This policy brief examines the autonomy and capacity gaps in the Brazilian National Data Protection Authority (ANPD), the main regulatory body for personal data in the country, after it became an autonomous agency in June 2022. The brief highlights three undefined aspects of the ANPD’s institutional design – its interaction with other regulators, measures to avoid regulatory capture, and addressing budgetary restrictions –  and provides recommendations to address these challenges.
 
The first recommendation of the author is to strengthen inter-agency coordination. While the ANPD has established connections with several government institutions, there is room to increase the agency’s political autonomy and build a more resilient culture of inter-agency cooperation beyond personal ties of staff members.
 
The second recommendation is to build resilience against regulatory capture. To ensure that the public interest remains at the core of ANPD’s mission, the agency should continue to communicate its key decision-making procedures and regulatory proposals transparently and effectively. The six-month cooling-off period that applies to officials leaving the federal government to join the private sector should be more precisely tailored to match the conflict of interest threats that are particular to the nature of the work conducted by the ANPD.
 
The third recommendation is to increase revenue through a supervisory fee. Since the ANPD's budgetary constraints prevent effective regulation of data in Brazil, new procedural fees should be introduced to firms that process large amounts of data to cover the costs of their regulatory supervision. These measures could help to improve the ANPD's capacity and ability to regulate the collection and processing of personal data in Brazil more effectively.
 
Grounded on two key dimensions of good public institutions capacity and autonomy, the brief discusses relevant criteria to assess these two dimensions and how they would be relevant features to incorporate in the agency, suggesting how the ANPD could become an ‘island of excellence’ or ‘pocket of integrity’ in the Brazilian regulatory landscape. Because digital technologies and the digitalisation of the economy have implications across multiple policy domains beyond personal data – such as competition, consumer protection, and law enforcement – the discussions here proposed are relevant not only to the specific theme of data protection, but permeates the activities of several government institutions in Brazil.