Newsletter (#010/2026) on Privacy and Data Protection by Campos Thomaz Advogados
Alerts, materials, and updates on Privacy, Data Protection, and Cybersecurity.
To subscribe, click here.
Find out more about our DPO as a Service
We have prepared specific material to explain how the external DPO as a Service works. Contact our partners.
Redata creates tax incentives for data center installation and artificial intelligence investment in Brazil
Law No. 15,504 of 2026 was enacted, creating the Special Taxation Regime for Data Center Services (Regime Especial de Tributação para Serviços de Datacenter, Redata), aimed at encouraging the installation of data processing centers and investment in artificial intelligence in Brazil. The law, published in the Federal Official Gazette (Diário Oficial da União) on September 16, 2026, provides for a five-year suspension of Import Tax, PIS/Cofins, PIS/Cofins-Import, and the Tax on Industrialized Products (IPI) on equipment purchases, for companies authorized by the Ministry of Finance that are current on federal tax obligations. The government estimates tax exemptions of approximately R$5.2 billion in 2026, decreasing to R$1 billion in each of the following two years. Learn more.
Data protection agency’s Board of Directors rejects draft guidance on high-risk personal data processing
The Board of Directors of the Agência Nacional de Proteção de Dados (ANPD, Brazil’s data protection agency) decided, unanimously, not to approve the draft Guidance Manual on High-Risk Personal Data Processing, which aimed to help data controllers and processors identify instances of high-risk data processing under Article 4, paragraph 3, of the regulation approved by CD/ANPD Resolution No. 2/2022. The proposal defined high risk based on a combination of at least one general criterion, such as large-scale processing or the potential to significantly affect data subjects’ fundamental rights, with at least one specific criterion, including the use of emerging technologies such as artificial intelligence and facial recognition, surveillance of publicly accessible areas, automated decision-making, and the processing of sensitive data or data belonging to children, adolescents, and older adults. Learn more.
ANPD opens public consultation to update enforcement process regulation
The Agência Nacional de Proteção de Dados (ANPD, Brazil’s data protection agency) launched, on September 9, 2026, a public consultation to gather input for updating its Enforcement Process and Administrative Sanctioning Process Regulation, set out in CD/ANPD Resolution No. 1/2021, with submissions accepted through the Brasil Participativo platform until October 26, 2026. The agency will also hold a virtual public hearing on the topic on September 24, 2026, streamed on ANPD’s YouTube channel, with registration required, available until September 18, 2026, only for those wishing to speak during the session. Learn more.
Federal Attorney General’s Office renews request for injunction against Discord over shortcomings in protection mechanisms
Brazil’s Federal Attorney General’s Office (Advocacia-Geral da União, AGU) deemed the measures proposed by Discord to strengthen user protection insufficient and reiterated, in a filing submitted to the 14th Federal Civil Court of the Federal District’s Judicial Section, its request for an injunction requiring the platform to adopt more effective safety mechanisms, including effective age verification controls, parental linking, and stricter safety settings. According to the agency, the proposal submitted by Discord, delivered in compliance with a ten-business-day deadline set in connection with the public civil action filed by the AGU on August 25, 2026, is generic in nature, contains numerous exceptions and conditions, and shows no consistent commitment to changes in the platform’s architecture or improvements to its systems and processes. Learn more.
Irish regulator fines Google €403 million over location data handling failures
Ireland’s Data Protection Commission (DPC) fined Alphabet, Google’s parent company, 403 million euros on September 21, 2026, over violations of EU privacy rules in handling users’ location data between 2018 and 2020. The violations involved three of the company’s features, Web & App Activity, Location History, and Location Accuracy, related to how Google informed users about the use of their location information and its retention of that data for longer than necessary. Learn more.
European Commission proposes age restrictions on social media and AI use by minors
The European Commission announced, on September 16, 2026, a legislative proposal that would ban the use of social media by children under 13 and create limited, parent-supervised accounts, with restricted features and reduced usage time, for users between 13 and 15 years old. For young people between 15 and 18, platforms would be required to adopt safe-by-design standards. The measures are part of a bill known as the “EU Kids Act,” which still requires approval from the European Parliament and the bloc’s 27 member states, and draws on a report by child protection experts, scientists, and child psychiatrists presented in July 2026. Learn more.
LGPD Infographic
Access the LGPD infographic prepared by our firm. Access here
Explore our series of content on privacy, data protection, and cybersecurity.
Discover our series of content on privacy, data protection, and cybersecurity. Access the full series here.
Produced by Alan Campos Elias Thomaz and João Marcelo de Oliveira
