backANPD Publishes Regulatory Agenda for the 2025-2026 Biennium
On Wednesday, December 11, 2024, Brazil’s National Data Protection Authority (ANPD) announced its Regulatory Agenda for the 2025-2026 biennium, a critical roadmap for planning and executing priority regulatory actions. The agenda was developed through public consultation, and the document underscores the collaborative and transparent nature of the regulatory process.
The Regulatory Agenda serves as a decision-making tool by providing a structured plan for the Authority’s actions and priorities, fostering transparency and predictability. This enables stakeholders and society to anticipate regulatory changes, better preparing for informed decision-making aligned with best practices.
Highlights of the 2025-2026 Agenda
The new agenda builds upon themes from the previous biennium while introducing new priorities, such as regulating personal data aggregators, sensitive health data, and legal basis for consent and credit protection. These topics are categorized into four prioritization phases, each with specific timelines for the initiation of regulatory processes:
- Phase 1: Topics carried over from the 2023-2024 agenda.
- Phase 2: Topics to begin within one year.
- Phase 3: Topics to begin within 18 months.
- Phase 4: Topics to begin within two years.
Key Regulatory Topics
The agenda outlines 16 priority actions for the upcoming biennium, including:
- Data subject rights
- Data Protection Impact Assessment (DPIA)
- Data sharing by public authorities
- Processing of personal data for children and adolescents
- Sensitive personal data, such as biometric and health data
- Security measures: technical and administrative
- Artificial intelligence
- High-risk data processing
- Religious organizations
- Anonymization and pseudonymization
- Guidelines for the National Policy on Protection of Personal Data
- Rules on best practices and governance
- Personal data aggregators
- Legal basis: consent and credit protection
The agenda reaffirms the ANPD’s commitment to fostering an inclusive, balanced, and forward-looking data protection framework.
share
