ANPD intensifies initiatives for data protection regulation in Brazil

On May 28, after announcing a public consultation for a resolution regarding supervision and application of sanctions for Brazil’s General Data Protection Law (LGPD), the Brazilian Data Protection Authority (ANPD) launched a series of initiatives to intensify data protection regulation in Brazil.

Registration Open for Technical Meetings

On May 28, ANPD opened registrations for meetings to establish criteria for preparing Data Protection Impact Assessments. Six experts will be selected to propose answers to a series of related questions (see the questions here).

The meetings will take place on June 21, 23, and 25 at 10:00 am (GMT-3) and be broadcast on ANPD’s YouTube channel.

Approved by Ordinance No. 11 of January 27, 2021, this initiative is part of the ANPD’s 2021-2022 Regulatory Agenda. The agenda concerns several topics addressed by the LGPD that require further regulatory definition.

Guidelines on Controllers, Processors, and Data Protection Officers

ANPD also published guidelines for defining Personal Data Processing Agents (controllers and processors) and Data Protection Officers (DPOs) on May 28.

This non-binding document is the first of an instructive nature published by the ANPD, establishing:

• Eligibility criteria for entities to act as controllers, processors, or DPOs;
• Legal definitions for controllers, processors, and DPOs;
• Respective liability regimes;
• Practical examples related to ANPD guidelines; and
• Answers to frequently asked questions.

The current guidelines are subject to comments and contributions from civil society, which can be submitted to [email protected]. Contributions are in the process of being compiled, and the guidelines will be updated as new regulations and understandings are established by the ANPD.

The full document can be found in Portuguese on ANPD’s portal. An English translation can also be found here.

For further information about ANPD’s activities and data protection issues, contact Mattos Filho’s Data Protection and Cybersecurity practice area.