Articles | Postado no dia: 25 August, 2026
ANPD Becomes a Regulatory Agency: What Does That Mean for Your Company?
In September 2025, Provisional Measure (MP) 1,317/2025 turned ANPD into an independent regulatory agency, granting it functional, technical, decision-making, administrative, and financial autonomy. Congress still needs to vote on the MP, but its effects are already in force, and companies can already feel the impact.
This change comes at a pivotal moment for the Authority’s growth: with reinforced autonomy, ANPD no longer depends on the Executive branch to exercise its powers and now has full regulatory authority, similar to agencies like ANATEL and ANVISA.
In practice, this includes the ability to apply much higher fines, carry out more intensive inspections, and run coordinated actions with other entities in the digital ecosystem.
This transformation also puts the agency at the center of internet regulation. The new ANPD will be responsible for overseeing compliance with the ECA Digital, supervising high-risk practices, and coordinating, together with ANATEL and CGI.br (Brazil’s Internet Steering Committee), administrative blocks on content or services when necessary, involving connection providers and .br domains.
With the expected growth of its technical staff and its newfound regulatory independence, the market is already anticipating a significant increase in inspections, including in-person ones, more sanctioning proceedings being opened, and faster enforcement of the authority’s rulings.
So, the “guidance-first” approach that marked the early phase of LGPD is expected to give way to a much more punitive and operational stance.
Companies will need to review their legal bases, consent mechanisms, processing records, data flow mapping, internal governance, incident response processes, and all the documentation that proves real compliance.
The trend is clear: ANPD will increasingly demand actual compliance. In a more mature, decisive regulatory environment, looking compliant “on paper” isn’t enough anymore, companies need to show technical, legal, and operational adherence to what LGPD requires today, and what it will require tomorrow.
Author: Yasmin Soares
