On September 9, 2026, the National Data Protection Agency (“ANPD”) announced a public consultation on proposed updates to the Regulation of the Enforcement Process and the Administrative Sanctioning Process (“Regulation”), approved by Resolution CD/ANPD No. 1/2021. In force since 2021, the Regulation governs the ANPD’s enforcement activities and the investigation of violations falling within its jurisdiction.
The proposed update reflects the expansion of the Agency’s powers under the Digital Statute of the Child and Adolescent, the rules applicable to internet application providers, and rules aimed at protecting women and addressing violence in digital environments.
ANPD will hold a public hearing on September 24, 2026, which will be streamed on the Agency’s YouTube channel. Those wishing to make an oral submission must register by September 18 using the online form available at “Public Hearing on the Revision of the Enforcement Regulation – Oral Participation”. The draft is available on the Brasil Participativo platform for the submission of suggestions, feedback, and comments until October 26, 2026.
Key Proposed Changes
The draft’s main proposed changes include:
- Expansion of the Regulation’s scope to include providers of information technology products or services directed at children and adolescents or likely to be accessed by them, as well as internet application providers, within the limits of the ANPD’s statutory powers.
- Expansion of the matters subject to ANPD enforcement, including the protection of children and adolescents in digital environments; the protection of women online and efforts to address violence against women in digital environments; and the guarantee of users’ rights and compliance by internet application providers with their statutory obligations.
- Reorganization of enforcement activities, distinguishing between ongoing monitoring and guidance activities and preventive and repressive actions conducted through administrative enforcement proceedings. The draft also expressly classifies security incident notification and investigation procedures governed by Resolution CD/ANPD No. 15/2024 as administrative enforcement proceedings.
- Further detail on interim and preventive measures, which may be adopted by the Enforcement Superintendency before or during the proceedings, without first hearing the regulated agent, where there is a risk of harm or a risk to the outcome of the proceedings. The draft establishes criteria for their adoption and allows daily fines to be imposed to ensure compliance.
- New rules for interactions with the ANPD, including mandatory registration as an external user in the Electronic Information System (SEI) upon the first filing, the use of SEI as the centralized channel for communications, and stricter requirements for confidentiality requests. Under the initial draft, documents for which restricted access is not precisely indicated, along with the applicable legal basis, will be treated as publicly accessible. The regulated agent must submit a redacted public version and will be responsible for the technical effectiveness of the redaction.
- Rules governing amicus curiae participation, limited to organizations and associations with adequate representativeness and activities related to the subject matter, subject to admission by the Enforcement Superintendency and without standing to appeal.
What Does This Mean for Companies?
The public consultation allows companies to assess the proposal’s impacts on their activities and submit contributions before the final text is approved.
Sources: Draft Resolution submitted for public comment; Resolution CD/ANPD No. 1/2021; Regulatory Impact Assessment Report (RIA) – Enforcement and Sanctions under the ECA Digital / Revision of Resolution CD/ANPD No. 1/2021.