Skip to content
Indene
en

Compliance e regulatório

ANPD proposes to presume non-delivered documents as non-existent during inspection

The draft of ANPD's new inspection regulation, open for public consultation until October 26, incorporates incident investigation into the process, creates precautionary measures, and presumes against those who fail to provide requested information. The burden of proof now shifts to the data processor.

By Rafael LimaCFO

5 min read

Páginas de norma empilhadas sobre fundo claro, com uma linha marcada em verde, e o título What you cannot prove, you did not do.
Páginas de norma empilhadas sobre fundo claro, com uma linha marcada em verde, e o título What you cannot prove, you did not do.

The ANPD (National Data Protection Authority) is reviewing its regulation on inspection and enforcement, with a public consultation open until October 26, 2026. The most significant change for personal data processors is outlined in a single paragraph of the draft: if a company refuses to provide requested information or provides it incompletely, the agency may presume uncontested facts to be true and unpresented documents to be non-existent. Indene's interpretation is that this proposal shifts the burden of proof to the regulated entity, and the time to produce evidence becomes before an incident, not after notification.

What is under consultation

The ANPD became a regulatory agency through Law No. 15,352, of February 25, 2026, and is now adjusting its inspection rules to the new structure. The public consultation began on September 9, on the Brasil Participativo platform, and revises Resolution CD/ANPD No. 1/2021. Three documents were released: the draft, the Regulatory Impact Analysis (AIR), and the reporting director's vote. The public hearing was held on September 24, with 43 registered participants.

A significant part of the revision addresses the agency's new competencies, such as the protection of children and adolescents in the digital environment and the duties of internet application providers. For those concerned with security and risk, what matters is something else: the draft now treats the communication and investigation of security incidents as part of the inspection process (Article 2, § 4), and changes the tools the ANPD has for investigation and enforcement.

What changes in practice

Topic 2021 Rule Draft Proposal
Investigation preparatory procedure for preliminary investigation (Art. 40) investigative procedure, which can be initiated due to a security incident, with in-person or remote technical inspection and digital evidence collection (Arts. 32 and 33)
Non-delivered information may characterize obstruction of inspection (Art. 6) in addition to obstruction, presumption of truthfulness of uncontested facts and non-existence of unpresented documents (Art. 33, § 2)
Monitoring used to plan inspection and analyze compliance (Art. 18) the ANPD may notify the company to interrupt or correct conduct even during monitoring (Art. 18, § 2)
Regularization "request for regularization" (Art. 32) "determination of regularization," with aggravating factors if not complied with (Art. 36)
Precautionary measure no discipline in the regulation may be adopted without prior hearing of the company, including when damage results from a security incident, with a daily fine of up to $9.65 million in total (Arts. 14-A to 14-E)
Defense ten business days ten business days, and the company informs its previous year's revenue in Brazil; if not informed, the ANPD estimates (Art. 47, § 1)
Confidentiality the company is responsible for requesting confidentiality (Art. 5, § 2) without precise indication of the information and legal basis, the document is treated as public (Art. 5)

The maximum daily precautionary fine is equivalent to $9.65 million (R$ 50 million at source; PTAX on September 30, 2026, Central Bank).

Excluded from this consultation are incident communication deadlines, which remain in Resolution CD/ANPD No. 15/2024, and fine calculation rules, which the ANPD is reviewing in a separate process. Resolution No. 15 continues to require communication to the agency and data subjects within three business days, when there is relevant risk or damage, and recording of all incidents, including those not communicated, for five years.

The case that illustrates the criterion

On July 8, 2026, the ANPD initiated a sanctioning process against Instituto Saúde e Cidadania (Isac), a social organization that manages public health units, due to a ransomware attack in 2025 that affected approximately 500,000 records, according to the institution itself. The sanction is yet to be defined.

The agency's statement describes the problem in terms of evidence. The entity claimed there was no relevant risk to data subjects, but, according to the ANPD, it failed to provide proof. It published a notice on its website instead of communicating with data subjects, and the notice did not include the date, nature of the data, or measures taken. It also failed to present technical evidence for its own claims, "even after repeated questioning." With the draft in force, this silence would have another effect: the presumption against those who failed to provide information.

What this means for financial institutions

Financial data and authentication data are among the criteria that Resolution No. 15 uses to define relevant risk. For banks, cooperatives, payment institutions, and fintechs, this means that most personal data incidents will likely require communication within three business days. Those who decide not to communicate must show why, with evidence, and keep this record for five years.

Institutions regulated by the Central Bank already face a similar documentary inspection, with the same five-year horizon for cybersecurity documentation. The ANPD's draft brings these two requirements closer. The good news is that the same trail serves both: incident logging, risk assessment with date and author, testing of the failed control, and proven correction. The bad news is for those who keep this trail in emails and loose spreadsheets, because the draft removes the benefit of the doubt from the company.

What to do now

  1. Read the draft and submit contributions by October 26 via Brasil Participativo, especially regarding the presumption in Article 33, § 2, and precautionary measures without prior manifestation.
  2. Check if incident records include those not communicated, with the minimum content of Article 10 of Resolution No. 15, and if they are kept for five years.
  3. For each incident classified as having no relevant risk, maintain the technical evidence supporting this conclusion: the lack of it was a key factor in the Isac case.
  4. Register as an external user in ANPD's SEI system and define who receives subpoenas; the defense period remains ten business days.
  5. Prepare the confidentiality classification for documents that may be requested, with the legal basis and a redacted version ready.

The rule proposed by the ANPD is the same that guides Indene's methodology: declared is not proof. Evidence with origin, date, and author responds to both the Central Bank and the ANPD simultaneously. Read the methodology.

References

Topics

Keep reading

All news