LGPD & DIGITAL LAW
The ANPD is now a regulatory agency: what changes for your company
Law 15,352/2026 turned the ANPD into Brazil's National Data Protection Agency, with autonomy and more structure to enforce. Understand the impact, the LGPD sanctions and how to prepare for incidents.
IN 30 SECONDS
- Since February 2026, the ANPD is an agency with autonomy and its own staff.
- Enforcement tends to demand evidence, not just written policies.
- Significant incidents must be reported within 3 business days.
- A data map and a tested response plan are the best defense.
On February 25, 2026, Law 15,352 turned Brazil’s National Data Protection Authority into the National Data Protection Agency. The acronym is still ANPD, but its weight is different: the agency gained its own structure and more capacity to regulate and enforce. For companies the message is simple: Brazil’s data protection law (LGPD) has entered a more mature enforcement phase.
What changed in practice
- An autonomous agency
The ANPD becomes a federal agency linked to the Ministry of Justice, with functional, technical, decision-making, administrative and financial autonomy. - More people to enforce
The law created 200 permanent positions for regulation and data protection specialists, to be filled through public exams. - More responsibilities
The agency also regulates and enforces the Digital ECA, the law protecting children and teenagers online, in force since March 17, 2026. - Higher evidence bar
In an inspection, a written policy is not enough: you need records, routines and trails that prove it works.
LGPD sanctions still apply
The LGPD already provides for warnings, fines of up to 2% of revenue in Brazil capped at R$ 50 million per violation, daily fines, publication of the violation, blocking and deletion of data and even suspension of processing. With a better-equipped agency, the likelihood of these sanctions being applied grows.
Security incidents: the most sensitive point
Leaks and unauthorized access are the most common path to an inspection. Under the ANPD regulation (Resolution CD/ANPD No. 15/2024), when an incident may cause significant risk or harm to data subjects, the company must notify the ANPD and the data subjects within 3 business days and keep a record of the incident for at least 5 years.
| Unprepared | Prepared |
|---|---|
| Nobody knows who decides on notification | Committee and roles defined in the response plan |
| Volume of exposed data unknown | Breach audit measures volume and root cause |
| Evidence lost in the rush | Evidence preserved with chain of custody |
| 3-business-day deadline missed | Notification templates ready |
What your company should do now
- Update your data map
Know which personal data you process, why, on what legal basis and with whom you share it. - Test your incident response plan
Run a drill and check that the company can meet the 3-business-day deadline. - Organize the evidence
Processing records, impact assessments, vendor contracts and data subject requests. - Review vendors
Many breaches start with third parties that have access to your data. - Check whether the Digital ECA applies
If your product can be used by children or teenagers, there are new obligations.
Where Gestão de TI comes in
We combine legal and technical analysis: breach audits with root cause, evidence preservation and support with notifying the ANPD and data subjects.
Quick checklist
- Data map up to date
- Incident response plan tested
- ANPD and data subject notification templates ready
- Incident records kept for 5 years
- Vendors assessed
HOW GESTÃO DE TI CAN HELP
Law & Technology
LGPD compliance, incident response and ANPD notification, with a legal and technical view.
For information only. This does not replace a professional review of your specific case. Legal references reflect the rules in force on the publication date (Brazilian law).