First announced: Regulatory resolutions issued by Brazil’s National Data Protection Authority (ANPD) during 2025.
Submitted by: NYBACS Compliance Desk
What changed
The ANPD clarified administrative sanction procedures, reporting obligations, and compliance program requirements. Enhanced oversight applies to high-risk processing and sensitive data categories.
Who’s affected
Companies operating in Brazil or processing Brazilian personal data, especially digital services and marketing entities.
Immediate actions
• Update data governance documentation.
• Review lawful basis for sensitive/children’s data.
• Prepare internal sanction-response procedures.
Practical notes & timeline ANPD continues active inspections in 2026. Enforcement intensity is increasing, particularly for large data controllers.



