17 de março de 2026
Share
New law transforms the ANPD into a regulatory agency and strengthens data governance in Brazil
On February 25, 2026, President Luiz Inácio Lula da Silva enacted Law No. 15,352/2026, resulting from the conversion of Provisional Measure No. 1,317/2025. The statute transforms the National Data Protection Authority into the National Data Protection Agency (ANPD), granting it the legal status of a special-regime autonomous agency and formally incorporating it into Brazil’s institutional framework of federal regulatory agencies.
The new law represents an additional step in the institutionalization of Brazil’s data protection policy. Under the new framework, the ANPD is endowed with functional, technical, decision-making, administrative, and financial autonomy, as well as its own assets and headquarters in the Federal District, pursuant to Article 55-A of the General Data Protection Law (Law No. 13,709/2018). The statute also provides for the institutional succession of the former authority by the new agency, ensuring continuity in ongoing regulatory activities, administrative proceedings, and judicial actions.
With the ANPD’s inclusion among Brazil’s regulatory agencies, the creation of careers and the organization of its personnel structure will follow the framework established by Law No. 10,871/2004. In practical terms, the authority will establish a regulatory and supervisory career track for data protection, including specialist positions to be filled through public competitive examinations. Supported by its own technical structure, agency officials will also exercise prerogatives typical of administrative police powers, such as the authority to order the closure of establishments, seize goods, and request assistance from federal or state police forces in cases of resistance. These measures are expected to enable more sophisticated audits and more agile enforcement proceedings, strengthening the mechanisms for implementing the General Data Protection Law and related legislation.
The transformation occurs at a time when the agency’s regulatory responsibilities are expanding. One of the factors driving the reform is the entry into force, on March 17, 2026, of the Digital Statute for Children and Adolescents (Law No. 15,211/2025). The statute establishes significant obligations for digital platforms, including age-verification requirements and restrictions on minors’ access to certain types of content, the implementation of which will depend to a large extent on the regulatory and supervisory role of the ANPD.
In this context, the conversion of the authority into a regulatory agency is intended to strengthen its institutional capacity to oversee compliance with data protection legislation and related regulatory frameworks. In a scenario in which personal data have become a central input of the digital economy, the strengthening of the ANPD signals the consolidation of a more structured and permanent regulatory environment for data governance in Brazil.
The full text of Law No. 15,352/2026 may be accessed at: L15352.
