On September 17, 2025, Provisional Measure No. 1,317 was issued, marking a new chapter in the governance of personal data protection in Brazil. This measure transforms the National Data Protection Authority (ANPD) into an autonomous regulatory agency, linked to the Ministry of Justice, granting it greater technical robustness, organizational stability and improved conditions to implement legal provisions and continue its ongoing work. The ANPD thus officially becomes the National Data Protection Agency.

This change consolidates a cycle of evolution that began with the creation of the ANPD. By assuming the status of regulatory agency, the ANPD now has a more stable, reinforced and predictable structure to carry out its rulemaking, supervisory and enforcement roles in the national privacy and digital rights landscape, as well as its function as an autonomous administrative authority for the protection of children and adolescents in digital environments.

The provisional measure also provides for the creation of specific career tracks within the ANPD, in addition to commissioned posts and trust positions aimed at strengthening the agency’s structure. The objective is to equip it with qualified human resources and sufficient technical capacity to keep up with the exponential growth of personal data processing and the complexity of the digital ecosystem.

For companies and data controllers, this transformation signals a scenario of increased regulatory demands and potential intensification of supervisory and enforcement actions. It will be essential to closely monitor the rules and guidance to be issued in order to adjust processes, policies and practices to the new expectations for LGPD and Digital ECA oversight and enforcement.

We will continue to closely monitor all updates and regulations related to Provisional Measure No. 1,317/2025 and remain at our clients’ disposal to support their adaptation to the new guidelines, contributing to increasingly responsible, secure and best-practice-aligned operations.