BRAZIL Trends and Developments Contributed by: Ana Paula Bialer, Bialer Falsetti Associados
Introduction As our lives become more digital, privacy and data protection have increasingly turned into an everyday topics and concerns. In the past decade, the con - cept of informational self-determination has ceased to be restricted to the world of privacy professionals and has become a topic of dinner-table conversa - tions among friends. These conversations touch basic human rights as well as political decisions by global leaders. This coming year is set to represent a turning point for privacy and data protection in Brazil. As of 2026, the Brazilian Data Protection Authority, an entity which previously had administrative and financial con - straints, has been transformed into a national regula - tory body, with technical, administrative and financial autonomy. The Agency will more than double the number of employees dedicated to carrying out its legal mandate. As a result, the responsive approach that has characterised the Agency’s activities is likely to gradually evolve to a more robust one, with numer - ous enforcement activities and potentially heavier In addition to the transformation of its legal nature, with the increase in both financial and human resources, the Brazilian Data Protection Agency (ANPD) enters 2026 with a new mandate: it has become the organi - sation within the Federal Administration responsible for enforcing the Brazilian Minors’ Online Safety Law, known as the ECA Digital, that was enacted in Sep - tember 2025. The centrality of this topic for the Agency’s activities is such that the Regulatory Agenda for the 2025–2026 biennium was updated at the end of the year, expand - ing the agenda to include aspects of the implementa - sanctions being applied. Protection of Children • the scope and general obligations of the ECA Digi - tal applicable to suppliers of information technol - ogy products or services; and • oversight and sanctioning of the ECA Digital, including the revision of existing resolutions around proceedings and enforcement procedures. tion of the ECA Digital, namely: • age verification mechanisms;
The regulatory initiative includes the preparation of a guidance document to clarify the main concepts relat - ed to the scope of application of the ECA Digital, as well as the duties applicable to information technology products or services. Additionally, the introduction of interpretative guidelines is important for ensuring a proper understanding of the scope of application of the ECA Digital and providing greater legal certainty for regulated entities in the process of implementing the law. An upcoming guideline will also establish clarifications on the duties of prevention, protection, information, and security, which are some of the most challenging concepts to be defined within the new framework. Establishing boundaries to ensure that organisations are clear on what needs to be done will be critical for the purposes of regulatory compliance. While there is an international trend towards online safety laws with specific provisions around minors, age verification and assurance mechanisms being increasingly considered and a call for more tools for parent supervision, Brazil seems to have taken the lead with a more structured and comprehensive set of obligations. Time will tell if all these duties can be implemented without substantially disrupting the online experience for both minors and adults. Priorities for Regulation and Enforcement in Brazil A map of priorities for 2026-2027 was published by ANPD at the end of the year. This is an important indication as to which areas the ANPD will focus its attention and enforcement initiatives, and therefore where additional caution should be taken by process - ing agents. Among others, the following key topics were identified. • Rights of personal data subjects, especially regard - ing the processing of biometric data: the ANPD has emphasised technical security measures and the underlying legal basis, eg, health and financial data. This has been one of the most challenging topics since the approval of the Brazilian Data Pro - tection Law (LGPD) in 2018 as it raises numerous questions from processors on the correct approach for implementation. Decisions usually involve substantial investments in processes, systems and personal training. Furthermore, specific aspects of the Brazilian market may require regulations that
27 CHAMBERS.COM
Powered by FlippingBook