LGPD enforcement already has a map (and a doctrine)

LGPD enforcement stopped being a lottery: it has a map, a doctrine, and a calendar.

The ANPD’s Priority Topics Map for 2026-2027, published via Resolutions CD/ANPD No. 30 and 31 of December 24, 2025, defines four concentration axes. And the doctrine accompanying the map has a name: responsive oversight, dialogue before sanction, sanction when there is no cooperation.

The 4 axes (and where your company sits in them)

The map concentrates enforcement on:

1. Data subjects’ rights: access, correction, and deletion requests answered on time, with a channel that works.
2. Children and teenager protection: the axis with the public reference sanction, the largest fine in LGPD history, and the Digital Child Statute in the same package.
3. The public sector: state processing, with its transparency particularities.
4. AI and emerging technologies: the new axis, with the Generative AI Technology Radar published in July 2026 and LGPD Articles 20 and 38 already applicable.

The practical read: mark which axes the operation touches. Being in a priority axis does not change the obligation (it is universal), it changes the probability of a visit.

Responsive oversight: the doctrine that rewards preparation

The ANPD practices what the literature calls responsive oversight: dialogue before sanction, sanction when there is no cooperation. The design turns the company’s history into part of the assessment.

That has a direct operational consequence: whoever answers fast, with an organized dossier, an identifiable officer, and incidents reported within the 3 business days, negotiates at the technical layer. Whoever improvises, hides, or lets the deadline run receives the sanction version, and the ByteDance precedent (25% off for waiving appeal and paying within 20 business days) shows even the sanction prices cooperation.

AI is already on the radar, with or without the law

Axis 4 generates the most questions: "but hasn’t the Legal Framework passed yet?". The agency’s answer is already in production: LGPD Article 20 (review of automated decisions) and Article 38 (impact report) apply today, the Generative AI Technology Radar was published in July, and the AI Legal Framework is one vote away, with the ANPD designed to command the system.

In other words: AI enforcement does not wait for the Legal Framework. The Legal Framework organizes what the ANPD already does.

The 30-day plan

1. Map the axes: which of the four the operation touches, with evidence.
2. Build the response dossier: identifiable officer, processing inventory, tested data-subject channels.
3. Close the red band: minors’ data with regularized legal representation and automated decisions with trails, if the operation touches axes 2 and 4.
4. Document cooperation: every request answered and every incident reported on time is credit in the history the doctrine reads.

Conclusion

The ANPD traded the lottery for cartography: a public priority map, a declared doctrine, and sanctions with numbers. Enforcement stopped being a surprise and became reading the map before it arrives at you.

The good news is that the chosen doctrine (dialogue before sanction) rewards exactly what is cheap to do: answer fast, document everything, and genuinely cooperate. The bad news is for whoever bet on the vacuum: the vacuum ended, with a published resolution and a reference fine.