Cybersecurity Policy Report, Privacy Agency Releases Results of DPO Legal Compliance Monitoring in Brazil, (Jul 6, 2026)

By Tony Foley

The National Authority for Protection of Data (ANPD), Brazil’s data protection authority, said last week that it had concluded the first of a two-part monitoring process assessing compliance with legal obligations related to the appointment of data protection officers (DPOs) by public bodies and companies and the availability of communication channels between data subjects and controllers.

The ANPD explained that DPOs played an essential role in data governance, acting as the conduit for communications among data subjects, controllers, and the agency, adding that providing these channels was essential to ensure that subjects could exercise their rights simply and effectively.

The monitoring process, outlined in a July 3 notice, covered 56 DPOs (39 from public bodies and 17 from private companies), and found that a total of 27 of these bodies fully complied with requests from the ANPD, eight had pending issues in need of resolution, and 21 did not respond to the agency’s request for compliance.

Some data controllers selected for the ANPD’s monitoring process were chosen based on audits by the Federal Court of Accounts (TCU), which identified public organizations without appointed DPOs, while other public and private organizations were selected based on analysis of complaints and petitions of data subjects that pointed to an absence of designated DPOs or the absence of or deficiency in a communications channel with the data subject.

The first phase of the monitoring consisted of analyzing the information provided by all organizations responding to the ANPD’s official requests. The list of nonresponsive entities was forwarded to the General Coordination of Sanctions for the potential adoption of appropriate measures. The process was concluded for the organizations that complied with the ANPD’s requests were concluded, while organizations that continue to present outstanding issues have 10 working days from the date of notification to rectify them.

News: InternationalLegislation LitigationEnforcement DataPrivacy DataSecurity