After a long period of uncertainty, on September 18 Brazil’s president enacted Law No. 14.058/20, which formally entered Brazil’s general data protection law (LGPD) into force. While the LGPD's provisions can be enforced through private lawsuits and public prosecutor actions, administrative sanctions are deferred until August 1, 2021.
Separately, Brazil’s National Data Protection Authority (ANPD), the administrative agency tasked with enforcing administrative sanctions and issuing regulations under the LGPD, has not yet been established. While the President published Decree No. 10,464 (Decree) (in Portuguese) on August 26 to establish the ANPD and outline its structure, the Decree will only enter into force once the ANPD’s Executive Director is appointed. Even once the Executive Director is appointed, there still will be a period of time before the newly constituted agency issues rulings and begins contemplating enforcement.
To learn more about the LGPD, see our recent webinar.
Authored by: Bret Cohen, Isabel da Costa Carvalho, Julian Flamant, Filippo Raso, and Sophie Baum.
Are you sure want to delete comment ?
Scan this QR Code to share this content
