Brazil has taken a significant step toward strengthening its data protection framework.
On September 18, 2025, Provisional Measure No. 1,317/2025 was published in the Federal Official Gazette, officially transforming the National Data Protection Authority (ANPD) into an independent regulatory agency. The change also grants the ANPD the legal status of a special autarchy linked to the Ministry of Justice and Public Security, with full technical, administrative, and financial autonomy.
With this move, the ANPD joins the list of regulatory agencies established under Law No. 13,848/2019, aligning its structure with institutions such as Anatel and Anvisa. This institutional upgrade significantly expands the ANPD’s powers to monitor compliance, impose sanctions, and influence public policies on privacy and data usage across the country.
Among its newly conferred responsibilities, the ANPD will oversee the enforcement of the recently enacted Digital Child and Adolescent Statute, which sets guidelines for protecting minors in virtual environments. The agency is also expected to assume a leading role in legislative debates on artificial intelligence currently underway in the National Congress.
Organizationally, the Provisional Measure creates a new career track for Data Protection Regulation and Oversight, comprising 200 permanent positions to be filled through public exams. These professionals will have police-like powers, including the authority to shut down establishments, seize equipment, and request police support when necessary.
Another key development is the ANPD’s inclusion in the Federal Management Board of the Fund for the Defense of Diffuse Rights (CFDD), thereby expanding its participation in public policies aimed at collective harm reparation—particularly in consumer protection and the digital environment.
The President of the Republic will be responsible for defining the agency’s new internal structure and staffing plan. The ANPD will have 30 days to submit a regulatory adaptation plan in accordance with the provisions of the Provisional Measure.
Although the measure takes immediate effect, it still must be approved by Congress within 120 days to be converted into law. If not ratified by mid-January 2026, it will lose its legal force.
The transformation of the ANPD into a regulatory agency is widely seen as a strategic institutional advancement that strengthens Brazil’s data protection culture. It also positions the country ahead of several Latin American nations—such as Bolivia, Honduras, Venezuela, and Nicaragua—that have yet to establish independent data protection authorities, despite increasing digitalization and international pressure to adopt global standards.
