Brazil's ANPD sets 2026-2027 data enforcement priorities

Brazil’s National Data Protection Authority (ANPD) published two documents on Wednesday: a map of priority enforcement themes for the 2026-2027 period and an updated version of its 2025-2026 regulatory agenda. The enforcement map sets four priorities: data subject rights; protection of children and adolescents in the digital environment; the processing of personal data by government bodies; and artificial intelligence and emerging technologies in the context of personal data processing. ANPD said publishing both resolutions together is meant to create coordinated action on regulating and enforcing the Digital ECA; more complex topics, such as verifying users’ ages, will initially be addressed through regulation and guidance, with enforcement and potential administrative sanctions following at a later stage. ANPD said the themes were drawn from two years of inputs gathered by its general fiscalization unit, including requests, incident reports, and enforcement actions, now consolidated into a 2023-2025 monitoring-cycle report and a technical note released the same day.

On enforcement, ANPD said planned activities include monitoring the secondary use of personal data for targeted advertising, verifying that organizations adopt by design and by default the most privacy-protective option available, and measures to prevent children and adolescents from accessing improper, inappropriate, or legally prohibited content. These activities will combine monitoring, guidance, and preventive action, and their schedule could be adjusted to stay compatible with regulations still needed to enforce new obligations created by Law 15.211, enacted on 17 September 2025, which instituted Brazil’s Digital ECA (Estatuto Digital da Criança e do Adolescente).

The updated regulatory agenda adds three items tied to the Digital ECA’s rollout: age-verification mechanisms; the scope and general obligations of information-technology product and service providers under the law; and enforcement and sanctions tied to two existing ANPD resolutions. ANPD said its planned revision of enforcement and sanctioning rules could include clarifications on how third parties and amici curiae participate in cases, as well as procedural deadlines, among other topics. On the rulemaking side, the agenda now includes an item aimed at aligning ANPD’s regulatory practices with Brazil’s 2019 regulatory-agencies law (Law 13.848/2019), following the agency’s recent conversion into a full regulatory agency; this will detail rules on public consultations, regulatory-impact analysis, and regulatory-outcome assessment, as well as procedures for how children and adolescents can take part in ANPD’s rulemaking process. A previously planned general item on personal-data processing involving children and adolescents will now be addressed through specific initiatives instead, including the forthcoming age-verification rule. Other previously planned items, including data subject rights, data protection impact reports, government data-sharing, and biometric data, remain on the agenda, with some start dates adjusted.

Why it matters

The map signals where Brazil’s privacy regulator will focus scrutiny first — children’s data and AI — giving companies operating in the country a concrete compliance timeline ahead of enforcement.