ANPD regulations: what to comply with in 2026

Brazil’s LGPD (General Data Protection Law) says what to do; the resolutions of the ANPD’s Board of Directors say how, how fast and with which document. On 30 October 2026, the ANPD’s official regulations page lists 13 resolutions, but only some of them create work for companies. This map separates those rules, summarises what each one requires in practice and the deadlines that matter, and lists the evidence you should be able to produce on the day the ANPD asks.

If your company is still building the foundations (data inventory, legal bases, data protection officer and incident workflow), start with the practical LGPD compliance checklist. This article picks up where it ends: the layer of regulations that turns the articles of the law into deadlines, forms and documents.

What is on the map and what is not

On 30/10/2026, the ANPD regulations page lists 13 resolutions, none marked as revoked. Six are the ANPD’s own planning instruments (agendas and priority-topic maps) and create no duties for companies. That leaves seven with a direct effect on operations.

Two changes of context are worth noting. The ANPD became the National Data Protection Agency under Law No. 15,352/2026, which converted Provisional Measure No. 1,317/2025. And the agency gained powers under the Digital Statute of Children and Adolescents (Law No. 15,211/2025, known as the ECA Digital), which explains the ongoing review of the enforcement and sanction regulations.

The map in one table

Resolution	Topic	What it requires in practice	Key deadlines
CD/ANPD No. 15/2024	Security incident notification	Assess the risk, notify the ANPD through the online form and notify data subjects, record every incident	3 business days; supplement within 20 business days; records kept for 5 years
CD/ANPD No. 18/2024	Data protection officer (encarregado)	Formal appointment, a deputy, publication on the website, resources and autonomy, conflict-of-interest management	Present the appointment when the ANPD asks
CD/ANPD No. 2/2022	Small-scale processing agents	Prove eligibility; use the simplified rules only if there is no high-risk processing	15 days to prove eligibility; deadlines doubled
CD/ANPD No. 19/2024 and No. 32/2026	International transfers	Choose the mechanism under art. 33 of the LGPD, use the standard clauses unchanged, publish a transparency notice	Standard clauses incorporated by August 2025; full clauses to the data subject within 15 days
CD/ANPD No. 1/2021	Enforcement and sanction proceedings	Provide documents and access, keep records, appoint a representative, comply with preventive measures	Deadlines in business days; defence and appeal within 10 business days
CD/ANPD No. 4/2023	Sanction calculation and application	No new document, but it defines what counts as a mitigating or aggravating factor	Mitigating factors depend on when the company acts

Incident notification: the rule with the shortest clock

CD/ANPD Resolution No. 15/2024 requires the controller to notify the ANPD and data subjects of any incident that may cause relevant risk or harm. Under art. 5, that happens when the incident may significantly affect fundamental interests and rights and involves at least one of these criteria: sensitive data; data of children, adolescents or older people; financial data; system authentication data; data protected by confidentiality; or large-scale data.

The deadline is three business days from the moment the controller learns that the incident affected personal data (arts. 6 and 9). What usually holds teams back is the formal side:

Who signs. The notification is made by the data protection officer, with a document proving the employment or contractual link, or by a representative with a power of attorney. These documents go with the notification, within the same deadline (art. 6, §§ 5 and 6). Have them ready before any incident.
What to report. Art. 6, § 2 lists twelve items, including the number of data subjects affected, security measures before and after the incident, risks and root cause. Anything missing can be supplemented, with justification, within 20 business days.
How to tell data subjects. Directly and individually, in plain language; if that is not feasible, through a public notice visible for at least three months. The controller then files, within three business days, a statement that data subjects were notified (art. 9, § 4).
What to keep. Every incident, notified or not, goes into the record, kept for at least five years, with the date of awareness, the risk assessment and, where applicable, the reasons for not notifying (art. 10).

The ANPD can also request, at any time, the record of the processing operations affected, the data protection impact assessment (RIPD) and the incident handling report (art. 8).

Data protection officer: a formal appointment, not just an email in the footer

CD/ANPD Resolution No. 18/2024 requires a formal act of appointment: a written, dated and signed document setting out how the officer works and what they do, to be presented to the ANPD on request (art. 3). It also requires a formally designated deputy (art. 4) and publication of the officer’s identity and contact details in a prominent place on the website (art. 9).

The officer may be internal, external or a legal entity, with no mandatory certification (arts. 12 and 14). The company must give them resources, technical autonomy and direct access to senior management (art. 10), and avoid the conflict of interest that arises when they also take strategic decisions about the processing itself (art. 19). Responsibility for compliance lies with the processing agent, not with the officer (arts. 11 and 17).

Small-scale agents: flexibility with conditions

CD/ANPD Resolution No. 2/2022 covers micro-enterprises, small businesses and start-ups, among others. The flexibilities include an exemption from appointing a data protection officer (provided there is a channel for data subjects), a simplified record of processing, a simplified information security policy and doubled deadlines, including for incident notification, as reworded by Resolution No. 15/2024.

There are three conditions. First, agents that carry out high-risk processing, earn more than the small-business ceiling (BRL 4.8 million under Complementary Law No. 123/2006) or belong to an economic group above it cannot use the differentiated regime (art. 3). Second, high risk combines a general criterion (large scale or significant effect on rights) with a specific one, such as emerging technology, automated decisions or sensitive data (art. 4). Third, the company must prove its eligibility within 15 days when the ANPD asks (art. 5).

