When Brazil's National Data Protection Authority (ANPD) published its semiannual Regulatory Agenda Monitoring Report in July 2022, it highlighted a common misconception: regulatory implementation isn't a one-time event. The ANPD's phased approach to the LGPD reveals several myths about how data protection laws take effect and what that means for your compliance efforts.
These myths persist because they're comforting. They allow organizations to delay action, treat compliance as binary, and assume enforcement will follow predictable patterns. Brazil's experience shows otherwise.
Myth 1: "We'll comply once all the regulations are finalized"
Reality: Enforcement begins before all regulations are finalized.
The ANPD structured its 2021-2022 regulatory agenda across three phases through Ordinance No. 11. By July 2022, all phase one and two items had started the administrative process, with two fully completed: the regulation for small processing agents and the inspection and sanctioning procedures.
Here's what compliance teams miss: the completion of inspection procedures in October 2021 through Resolution CD/ANPD No. 1 meant the ANPD could begin enforcement activities before regulations on international transfers or legal hypotheses for processing were finalized. Waiting for the full regulatory picture before the authority starts reviewing your practices puts you behind.
If your compliance program treats "final regulations" as a starting gun, you're already behind. The inspection framework defines how the ANPD will review your operations, what documentation they'll request, and how sanctions will be applied. That framework is operational now.
Myth 2: "Phased implementation gives us more time to prepare"
Reality: Phased implementation compresses preparation windows because each phase builds on the last.
Organizations often interpret "phased approach" as extended deadlines. The opposite is true. When the ANPD released operational guidance for incident response and finalized DPO responsibilities as part of phase two, it assumed organizations had already implemented phase-one requirements around applicability and inspection readiness.
Consider what this means practically: you can't develop a defensible incident response plan (phase one) without understanding your DPO's role in receiving and escalating breach notifications (phase two). You can't map international data flows (phase two) without first determining whether you qualify as a small processor with simplified obligations (phase one).
The phased structure creates dependencies. If you're waiting to see phase-three guidance on data subject rights before building your DSAR workflow, you're ignoring that your DPO needs to be the point of contact for those requests under phase-two regulations.
Myth 3: "Small organizations get a compliance exemption"
Reality: Small processors face simplified requirements, not exemptions, and still carry most LGPD obligations.
Ordinance No. 2, published in January 2022, clarified that the LGPD applies to micro-companies, small companies, startups, and legal entities governed by private law. The myth of exemption likely stems from one genuine concession: these entities don't need to appoint a formal Data Protection Officer.
But that's where the relief ends. Small processors must still establish a Legal Basis for Processing, respond to data subject requests, implement security measures, and report qualifying incidents. The "simplified format" mentioned in the ordinance refers to documentation and process formality, not substantive obligations.
If you're a small processor treating the DPO exemption as a green light to defer compliance, you're misreading the regulation. You still need someone performing DPO functions; you just don't need to formally designate and register that person with the ANPD. The accountability remains.
Myth 4: "Guidance documents are just recommendations"
Reality: Guidance documents preview regulatory positions and shape enforcement priorities before formal rules are published.
The ANPD's operational guide for incident response and updated DPO guidance document serve a specific function in phased implementation: they telegraph the authority's interpretation of statutory requirements while formal regulations move through public comment and deliberation.
When the DPO guidance defines the role as "fostering and disseminating the culture of data protection in the organization" and specifically mentions "receiving requests from data subjects and the national government authority," it's not offering suggestions. It's describing the standard against which your DPO's performance will be measured during inspections.
Guidance documents in phased regulatory environments function as advance notice of enforcement expectations. If your legal team is waiting for "official regulations" while ignoring operational guides, you're missing the clearest signal you'll get about what the ANPD considers compliant behavior.
Myth 5: "We can adopt a wait-and-see approach to enforcement"
Reality: The completion of inspection procedures means enforcement can accelerate at any time, regardless of which phase items remain pending.
The comment period for international data transfer regulations closed June 30, 2022. Phase three items on legal hypotheses for processing and data subject rights hadn't yet appeared in the monitoring report. But none of that prevents the ANPD from conducting inspections under the procedures finalized in October 2021.
This is the strategic insight other jurisdictions should note: Brazil separated the authority to enforce from the completion of all substantive rules. The inspection framework, sanctioning procedures, and methodology for calculating fines are operational. The ANPD can review your consent records, data processing agreements, and security measures today, even while phase-three regulations remain in development.
Organizations that treat incomplete regulatory agendas as enforcement delays are confusing administrative process with enforcement capability. The ANPD has the tools to act; it's choosing when to deploy them.
What to do instead
Map your compliance program to the phased structure. Review which phase-one and phase-two items apply to your operations and confirm you've implemented them. Don't wait for phase-three clarity on data subject rights to build your request intake process; your DPO is already responsible for receiving those requests under current guidance.
Treat operational guides and guidance documents as binding in practice. If the ANPD publishes a 50-page incident response guide, your security team should be working from it, not waiting for the regulation to be "officially" finalized.
Assume enforcement will accelerate. With inspection procedures complete and 2023 identified as a "pivotal year," the ANPD has signaled its readiness to move from rulemaking to enforcement. Your compliance posture should reflect that timeline, not an imagined grace period.
Phased implementation isn't a gift of extra time. It's a structured rollout that lets regulators build enforcement capability while organizations are still decoding requirements. Brazil's approach makes that sequence explicit. Your compliance strategy should too.
