Small business compliance with the Brazilian General Data Protection Law and the limits of the simplified regime for small-scale processing agents

This is the authors' abstract. We don't add key points for this paper.

This article analyzes the differentiated regime established by ANPD Resolution No. 2/2022 for small-scale processing agents and examines whether its flexibilities foster effective compliance of micro and small enterprises with the Brazilian General Data Protection Law or instead create a false perception that legal obligations have been waived. The research is qualitative, theoretical and exploratory, combining a literature review, a documentary analysis of Brazilian legislation and of the European Union General Data Protection Regulation, and a reading of secondary data from the survey Privacy and Personal Data Protection 2023, conducted by the Brazilian Network Information Center. The theoretical framework connects the conceptual path from privacy to data protection, risk-based regulation and the principle of accountability. The data show that the adoption of compliance measures by enterprises with 10 to 49 employees is roughly half, or less, of that observed in larger firms. The normative analysis shows that the simplified regime reduces formalities while preserving principles, legal bases and data subject rights, and excludes high-risk processing. The study concludes that simplification is legally sound but insufficient without support instruments such as templates, sector guidance and codes of conduct developed by representative associations.