Brazil's ANPD to weigh sanctions on 21 agencies and firms

Brazil’s National Data Protection Authority (ANPD) has wrapped up the first phase of an enforcement sweep covering 56 data controllers — 39 public agencies and 17 private companies — checking whether each had named a data protection officer and set up an accessible channel for people to exercise their privacy rights. Of those, 27 fully complied, 8 still have issues to fix, and 21 never responded to the agency’s requests at all.

Non-response and continued non-compliance can lead to further ANPD action, including sanctions; the list of entities that ignored the agency’s requests has already been forwarded to its sanctions unit for review, while those with pending issues have 10 business days from notification to fix them.

The audited list leans public-sector — federal institutes, state transit departments, professional councils — but includes a handful of consumer-facing tech names. Google Brasil and food-delivery platform iFood are among the 8 still working through pending compliance issues; e-commerce marketplace Shopee, education platform Hotmart, retailer Grupo Casas Bahia, cosmetics group Natura, and OpenAI are among the 27 ANPD cleared as fully compliant. ANPD said it selected some controllers after an audit from Brazil’s federal accounts court, the Tribunal de Contas da União, flagged public bodies with no designated officer, and others after complaints from people who said a company or agency had no visible privacy contact point.

Why it matters

The sweep signals ANPD is moving from guidance to enforcement on a basic compliance bar — naming a privacy point of contact — and that even large consumer platforms operating in Brazil aren’t automatically exempt from a closer look.