The public consultation on ANPD enforcement broadens the scope of the rules and creates interim measures backed by a daily fine.
ANPD enforcement may soon be governed by new rules. On 9 September, the ANPD (Brazilian National Data Protection Authority) opened a public consultation on the draft amending Resolution CD/ANPD No. 1/2021. That instrument currently governs the enforcement procedure and the administrative sanctioning procedure. In addition, the proposal creates a specific regime of interim measures. Lastly, the deadline for contributions runs until 26 October.
What changes in ANPD enforcement
First, the draft changes the name of the regulation. It will now be called the Regulation on Enforcement Activities and on the Administrative Enforcement Procedure. In practice, the text reorganises the entire structure of enforcement action.
Enforcement activities will now comprise monitoring, guidance, prevention and repression. In turn, the administrative enforcement procedure covers the investigative and the sanctioning procedures. It also includes the procedures for reporting and investigating security incidents.
The point of greatest impact lies in the ANPD’s interim measures. The Enforcement Superintendence will be able to adopt them without a prior statement from the regulated entity. To that end, it will suffice to find a danger of harm or a risk to the useful outcome of the proceedings. The criteria include the likelihood of irreversible harm and actual or imminent harm to fundamental rights.
The interim decision may be appealed to the Board of Directors, but without suspensive effect. Moreover, the ANPD will be able to impose a daily fine to ensure compliance with the measure. That amount is subject to an overall cap of BRL 50 million. On the other hand, the draft prohibits interim measures that, on a standalone basis, order the moderation of unlawful content.
The proposal also sets out rules on the duties of regulated entities. For example, the company will have to register an external user in the SEI system (the electronic case management system used by Brazilian federal authorities) as early as its first submission. From then on, all official communications will take place through that channel. Likewise, any party claiming confidentiality must precisely identify each restricted piece of information and its legal basis. Without such identification, the document will be publicly accessible.
Another new feature is the amicus curiae. Organisations with adequate representativeness will be able to request admission to the proceedings. The deadline is thirty consecutive days after publication of the order instituting the proceedings. However, admission is at the discretion of the Enforcement Superintendence and the decision is not subject to appeal.
Finally, the unjustified refusal to provide information will carry clearer consequences. In addition to possible obstruction of enforcement, there will be a presumption that uncontested facts are true. The draft further presumes that documents not produced do not exist.
Who is affected by the ANPD enforcement regulation
The scope of the regulation grows significantly. Today, the rules cover data subjects and processing agents. Under the draft, they will also apply to two further groups.
- Suppliers of information technology products or services directed at children and adolescents, or likely to be accessed by them, under Law No. 15,211/2025.
- Internet application providers, as regards users’ rights and the duties laid down in the Marco Civil (Brazilian Internet Civil Rights Framework) and in Decrees No. 8,771/2016 and No. 12,976/2026.
In other words, companies that do not process data as their main activity may come onto the authority’s radar. In addition, the amendments apply to all proceedings pending on the date of entry into force. The draft preserves only the procedural acts already performed. Ongoing enforcement proceedings will be converted into investigative procedures.
What still depends on regulation
The draft has not yet been approved. Accordingly, the 2021 text remains in force until the new resolution is published. However, the number and date of the future instrument remain open.
The portion of the draft that has been made available also does not detail the sanctioning procedure or any changes to penalties and their calculation. For this reason, these points deserve monitoring in the next stages of the consultation.
What to do now
In the meantime, companies may take certain steps in advance:
- Check whether their activity falls within the new groups of regulated entities.
- Organise internal workflows for responding to requests for documents and information.
- Determine who will be the user registered in the SEI system and who will receive notifications.
- Establish a routine to identify confidential information and prepare public versions of documents.
- Assess whether it is advisable to submit a contribution to the consultation by 26 October.
In short, the new regime of interim measures without a prior statement calls for heightened attention from regulated entities, particularly in view of the daily fine. The firm continues to monitor the matter and publishes further legal news with commentary on regulation and data protection.