On August 14, 2026, Law No. 13,709/2018, known as the LGPD (Brazilian General Data Protection Law), will complete eight years since it has been published. During this period, Brazil’s data protection regulatory framework has undergone transformations that consolidated the topic as a priority for companies, government agencies, and citizens. The Brazilian Data Protection Agency (ANPD) has demonstrated institutional maturity that now translates into concrete enforcement actions.
Regulatory advances and institutional evolution of ANPD
The field of data protection has advanced significantly since then. Regulations now cover international data transfers, processing of personal data of children and adolescents, and the role of data protection officer (DPO), among other topics.
ANPD initially operated as an agency linked to the Executive Branch with a limited administrative structure. Over the years, it has gained administrative and financial autonomy and consolidated itself as the Brazilian Data Protection Agency, with decision-making independence and an active presence in addressing the topic in the country. This transition represented a relevant step toward institutional evolution. With its new structure, ANPD expanded its enforcement capacity, strengthened dialogue with the private sector, and achieved greater institutional robustness in applying LGPD.
ANPD monitoring and enforcement cycles
Within the scope of ANPD’s activities, its sanctioning role has also evolved over the eight years since LGPD has been published, adopting an increasingly active stance in its monitoring, guidance, prevention, and repression activities. In this context, monitoring works as an enforcement sensor with broad scope and an initial surface-level perspective, aimed at detecting anomalies and selecting cases that require deeper examination. Based on this information, ANPD organizes actions to assess compliance, manage regulatory risks, and correct inappropriate practices when necessary.
To provide greater clarity on this monitoring trajectory, ANPD publishes its Monitoring Cycle Report and its Priority Themes Map as central instruments for society to follow developments in the area. See more details about the current ANPD Priority Themes Map for the 2026-2027 biennium here.
Appointment and disclosure of DPO contact information
As a milestone near the beginning of the eighth year since the LGPD has been published, ANPD concluded in July 2026 the first phase of two monitoring processes aimed at assessing compliance with basic obligations, namely: (i) the appointment of data protection officers and (ii) the provision of communication channels between controllers and data subjects.
Of the 56 data processing agents evaluated (including government agencies and private companies), 27 (half of which were private companies) fully complied with the Agency’s requests, while another 8 still have pending issues to correct within the granted period. Besides, 21 entities did not respond to ANPD"s requests for compliance, and the list was forwarded to the General Coordination of Sanctions for analysis and appropriate measures.
These data demonstrate that the private sector is also under ANPD scrutiny, despite the relevant focus on the public sector (driven in part by an audit conducted by the General Accounting Office that identified entities that did not appoint DPOs). Collaboration with the Agency is essential to avoid sanctions.
Companies that have not yet formally appointed a DPO or that do not provide accessible communication channels to data subjects should address these issues urgently. They should also seek to collaborate with the Agency if contacted. The DPO serves as a communication channel between the controller, data subjects, and ANPD itself. This role is central to data governance within any organization.
Eight years after the LGPD has been published, Brazil’s regulatory environment features a mature authority with consolidated enforcement instruments and institutional willingness to use them. The intensification of enforcement requires organizations to review their compliance programs and anticipate ANPD’s next actions, especially regarding the priority topics for 2026-2027. Proactive preparation has become an essential regulatory risk management measure.
