ANPD (Brazil)
Definition
The ANPD (Autoridade Nacional de Proteção de Dados) is Brazil's data protection authority, responsible for regulating, guiding and enforcing compliance with the LGPD.
The ANPD's powers are set out in LGPD Arts. 55-A to 55-L. Originally created within the federal administration, it later gained the status of an autonomous agency with technical and decision-making independence. A Board of Directors (Conselho Diretor) issues its regulations, known as Resoluções CD/ANPD, and a National Council for Personal Data Protection and Privacy provides advisory input.
Its main functions are issuing regulations and guidance, receiving complaints from data subjects, supervising and sanctioning controllers and processors, and promoting awareness. Regulations already issued cover, among other topics, the inspection and sanctioning process, small processing agents, security incident reporting, the role of the encarregado and international transfers with standard contractual clauses. Sanctions under Art. 52 include warnings, fines, publicising the infraction, blocking or deleting data and suspending processing.
The ANPD has also signalled a role in AI governance in Brazil. Example: after a ransomware attack exposing customer records, a company files an incident report with the ANPD within three working days and may later be asked for additional information.
Where this term is assessed
Assessed in the Data Protection & AI Professional (DPAI), domain 7: Governance and audit.
Primary sources
- LGPD Arts. 55-A to 55-L
- Resoluções CD/ANPD