Brazil's ANPD becomes a regulatory agency: what changes for companies
Law 15,352/2026 turned Brazil's ANPD into an agency with financial autonomy and 200 new posts. What changes in LGPD and ECA Digital enforcement.
Brazil's National Data Protection Authority (ANPD) is now a full regulatory agency, on a par with the telecom and energy regulators. The shift began with Provisional Measure 1,317 in September 2025 and was consolidated by Law 15,352/2026, published on February 25, 2026.
Timeline
| Date | Milestone |
|---|---|
| Sep 2025 | MP 1,317/2025 turns the ANPD into an agency |
| Feb 9 / Feb 24, 2026 | Approved by the House and Senate |
| Feb 25, 2026 | Law 15,352/2026 published |
| Mar 17, 2026 | ECA Digital (children online) takes effect, overseen by the ANPD |
| Apr 8, 2026 | New internal structure (Decree 12,881/2026) |
| Jun 2026 | Civil service exam authorized; 19 sanction proceedings opened |
| Nov 2026 | ECA Digital sanctions expected to begin |
What the law changed
The ANPD became a special autarchy with functional, technical, decision-making, administrative and financial autonomy (Teletime). Law 15,352 created 200 specialist posts, internal audit and the ability to requisition staff until the end of 2028 (Wagner Advogados). A first exam with 50 posts was authorized in June 2026 (Turivius).
The agency also oversees ECA Digital, which requires reliable age assurance, parental linking for under-16s, privacy by default and a ban on ad profiling of minors, with fines of up to 10% of group revenue in Brazil (Mayer Brown).
Enforcement so far
Between July 2023 and June 2025 the ANPD ran 35 inspections and opened 3 sanction proceedings (ANPD). Its only published monetary fine by early 2026 was R$14,400 against Telekall; the most common violation was failure to report incidents (Confidata). In June 2026 it opened 19 proceedings, its largest batch ever.
The ANPD is also slated to coordinate AI oversight under bill PL 2338/2023, still pending in the House (Teletime).
What companies should do
The LGPD itself has not changed: fines remain capped at 2% of Brazilian revenue, up to R$50 million per violation, and incidents must be reported within 3 business days (Mayer Brown). What changes is enforcement capacity.
- Make sure the incident plan meets the 3-day deadline.
- Appoint a DPO and keep a working data-subject channel.
- Keep incident records for 5 years.
- Platforms with young users should implement age assurance before November 2026.
Source
- Teletime: ANPD vira oficialmente agência
- LegisMap: Senado aprova MP que transforma a ANPD em agência
- Wagner Advogados: Lula sanciona lei da ANPD
- Turivius: multas da LGPD em 2026
- Mayer Brown: ECA Digital enforcement
- ANPD: Relatório do Ciclo de Monitoramento 2023-2025
- Confidata: mapa de sanções da ANPD 2026
- Mayer Brown: regulamento de comunicação de incidentes
- LegisMap: orientações preliminares para aferição de idade
- Teletime: votação do PL da IA