

Data protection authority approves regulation on supervision and enforcement procedures
Regulation specifies certain measures to monitor, guide, enforce and avoid sanction processes
Subjects
On October 28, 2021, The Brazilian Data Protection Authority (ANPD) exercised its normative, supervisory, and sanctioning powers to approve the Regulation on Supervision and Sanctioning Procedures, which covers how the administrative sanctions provided for in the Brazilian Data Protection Law (LGPD) are applied.
Having released a draft regulation for public consultation on May 28, 2021, the ANPD has approved the final version following five months of deliberation. This latest regulation is part of the ANPD’s 2021-2022 Regulatory Agenda, set forth in an ordinance published on January 27, 2021, concerning the regulation of several issues that were provided for in the LGPD yet required further definition.
The regulation specifically describes all phases of the administrative sanctioning process. It also outlines the ANPD’s measures in order to monitor, guide, enforce and avoid sanctions, with enforcement now occurring via a specific process included in the new regulation.
Nevertheless, the ANPD has yet to publish the criteria for pecuniary sanctions, which according to the LGPD are set to be the subject of another specific regulation.
As the ANPD itself has indicated, there is an expectation that it will:
- Plan and support monitoring activities with relevant information;
- Analyze processing agents’ compliance with personal data protection measures;
- Consider regulatory risks based on the processing agents’ behavior to appropriately allocate resources and adopt compatible measures;
- Prevent irregular practices;
- Promote a stronger data protection culture; and
- Correct irregular practices, acting to minimize and compensate for damages.
The new regulation was officially published on October 29, 2021, and can be accessed here (in Portuguese).
Mattos Filho’s specialists have also created a flowchart outlining the new regulation’s changes and impacts.
For more information on the ANPD’s supervision and enforcement of sanctions, please see Mattos Filho’s Data Protection and Cybersecurity practice.