The Brazilian data protection authority ('ANPD') announced, on 8 November 2022, that it had approved its regulatory agenda for the biennium 2023-2024. In particular, the ANPD highlighted that one of the most prominent themes of the agenda is the regulation of dosimetry and application of administrative sanctions, as well as the criteria that will guide the calculation of the value of fines. On this point, the ANPD noted that the document on dosimetry and the application of administrative sanctions is in the final stage of preparation. In addition, the ANPD noted that the processing of personal data of children and adolescents will also be a prominent theme.

Furthermore, the ANPD outlined 20 items planned in the agenda which include:

• rights of the holders of personal data;
• incident reporting and notification deadline specification;
• international transfer of personal data;
• personal data protection impact assessments;
• personal data protection officer ('DPO');
• legal hypotheses for processing personal data;
• definition of high risk and large scale;
• anonymisation and pseudonymisation;
• sensible personal data and biometric data;
• security, technical, and administrative measures (including minimum technical security standards); and
• artificial intelligence ('AI').

You can read the press release here and the regulatory agenda here, both only available in Portuguese.

UPDATE: 5 January 2024

ANPD revises regulatory agenda for 2023-2024

On 29 December 2023, the Brazilian Data Protection Authority (ANPD) published a revised version of its regulatory agenda for 2023-2024.

What has changed in the regulatory agenda?

Items 15 and 16, relating to, respectively, establishing guidelines for the National Data Protection and Privacy Policy and regulating rules for good practices and governance, will be actioned until December 2024, instead of December 2023.

You can read the press release here and the regulatory agenda here, both only available in Portuguese.