notifications (Resolution No. 15/2024). This means that companies will need to monitor and implement changes much more rapidly than before.  

The Role of the ANPD in Regulating AI and Big Data

There is a growing expectation that the ANPD will play a leading role in regulating Artificial Intelligence and technologies such as Big Data. In 2023, the Federal Senate created a Temporary Commission on Artificial Intelligence, whose report pointed to the ANPD as the natural candidate to coordinate the future National AI Regulation and Governance System.  

Similarly, the Science and Technology Committee of the Chamber of Deputies has issued opinions favorable to the ANPD taking a leading role in this area.

In the context of Big Data, the ANPD is expected to use its guidance and sanctioning powers to prevent abuses in the massive use of personal data—whether by companies or by the public sector itself—fostering practices of transparency, data minimization, and “privacy by design” in innovative solutions.

The ANPD's new status signals the beginning of a more mature chapter in Brazilian data protection—where clear rules, effective oversight, and digital education go hand in hand to strengthen trust in the digital economy and concretely protect the rights of the connected society.