ANPD regulatory changes increase data privacy risks for PJ payroll

The transformation of Brazil’s National Data Protection Authority (ANPD) into a regulatory agency with administrative and financial autonomy has increased scrutiny over how companies handle personal data. Under Law No. 15,352 of February 25, 2026, the ANPD has expanded its oversight, recently opening a record 19 administrative sanctioning processes in a single month.

A significant compliance gap has emerged regarding the payroll of service providers (PJ). While employee data is typically managed through secure systems, many companies continue to process PJ remuneration via spreadsheets, emails, and messaging apps. This practice poses risks under the General Data Protection Law (LGPD), as these documents often contain sensitive personal information, such as partners' tax IDs (CPF), personal bank details, and individual compensation data.

As the controller of this information, contracting companies are obligated to maintain the same security, access controls, and registration standards for PJ data as they do for regular employees. The ANPD has identified the use of artificial intelligence and other emerging technologies as key priorities for its 2026-2027 inspection biennial.