11/11/2024
Celebrating four years of operation on November 6, the Brazilian Data Protection Authority (ANPD) sought to reaffirm its importance as a strategic partner for data privacy stakeholders in Brazil and released a series of documents and guidelines for the upcoming year.
As the moment is one of planning, for companies and organizations doing business in Brazil, the ANPD’s actions are vital in mitigating legal risks, strengthening consumer trust, and converging with data protection standards comparable to key jurisdictions across the globe.
In a constantly evolving regulatory landscape, understanding, and aligning with ANPD’s rules, resolutions, and directives is not just a matter of compliance but an opportunity to stand out in the competitive digital markets for Brazil.
During its anniversary events in Brasília, the ANPD released the policy priorities for 2025. Here are some of the main topics mentioned by ANPD’s representatives:
- Artificial Intelligence and Data Protection: The ANPD is focused on integrating the General Data Protection Law (LGPD) with artificial intelligence technologies, ensuring that AI usage is compatible with data subjects’ rights.
- Children and Adolescents’ Data Protection: This is a priority topic, with special attention given to data processing practices involving children and adolescents.
- Regulation of Data Subjects’ Rights: The ANPD plans to deepen the regulation of data subjects’ rights, providing clarity and practical guidance for both data subjects and data handlers.
- Data Protection Impact Assessment (DPIA): Standardizing and facilitating the preparation of DPIAs, making this process more accessible and useful for data handlers and oversight bodies.
- National Data Protection Policy: Developing a comprehensive national policy reflecting Brazil’s priorities and best practices in data protection.
- Regulation on Biometric Data: Creating clear guidelines for the use of biometric data, balancing security and privacy.
- Public Sector Data Sharing: Establishing clear and secure rules for data sharing among public entities.
- High-Risk Data Handling Guide: Providing parameters to identify and manage high-risk data handling.
- Minimum Technical Security Standards: Establishing minimum technical standards to ensure the security of personal data handling operations.
These priorities reflect ANPD’s commitment to improving the regulatory structure and data protection in Brazil, responding to technological changes and citizens’ security and privacy needs.
The second semester of 2024 was already marked by new mandatory resolutions for data controllers in Brazil, including those related to the obligation to appoint a data protection officer (DPO) (Resolution No.18/2024) and the main requirements and safeguards for international data transfers – IDTs (Resolution No. 19). As to IDTs, companies will have a deadline of 12 months from the date of publication of the Resolution No. 19 to adapt their processes, contracts, and privacy policies to meet the new requirements established by the ANPD. A transition period is designed to allow organizations to make the required adaptations.
Our Privacy and Data Protection team is available to provide clarification and guidance on those matters.
Coauthored by: Fabricio Bertini Pasquot Polido and Denise de Araujo Berzin Repuke
