The institutional transformation
Law 15.352/2026 (February 25, 2026) establishes the National Data Protection Authority (ANPD) as a full regulatory agency with operational and financial autonomy.
What changes in practice
- Own budget and greater financial autonomy
- Specialized career track: 200 effective Data Protection Specialist positions
- Full regulatory power: can publish binding technical norms
- Expanded enforcement power: deeper, more technical audits
- Administrative sanctions with more robust criteria
Priority enforcement areas in 2026
- Data subject rights: service quality, response times
- Children and adolescent data: including Digital ECA (Law 15.211/2025)
- Data processing by Public Power
- AI and emerging technologies
Fines and sanctions in 2026
- Daily fine: up to R$ 50,000 per day of non-compliance
- Per-infraction fine: up to 2% of revenue of the last fiscal year, capped at R$ 50 million per infraction
- Partial or total suspension of the database
- Blocking of personal data referenced in the infraction
For international companies
If your company processes data of Brazilian residents, the LGPD applies. The new agency status of ANPD means more sophisticated cross-border enforcement coordination with EU GDPR authorities and others.