On December 20, President Jair Bolsonaro enacted the remaining articles of the Data Protection Law, creating the National Authority for Personal Data (ANDP). 

These articles, originally vetoed by Bolsonaro, but later reinstated by Congress, include stiffer administrative penalties in cases of infringement by data processing agents and envisage: the partial suspension of the operation of the database in question for a maximum period of six months; the suspension of personal data processing activities during the same period; and the partial or total prohibition of any activities related to data processing.

The new sanctions may only be applied after an alternative sanction (such as fines, blocking and deletion of the personal data concerned) has been imposed. As a whole, the regulations in question create the National Authority for Personal Data (ANDP), the state body in charge of ensuring the application of the General Law on Personal Data Protection, to come into force in the second half of 2020.