Data protection authority's new LGPD sanctions rules open for comment
What’s happening
Brazil's data protection authority (ANPD) is updating its rules for setting fines and other LGPD sanctions, adding new duties such as those under the children's digital statute; comments are open on the Brasil Participativo platform until November 30, 2026. Under the LGPD, employee health data, including data from wellbeing programs and psychosocial risk surveys, is sensitive data that needs a specific legal basis and stronger safeguards.
What to do
Review how you collect, store and share employee health and survey data (legal basis, access limits, anonymization), and have your data protection officer track the final rules.
Source
gov.br. Checked October 19, 2026.