The National Data Protection Agency (ANPD) has entered a new phase in its operations. While in the early years of the General Data Protection Law (LGPD) the Agency's focus was on guidance and building the regulatory environment, current actions demonstrate progress in monitoring and overseeing organizations.
The first stage of monitoring carried out by the ANPD evaluated 56 data processing agents (including public bodies and private companies) and provided an important snapshot of the maturity level of Brazilian organizations in relation to data protection.
More than just verifying compliance with two specific obligations of the LGPD (Brazilian General Data Protection Law), the inspection revealed a scenario that deserves attention: many institutions still face difficulties in meeting requirements considered basic to the legislation.
In this article, we analyze what the results of this audit indicate and what lessons can be learned by organizations seeking to strengthen their governance in privacy and data protection.
The first phase of ANPD's inspection
The ANPD evaluated 56 treatment agents, being:
- 39 public bodies;
- 17 private companies.
The objective was to verify compliance with two fundamental requirements stipulated in the LGPD (Brazilian General Data Protection Law):
- The designation of the Data Protection Officer (DPO);
- The provision of communication channels so that data subjects can exercise their rights.
Although they seem like simple requirements, they represent the gateway to any privacy program.
The results were divided into three groups:
- 27 organizations They fully complied with the requests;
- 8 had pending issues.but still eligible for regularization;
- 21 did not even respond to the official letters sent by the ANPD.
More than just numbers, these results help to understand different levels of maturity in privacy and data protection.
What do the results reveal about the maturity of organizations?
The three groups identified by the audit represent quite distinct stages of compliance with the LGPD (Brazilian General Data Protection Law).
The organizations that complied with the requests demonstrate that they possess a minimum privacy governance structure, with processes capable of responding to the demands of the regulatory body.
Those that presented pending issues indicate that there is some level of structuring, but there are still important adjustments to be made to achieve greater compliance.
The group that draws the most attention, however, is that of organizations that simply did not respond to the ANPD's official requests.
This behavior may indicate that data protection is not yet part of the institution's strategic priorities, or that there is not even a structure responsible for monitoring this type of regulatory demand.
In other words, failing to respond to the authority responsible for enforcing the LGPD (Brazilian General Data Protection Law) may reveal a significantly lower level of maturity than expected for organizations that process personal data of customers, employees, and citizens on a daily basis.
What stands out among the audited institutions
The list of audited organizations also brought up some interesting points for reflection.
Among the institutions that did not respond to the ANPD (National Data Protection Authority), public bodies predominate, such as federal councils, universities, federal institutes, and DETRANs (State Traffic Departments).
At the same time, large companies such as Google Brazil and iFood appear among the organizations that have outstanding issues.
These results help to deconstruct some common ideas about compliance with the LGPD (Brazilian General Data Protection Law).
The public sector still faces significant challenges.
Public bodies are expected to be benchmarks in transparency, governance, and compliance.
However, these very institutions accounted for a large portion of the lack of response.
Several factors can contribute to this scenario, such as budgetary constraints, lack of dedicated privacy structures, high turnover of managers, and low prioritization of the data protection agenda.
Regardless of the cause, the result highlights a significant challenge: How can organizations that handle the personal data of millions of citizens daily fail to comply with the General Data Protection Law?
Company size does not guarantee compliance.
Another relevant point is the presence of large companies among those that have outstanding issues.
This data demonstrates that financial resources, robust legal teams, or specialized departments do not, in themselves, guarantee compliance with the LGPD (Brazilian General Data Protection Law).
In practice, compliance depends on well-defined processes, continuous governance, and, above all, prioritization of the issue within the organization.
Data protection is no longer just a legal responsibility; it has become part of risk management and business strategy.
Why did the ANPD start specifically with the data protection officer?
The ANPD's choice was not random.
The Data Protection Officer and the communication channels with data subjects represent two of the most basic obligations stipulated by the LGPD (Brazilian General Data Protection Law).
These are requirements that objectively demonstrate whether a minimum structure exists to meet privacy-related demands.
If an organization is still unable to meet these initial requirements, an inevitable question arises:
How does she manage far more complex obligations, such as data inventory, risk assessment, incident management, contract review, or ongoing governance programs?
Therefore, these two criteria function almost as an indicator of the company's maturity.
In many cases, the absence of a formally designated person in charge or a functional customer service channel is not an isolated problem.
It is often accompanied by other important gaps, such as:
- absence of an inventory of personal data;
- Outdated privacy policies;
- lack of internal training;
- lack of documented processes;
- Insufficient governance over data processing.
Oversight also needs to mature.
Although the ANPD's performance has been strengthening, it is also important to note that the regulatory process itself continues to evolve.
A recent case involving a disciplinary process generated discussion precisely because the contact information for the person in charge was available on the organization's website, although it was not presented in the manner deemed appropriate by the regulatory body.
Situations like this highlight the importance of strengthening not only the Agency's oversight capacity, but also the predictability of the rules.
The authorization for the ANPD to hold a public competition represents an important step forward in this regard, expanding the technical capacity to guide, monitor, and oversee organizations.
At the same time, there is still room for complementary regulations to bring greater clarity to practical aspects of compliance, reducing divergent interpretations and increasing legal certainty for companies and public bodies.
What to expect from the next ANPD inspections
The consequences of this first stage have already begun to produce effects.
Os 21 data processing agents who did not respond to official requests. Their cases were forwarded to the General Coordination of Inspection and Sanctions of the ANPD, giving rise to the respective sanctioning processes.
The eight agents with outstanding issues They were given time to regularize their situation before more severe measures were adopted.
Furthermore, the processes can be monitored publicly through the Electronic Information System (SEI) and the panel provided by the ANPD itself, reinforcing the transparency of the Agency's actions.
The most relevant aspect, however, goes beyond individual processes.
The ANPD itself reported that this represents only the first stage of a broader oversight plan, indicating that further actions are expected to occur continuously.
This signals an important shift in the regulator's role: compliance with the LGPD is no longer seen as a one-off project, but requires ongoing monitoring.
How companies can prepare
Regardless of size or sector, organizations need to understand that compliance with the LGPD (Brazilian General Data Protection Law) does not end after the initial implementation of policies and documents.
Compliance requires constant updating, process review, team training, and continuous monitoring of practices related to the processing of personal data.
More than just avoiding sanctions, a consistent privacy program strengthens corporate governance, increases customer and partner trust, and reduces operational risks.
In this context, understanding the organization's maturity level is one of the first steps in identifying opportunities for improvement before an audit takes place.
If your company wants to understand its compliance process with the LGPD (Brazilian General Data Protection Law), conducting an initial diagnostic can help identify gaps, define priorities, and guide the next steps in the adaptation process in a structured way.
The closing thought
The first major inspection by the ANPD (National Data Protection Authority) sent an important message to the market: data protection has definitively become part of the regulator's monitoring agenda.
The results show that there is still a significant way to go for many organizations, regardless of their size or sector.
At the same time, they emphasize that investing in governance, processes, and a culture of privacy should not be seen merely as a legal obligation, but as a strategic element to strengthen trust, reduce risks, and prepare the company for an increasingly active regulatory landscape.
