News

On February 25, 2026, Law No. 15,352 was enacted, originating from Provisional Measure No. 1,317/2025, which transforms the Brazilian National Data Protection Authority into a regulatory agency of special nature, now named the National Data Protection Agency. The enactment of this new legal framework marks a decisive step in strengthening Brazil’s national data protection policy, aligning the country with international best practices in regulatory governance.

The new structure grants the authority functional, technical, decision-making, administrative and financial autonomy, reinforcing its strategic role in regulating, supervising and enforcing the General Data Protection Law (LGPD). With this new institutional status, the agency formally joins the list of special-regime federal agencies, expanding its capacity to act in light of the growing complexity of the digital ecosystem and emerging technologies.

Strengthening of competences: enforcement of the Digital Child and Adolescent Statute

The transformation of the authority into a regulatory agency coincides with an expansion of its responsibilities, now including the power to regulate and supervise the Digital Child and Adolescent Statute (ECA Digital), established by Law No. 15,211/2025. The new regulatory framework aims to combat the “adultization” of children and adolescents on digital platforms, imposing strict obligations on technology companies regarding transparency, removal of abusive content, and linkage of minors’ accounts to their legal guardians.

Enhanced autonomy and legal certainty

The conversion of the authority into a regulatory agency strengthens its independent functioning, ensuring more robust institutional conditions for exercising regulatory, enforcement and supervisory functions. This enhanced autonomy, combined with a specialized technical career structure, is expected to increase predictability and legal certainty for both public and private organizations, particularly in data-intensive and innovation-driven sectors.

Under the new legal framework, the agency enters a new institutional phase. It is now equipped with the appropriate structure to address growing challenges related to the digital economy, online platforms, artificial intelligence and the protection of vulnerable groups, including children and adolescents, in digital environments. This represents an advancement that reinforces the maturity of Brazil’s data protection regime and consolidates a regulatory authority endowed with autonomy and technical capacity consistent with its legal mandates and contemporary demands.