International transfers: standard clauses and transparency

CD/ANPD Resolution No. 19/2024, corrected on 18/08/2025, regulates the transfer mechanisms under art. 33 of the LGPD that depend on the ANPD. Agents already using contractual clauses had 12 months from publication on 23/08/2024 to incorporate the standard clauses approved by the ANPD. That deadline ended in August 2025. The standard clauses must be adopted in full and without changes to the text.

The rule also creates transparency duties: give data subjects the full clauses within 15 days on request, and publish on the website, in Portuguese, an explanation of the transfer covering purpose, destination country, responsibilities and rights (art. 17). Since January 2026, CD/ANPD Resolution No. 32/2026 recognises the European Union, plus Iceland, Liechtenstein and Norway, as offering adequate protection. For these destinations, transfers may rely on the adequacy decision, which will be reassessed in four years. The most common case is cloud and SaaS providers, a topic covered in supplier risk management.

Enforcement and sanction calculation: the rules of the game

CD/ANPD Resolution No. 1/2021 lists the duties of those being supervised (art. 5): provide documents in the requested deadline and format, give access to systems and premises, submit to audits, keep records for the legal periods and throughout proceedings, and appoint a representative with knowledge and autonomy. Before any sanction, the ANPD can use preventive measures such as a warning, a request for regularisation and a compliance plan; failing to comply counts as an aggravating factor in any later sanction proceedings (art. 32, § 2). Defence and appeal each have ten business days.

CD/ANPD Resolution No. 4/2023 defines how sanctions are calculated. For this map, three points matter: obstructing enforcement is a serious infringement in itself (art. 8, § 3, II); mitigating factors such as ending the infringement or having a good-practice and governance policy depend on when the company acts; and the infringer bears the burden of proving it meets the conditions for mitigation (art. 13, § 3). Evidence organised before proceedings is worth more than evidence assembled during them.

What is under review

According to the ANPD, the update to the enforcement and sanction-proceedings regulation was under public consultation until 26 October (ANPD), and the update to the sanction-calculation regulation opened in October, with contributions until 30 November, to include the agency’s new powers, such as those under the ECA Digital (ANPD). Until the final texts are published, Resolutions No. 1/2021 and No. 4/2023 apply. The official list also contains no specific resolution on the data protection impact assessment (art. 38 of the LGPD), which the ANPD can already require.

To prioritise, use CD/ANPD Resolution No. 30/2025, the Priority Topics Map for 2026-2027, which directs enforcement towards data subject rights (with emphasis on biometric, health and financial data), children and adolescents, the public sector and artificial intelligence.

How to organise the evidence

For each regulation, define an owner, a control and dated evidence. A minimum file:

Incidents: a risk assessment procedure using the art. 5 criteria, a notification template, signed representation documents, and an incident record with five years of history.
Data protection officer: the formal appointment and the deputy’s, a dated screenshot of the website notice, a conflict-of-interest statement, and a record of when the officer was consulted on relevant decisions.
Small-scale agents: an eligibility and high-risk analysis, reviewed every year or whenever revenue changes.
Transfers: an inventory of transfers by supplier and country, the mechanism used, contracts with the standard clauses and the transparency page.
Enforcement: a named representative, a retention policy and an index that makes it possible to deliver documents in the requested format.

When the same controls serve the LGPD, ISO 27001 and sector rules, it pays to reuse them in a single base. The guide to choosing a GRC platform in Brazil shows what to ask of a tool in this scenario, and the GRC software guide covers the general evaluation criteria.

Where Eagle fits

Futture’s Eagle GRC module was designed to centralise frameworks, requirements, policies, controls, evidence and action plans in a reusable model, with the option of adding custom requirements, such as those from ANPD resolutions. It does not submit incident notifications to the ANPD, which are made through the official form, nor does it replace legal analysis or the data protection officer.

Sources consulted on 30/10/2026: the ANPD regulations page; the resolutions cited, in the Official Gazette (DOU) and on gov.br/anpd; the LGPD, Law No. 15,352/2026 and Complementary Law No. 123/2006, on the Planalto website; ANPD news on the public consultations. This article is for information only and does not constitute legal advice; consult the official text of the rules.

Frequently asked questions

What is the deadline for notifying the ANPD of a security incident?

Three business days from the moment the controller learns that the incident affected personal data, when it may cause relevant risk or harm to data subjects (CD/ANPD Resolution No. 15/2024). The same deadline applies to notifying data subjects. The information can be supplemented within 20 business days. Small-scale processing agents have twice the time, provided they qualify under CD/ANPD Resolution No. 2/2022.

Does appointing a data protection officer require a formal document?

Yes. CD/ANPD Resolution No. 18/2024 requires a formal written, dated and signed act setting out how the officer works and what they do, to be presented to the ANPD on request. The rule also requires a formally designated deputy and publication of the officer’s identity and contact details in a prominent place on the website.

Can I still use my own contractual clauses for international transfers?

Agents using contractual clauses had until August 2025, 12 months after CD/ANPD Resolution No. 19/2024 was published, to incorporate the standard clauses approved by the ANPD, which must be adopted without changes. Specific clauses that differ from the standard ones require ANPD approval. For the European Union, Iceland, Liechtenstein and Norway, CD/ANPD Resolution No. 32/2026 allows reliance on the adequacy decision.

Will the ANPD’s enforcement and fine rules change?

They are under review. The update to the enforcement and sanction-proceedings regulation was under public consultation until 26 October 2026, and the update to the sanction-calculation regulation is open for contributions until 30 November 2026, to include powers such as those under the ECA Digital. Until the new texts are published, CD/ANPD Resolutions No. 1/2021 and No. 4/2023 apply.

ANPD regulations: a map of what your company must comply with