🛡️ Brazil gains a new guardian of privacy: ANPD is now a regulatory agency

Brazil has just taken a historic step in personal data protection.

The National Data Protection Authority (ANPD) has been transformed into the National Data Protection Agency, gaining technical, financial, and decision-making autonomy, a game-changing move for the enforcement of Brazil’s General Data Protection Law (LGPD).

With its new structure, the ANPD now has its own assets, a team of 200 specialists, and the same institutional status as agencies like ANATEL and ANAC. This means greater independence and a stronger ability to oversee compliance, impose sanctions, and issue regulations with less political interference. Until now, limited resources and authority had constrained its effectiveness, making LGPD enforcement rather timid in practice.

In Europe, even under the powerful GDPR, only about 0.6% of imposed fines had actually been paid by 2024. Proceedings there are lengthy, and bureaucracy slows the execution of sanctions. In Brazil, expectations are different: with the ANPD elevated to agency level, the country could see faster action, real authority, and, at last, a regulatory framework capable of ensuring that the law is truly enforced.

This shift is part of a broader government agenda to strengthen digital governance. Alongside the new ANPD, Congress is debating the Artificial Intelligence Act, which will set ethical and transparency standards for algorithmic use, and the Cybersecurity Legal Framework, designed to establish a national incident response system and protect critical infrastructure. Together, these initiatives signal a country beginning to view privacy and information security not merely as technical matters, but as strategic pillars of sovereignty and innovation.

Personally, I believe that if the ANPD wields its new powers with the same rigor that ANATEL applies to telecommunications or ANAC to aviation, Brazil could become the first country in the world to truly enforce its data protection law. It will take courage, expertise, and transparency—but the path is open.

Now it’s up to companies to understand: privacy is no longer a competitive advantage. It’s a matter of survival.