The ripple effect of the EU’s General Data Protection Regulation (GDPR) on the world’s data protection regulation framework hit South America when Brazil approved its new General Data Privacy Law (Lei Geral de Proteção de Dados Pessoais or LGPD) in August 2018. Although the law was under consideration for several years before the GDPR, the imprint of the EU regulation is clearly apparent in Brazil’s new data protection law.

Brazil’s law faced an issue, however, because the LGPD did not create a data protection authority. That issue was addressed at the end of 2018, when outgoing President Michel Temer issued an executive order that made changes to the law, including the creation of the Brazilian National Data Protection Authority (Autoridade Nacional de Proteção de Dados or ANPD).

According to the JD Supra blog, the ANPD is part of the federal government and linked to the office of the President of Brazil. Pursuant to Section 55(j) of Executive Order no. 869/18, the ANPD has the authority to:

• “Issue rules and regulations regarding data protection and privacy;

• “Within the administrative sphere, exclusively interpret the LGPD, including cases in which the law is silent;

• “Request information regarding the processing of personal data from data processors and controllers;

• “Exclusively oversee and impose administrative sanctions for violations of the LGPD;

• “Promote data protection and privacy within the Brazilian society; and

• “Develop studies regarding domestic and international data protection and privacy practices and establish partnerships with authorities from other counties to increase international cooperation.”