Brazil: Decree on organisational structure and expanded powers of National Data Protection Agency enters into force (No. 12881)

On 8 April 2026, the Decree on organisational structure and expanded powers of the National Data Protection Agency (ANPD) enters into force. The Decree strengthens the ANPD’s institutional autonomy and confirms its powers under Brazil’s personal data protection law and Law No. 15,211/2025 on the protection of children and adolescents in digital environments. It authorises the ANPD to issue implementing rules, investigate infringements, apply warnings and fines, define standards for parental controls and age verification, regulate access to data for research, and assess compliance measures for digital services aimed at, or likely to be accessed by, children and adolescents.