Autoridade Nacional de Proteção de Dados (ANPD)

What it does

Brazil's data protection authority, an autonomous federal agency. Already regulates AI indirectly through LGPD Article 20 (right to review of automated decisions) and has issued preventive measures against AI training on personal data (notably the 2024 order suspending Meta's use of Brazilian personal data for AI training — real, exercised power). Under PL 2338/2023 as approved by the Senate in December 2024, ANPD would coordinate the proposed Sistema Nacional de Regulação e Governança de IA (SIA). Can investigate, issue preventive suspension orders, and fine (LGPD fines up to 2% of Brazilian turnover, capped at BRL 50 million per infraction).

Its AI responsibilities

Currently: data protection enforcement under the LGPD where AI processes personal data, plus a Regulatory Sandbox for AI project. Prospectively: the leading candidate to coordinate the Sistema Nacional de Governança da IA (SIA). ANPD filed formal proposed amendments to the substitutive text of PL 2338 — it is an active participant in shaping its own future mandate, not a passive recipient.

Its powers

fine

Honest assessment

Mixed. ANPD genuinely runs open consultations and genuinely enforces. But the consultation infrastructure moved during 2025–26 (Participa+Brasil shut down, replaced by Brasil Participativo), so verify any URL before use. Formal complaint filing requires a gov.br account tied to a CPF (Brazilian taxpayer number), which effectively excludes non-residents. Everything is in Portuguese. Informal email to ANPD's ouvidoria is the realistic foreign route, but I could not verify that address.

Honest assessment

Genuinely usable, and the tomada de subsídios instrument is unusually open — it invites input before a draft exists, which is the stage at which input actually matters. Any Portuguese speaker can file. The ANPD publishes contributions and its responses. The one honest caveat: the 16 October deadline mentioned on its site does not state a year on the page as read, so confirm the year before relying on it. The individual complaint channel is a real, working remedy for an ordinary person whose data was misused by an AI system — that is the most concretely useful thing in this entry.

Current business

AI Regulatory Sandbox project (an international award finalist). Open 'tomadas de subsídios' (calls for contributions) for its regulatory agenda, with contributions accepted until 16 October, including a topic on 'IA e proteção dos dados dos Titulares' (AI and data subjects' data protection). Proposed amendments to the PL 2338 substitutive are published on its site. Competing 2026 bills (PL 762/2026, PL 704/2026) would give ANPD the lead AI supervisory role with mandatory algorithmic impact assessments.

Public route

Two formal instruments. (1) CONSULTA PÚBLICA — formal public consultation on a draft regulation, with a published response. (2) TOMADA DE SUBSÍDIOS — an earlier-stage, more open call for evidence used to shape the regulatory agenda before drafting. Both are announced on gov.br/anpd and usually run through the federal Participa + Brasil platform. There is also a complaints channel (petição de titular) for individual LGPD violations, which is a genuine individual remedy.

Format rules

None. Open to any person or organisation. The individual complaint route requires first attempting contact with the controller.

Languages

Portuguese only.

Notes

Brazil is not a network member and has no AI safety institute.

Research note

ANPD's AI sandbox, its open tomadas de subsídios including an AI-and-data-protection topic, and its formal amendment proposals to PL 2338 are VERIFIED from gov.br/anpd. THE DIRECTOR-PRESIDENT IS DELIBERATELY UNVERIFIED AND UNNAMED — the site's leadership page was not retrieved and I will not guess. The 16 October deadline is verified as stated on the site but its year is UNVERIFIED. The claim that ANPD will lead the SIA is a proposal in pending bills, NOT current law.