On October 29, 2026, Brazil's Agência Nacional de Proteção de Dados (ANPD) held a virtual public hearing on the draft revision of the Regulamento de Dosimetria e Aplicação de Sanções Administrativas (Resolution CD/ANPD No. 4 of February 24, 2023), the regulation that sets how the authority grades and calculates administrative sanctions. The same round includes a public consultation on Brasil Participativo, open for contributions until November 30, 2026, as the ANPD hearing notice states. Data controllers and processors processing personal data in Brazil, digital platforms and online services likely to be accessed by minors under the ECA Digital (Lei 15.211/2025), and internet application providers subject to Decrees 12.975/2026 and 12.976/2026 must submit contributions by November 30, 2026 and begin recalibrating compliance risk models and sanction-exposure assessments built on Resolutions CD/ANPD 1/2021 and 4/2023, or, once the revised regulation is adopted (expected in the first quarter of 2027), face recalculated administrative fines of up to BRL 50 million per infraction or 2% of revenue in Brazil, plus data blocking and service restrictions.
The draft would give the ECA Digital and the Marco Civil da Internet decrees their own calculation parameters, and would stop LGPD (Lei 13.709/2018) criteria from being copied onto those regimes. Resolution CD/ANPD No. 4 of February 24, 2023 stays in force until a new resolution is adopted and published.
What does the ANPD dosimetry consultation change?
The consultation widens who can be sanctioned under the dosimetry regulation. ANPD states that the revision will include the agents it regulates under the ECA Digital and under Decrees 12.975/2026 and 12.976/2026, each with its own sanction-calculation parameters, and that it will review the calculation bases, caps and formulas for administrative sanctions.
The agency also states that the sanction regimes will stay separate, so criteria written for one statute are not applied to another. The October 29, 2026 hearing put classification and cumulativity in front of specialists and of public and private representatives. The draft is the minuta published with the public consultation. Oral comments are inputs. They do not adopt the text.
| Regime | Instrument the draft addresses | What ANPD says the revision does |
|---|---|---|
| LGPD | Resolution CD/ANPD No. 4 of February 24, 2023 | Review of calculation bases, caps and formulas |
| ECA Digital | Lei 15.211/2025 | Own sanction parameters for the new regulated agents |
| Marco Civil da Internet | Decrees 12.975/2026 and 12.976/2026 | Own parameters, kept separate from the LGPD criteria |
Who is exposed to the revised Brazilian sanctions rules?
Exposure follows activity in the Brazilian market, not the place of incorporation. Controllers and processors of personal data under the LGPD already sit inside Resolution CD/ANPD No. 4, and the draft is the recalibration of that model. Platforms and online services likely to be accessed by minors sit under the ECA Digital, which the ANPD regulates and which the draft would bring into the dosimetry regulation with its own parameters. Internet application providers covered by Decrees 12.975/2026 and 12.976/2026, the decrees that updated the Marco Civil da Internet, are the third group: the draft is written so they are sanctioned under criteria built for those decrees.
Speakers asked for three changes that are not yet resolution text: replace "exercise of rights" (exercício de direitos) with "guarantee of rights" (garantia de direitos) for duties toward children, define when one situation becomes several infractions, and score gravity against the agent's knowledge of the tools involved.
What must exposed actors do by November 30, 2026?
Written contributions are due by November 30, 2026 on Brasil Participativo. Teams should map which regimes apply: an LGPD-only model will not describe exposure under the ECA Digital or the Marco Civil decrees once those parameters exist.
- Mark every minuta provision that changes how a Resolution CD/ANPD No. 4 model scores an infraction.
- File comments by November 30, 2026 on classification, cumulativity, and any parameter that would apply to your services.
- Keep the LGPD file, the ECA Digital file and the Decrees 12.975/2026 and 12.976/2026 file separate, so one incident is not scored three times by habit.
- Rebuild scenarios that still use only Resolutions CD/ANPD 1/2021 and 4/2023, and flag where the draft changes the base, the cap or the formula.
Per-jurisdiction monitoring on Obsidian surfaces a consultation of this kind the moment the authority publishes the notice.
What happens if the revised dosimetry is adopted as drafted?
Until adoption, the enforceable method remains Resolution CD/ANPD No. 4 of February 24, 2023, published in the Diário Oficial da União. Missing November 30, 2026 does not itself trigger a fine. It means later calculation rules are set without that organisation's comments.
The final resolution is expected in the first quarter of 2027. After adoption, LGPD, ECA Digital and Marco Civil breaches the ANPD enforces can be scored on the new parameters. The LGPD ceiling stays a fine of up to 2% of revenue in Brazil, capped at BRL 50 million per infraction, plus data blocking and other measures. The draft changes the path to that ceiling, and opens a separate path for the newer regimes.
Before November 30, 2026, confirm which regimes cover your services, read the minuta, and file the comments that change your exposure. Replace any model that still treats Resolution CD/ANPD No. 4 as the last word on ECA Digital and Marco Civil penalties. Obsidian keeps the adoption step on the same file when it is published.
