ANPD opens review of enforcement rules

Brazil’s ANPD has opened a public consultation on new rules for overseeing digital platforms and on revisions to its administrative enforcement and sanctioning procedures. The discussion followed a public hearing with 43 registered participants, including experts and representatives from the public and private sectors, according to available coverage.

What is the ANPD reviewing?

The ANPD is discussing updates to its enforcement process rules and its administrative sanctioning process. Coverage cited by ALT Digital LATAM says the public hearing was part of that process, and Portal do Holanda reported that the proposal includes changes to enforcement and administrative sanctioning procedures.

The central point is that the authority has put out rules for consultation that affect how oversight is carried out and how potential penalties are handled. For now, the available material describes a debate stage, not a finalized rule.

What obligations remain in force for companies?

Specialized publications consulted agree that operational duties already exist under the LGPD for security incidents. TI Inside says Resolution CD/ANPD No. 15/2024 requires notifying the ANPD and data subjects, within up to three business days, of incidents that could create relevant risk or harm.

That same coverage adds that the incident must also be recorded, even if it is not reported. RNP, for its part, links the resolution to the up to three-business-day deadline for reporting certain security incidents and recalls the administrative sanctions set out in Article 52 of the LGPD.

What changes between the consultation and current compliance?

The difference is that the public consultation is aimed at possible regulatory adjustments, while the deadlines for notification and recordkeeping are already described as current obligations in technical publications. In other words, the debate over new rules does not replace the duties that specialized sources attribute to Resolution CD/ANPD No. 15/2024.

Against that backdrop, the ANPD keeps the debate open on how digital platforms should be supervised, while the compliance community continues to focus on incident documentation and on the notification timelines already set out in the cited regulation.