In an interview with the LexLegal website, our partner and LGPD expert, Dr. Ellen Carolina Silva, highlighted the importance of appointing a Data Controller (DPO) to ensure transparency and corporate governance in the processing of personal data. She states that the controller is the point of contact who ensures that the rights of data subjects are effectively met and that the company is aligned with legal requirements. Their absence directly compromises transparency and corporate governance in relation to the protection of personal data.

How is ANPD strengthening data protection in Brazil?

The National Data Protection Authority (ANPD) has been stepping up its enforcement actions in Brazil, highlighting companies’ responsibilities in relation to the General Data Protection Law (LGPD). Recently, 20 companies were notified for failing to comply with essential obligations, such as appointing a data protection officer (DPO) and implementing efficient communication channels. These companies include big names such as Uber, Telegram, Telefónica, Serasa, Tinder, Latam, Quinto Andar, Eventim, Dell, Tim Tok, BlueFit and X.

These measures aim to ensure that data subjects can fully exercise their rights, reinforcing transparency and security in the processing of personal information. The ANPD highlights that, in addition to penalties, the objective is to guide and educate organizations to promote ongoing compliance with the LGPD.

For Ana Carolina Teles, an expert in artificial intelligence and governance, risk and compliance (GRC) at Palqee, these actions were predictable and essential. “The ANPD’s inspection is a move that was expected by those who follow the regulatory agendas regularly published by the Authority. This action is essential because it shows that the Authority is not limited to repressive measures – although, when necessary, they act in this way. Considering the context of Brazil and the level of maturity of society in relation to data protection and privacy, they have been acting in an educational and preventive manner”, highlights the expert.

The LGPD requires companies to appoint a data controller, also known as a Data Protection Officer (DPO). This professional is the main point of contact between the organization, data subjects and the ANPD.

“The person in charge is the point of contact who ensures that the rights of data subjects are effectively met and that the company is aligned with legal requirements. Their absence directly compromises transparency and corporate governance in relation to the protection of personal data”, explains Ellen Carolina Silva, LGPD specialist and partner at Luchesi Advogados.

Despite being an essential task, the appointment of a DPO is still neglected by many organizations, including large companies. A recent inspection by the ANPD showed that, even after four years of the LGPD being in force, many entities still have not met this basic requirement.

Communication channels: more than just contact

Another critical point identified by the ANPD is the lack of effective communication channels for data subjects to exercise their rights. According to Mirella Andreola, partner at Machado Associados, providing an email address or a telephone number is not enough. “Companies need to develop mechanisms that allow users to stay in touch, explain their demands, obtain quick responses and receive appropriate solutions. This requires well-structured internal processes to respond to requests within the appropriate timeframe,” she says.

The lack of a customer service channel violates the LGPD and compromises the relationship of trust between consumers and companies, according to experts consulted by LexLegal.

“The reputational impact for companies that do not comply with the LGPD can be significant, as it represents a breach of trust and good faith between organizations and their customers,” says Juliana Regueira, head of Innovation and Contracts at VBD Advogados.

Education as a pillar of compliance

Since its creation, the ANPD has adopted an educational approach to guide companies and promote awareness of the importance of data protection. In 2024, the ANPD published a guidance guide for data controllers, detailing their roles and responsibilities.

“Education is essential to strengthening the culture of privacy. Companies that understand data protection as a collective responsibility can integrate the principles of the LGPD into their daily routines,” says Mirella Andreola.

This educational approach, however, does not exclude the application of penalties for cases of non-compliance. Fines can reach R$50 million, in addition to reputational penalties and sanctions such as the suspension of the use of databases.

For lawyers in the field, compliance with the LGPD is not only a legal requirement, but also an opportunity for companies to modernize their internal processes and gain the trust of their customers.

“Adopting good data protection practices is a demonstration of social responsibility and a way to stand out in an increasingly competitive market”, says Ellen Carolina Silva.

Challenges include initial implementation costs and the need to train teams to deal with new regulatory demands. However, the benefits include greater legal certainty, reduced risk of penalties and greater value perceived by consumers.

Opportunities

As enforcement increases and the market matures in terms of privacy, companies that invest in compliance will be better positioned to deal with an ever-evolving business environment.

ANPD’s oversight is more than a repressive measure. It represents an invitation for companies to adopt a more transparent and responsible stance regarding the personal data they process. By combining education, governance and oversight actions, ANPD fulfills its role as guardian of privacy in Brazil.

“Data protection is a path of no return. Companies that embrace compliance as a strategic pillar will not only avoid penalties, but will also build stronger and more trustworthy relationships with their stakeholders,” highlights Juliana Regueira.

“The focus must be, above all, transparency and respect for the rights of data subjects. When organizations incorporate this mindset into their daily operations, compliance ceases to be a burden and becomes a competitive differentiator,” concludes Ana Carolina Teles.

Source: Lexlegal Brasil