Ordinance No. 11 of the Brazilian data protection authority ('ANPD') was issued, on 28 January 2021, in the Official Gazette, regarding its Biannual Regulatory Agenda (2021-2022). In particular, the ordinance aims to aggregate the regulatory actions considered to be a priority for the ANPD. Furthermore, the ordinance provides a regulatory agenda divided into three phases.

• Phase 1, by the end of the first half of 2021:
  • publish the ANPD internal regulations;
  • publish the 2021-2023 strategic plan;
  • develop a differentiated regulation for small businesses;
  • edit regulations and procedures on personal data protection and privacy; and
  • edit regulations on reports of the impact of personal data protection in cases where the processing represents a high risk to guaranteeing the general principles of personal data protection.
• Phase 2, by the end of the first half of 2022:
  • launch a resolution on the question of the term required for reporting a security incident;
  • create a resolution on the nature and size of an entity or the volume of data processing operations; and
  • create guidelines on the international transfers of personal data.
•  Phase 3, by the end of the second half of 2022:
  • launch a resolution on the rights of data subjects; and
  • launch guides on best practices including the legal hypotheses for the legal bases for the processing of personal data.

You can read the ordinance, only available in Portuguese, here. 

UPDATE (2 February 2021) 

ANPD publishes Strategic Plan for 2021-2023 

The ANPD published, on 1 February 2021, its Strategic Plan for 2021-2023 containing the ANPD's mission, vision and values, in line with the ordinance. In particular, the report presents the goals that the ANPD intends to achieve, as well as the three strategic objectives for strengthening the culture of protection of personal data, establishing the effective regulatory environment for the protection of personal data, and improving the conditions for the performance of legal powers. 

You can read the press release, here and the report here, both only available in Portuguese.