ANPD publishes implementation report on the 2025–2026 Regulatory Agenda

The ANPD has released its implementation report for the second half of the 2025–2026 biennial Regulatory Agenda.

The document outlines the status of the ANPD’s central normative and regulatory initiatives during this period.

The initial version of the regulatory agenda established 16 priority topics for ANPD’s operation, including 10 projects carried over from the previous regulatory cycle and 6 new topics.

Three additional topics were incorporated into the agenda following the enactment of the Digital Statute for Children and Adolescents – or “ECA Digital” – and the designation of the ANPD as an autonomous administrative authority responsible for safeguarding the rights of children and adolescents in the digital environment.

Notable topics currently under development

• Data subject rights;
• Data Protection Impact Assessment (DPIA);
• Public‑sector data sharing;
• Sensitive personal data, with a specific focus on biometric data;
• Technical and administrative security measures (i.e., technical and organizational measures – TOMs), including baseline security standards;
• Artificial intelligence (AI);
• High‑risk processing of personal data;
• Religious organizations; and
• Anonymization and pseudonymization.

Phase 2 initiatives also envisioned

• Guidelines for the National Policy on Personal Data Protection and Privacy;
• Personal data aggregators (data brokers);
• Health‑related sensitive personal data; and
• Topics linked to “ECA Digital”, including the scope and obligations of technology providers, oversight and enforcement guidelines, and age‑verification mechanisms.

The report emphasizes the ANPD’s commitment to transparency, predictability, and regulatory alignment, particularly amid increasing legislative complexity and its expanded duty to protect children and adolescents in the digital ecosystem.

Demarest’s Privacy, Technology and Cybersecurity team is available to provide further information.