LGPD by the numbers: only 14% of firms have a DPO

Only 14% of Brazilian companies with ten or more employees that hold data on individuals had appointed a data protection officer (the “encarregado” under the LGPD) in 2025, according to the TIC Empresas 2025 survey by Cetic.br/NIC.br. The share was 17% in 2021 and 19% in 2023, and among small companies it fell to 12%. On the other side, the ANPD changed pace: of the 37 sanctioning proceedings recorded in its Enforcement Dashboard through October 2026, 25 were opened this year, and 23 of those 25 deal with appointing the data protection officer or providing a channel for data subjects. My reading is that enforcement started with the most basic obligation, one most companies still fail to meet and one that runs through the customer and lead records kept in the CRM. This article is for information only and is not legal advice; each company should validate its choices with its legal team and its data protection officer.

At Iasbeck&Co we implement CRM and AI agents in B2B operations, and the LGPD usually comes up when someone wants to import an old database or connect an agent to customer history. I gathered the official numbers, with the year, base and method of each, and my reading for executives, team leaders and HR. The care needed when CRM data goes into AI tools is covered in AI and the LGPD, and the database hygiene routine in CRM data quality.

How many companies comply with the LGPD? The Cetic.br picture

Cetic.br measures LGPD compliance in a module of the TIC Empresas survey. The 2025 edition interviewed 4,174 companies with ten or more employees by phone between February 2025 and January 2026, and 1,775 of them answered the privacy and personal data protection module (Cetic.br, results presentation, 2026). The results came out on August 31, 2026, and allow comparison across three editions: 2021, 2023 and 2025.

The data protection officer and the responsible team

The table separates two questions: having a team or employees responsible for the topic, and appointing a data protection officer, the person who answers to data subjects and to the ANPD (LGPD, art. 41).

Indicator (Cetic.br)	2021	2023	2025
Appointed a DPO, total	17%	19%	14%
Appointed a DPO, small (10 to 49 employees)	15%	16%	12%
Appointed a DPO, medium (50 to 249)	29%	35%	21%
Appointed a DPO, large (250 or more)	41%	43%	40%
Has a team or employees responsible for data protection, total	23%	25%	20%
Has a team or employees responsible, large	47%	56%	55%

Sources: Cetic.br, tables XP12 (2021, 2023, 2025), base of companies holding data on individuals, and XP07 (2021, 2023, 2025), base of all companies.

Among companies with a data protection officer, 65% named someone in-house and 31% hired a third party (Cetic.br, XP13). When the officer comes from inside the company, they come from IT in 28% of cases, from administration in 19% and from legal in 18% (Cetic.br, XP14). The questionnaire’s list of departments does not even include marketing or sales, which is where much of the customer and lead data lives.

What companies did to comply

Formal compliance actions also fell or stalled compared with 2023. The base is the same as for the DPO: companies that hold data on individuals.

LGPD compliance action	2021	2023	2025
Amended existing contracts	28%	35%	30%
Drew up a compliance plan	24%	32%	25%
Developed a privacy policy for customers	32%	32%	28%
Ran security tests against data leaks	30%	29%	27%
Drew up a retention and disposal policy	no data	25%	22%
Offered a service channel for data subjects	24%	20%	18%
Built a personal data inventory	18%	18%	15%

Source: Cetic.br, XP12 tables for 2021, 2023 and 2025, linked above.

Two rows matter for anyone running a CRM. A personal data inventory, the map of what data the company holds, where and for what purpose, exists in 15% of companies, and a retention and disposal policy, which says when an old contact leaves the database, in 22%. Without them, the company cannot answer with confidence a data subject who asks what data about them is in the CRM.

What companies do with customer data

Among companies holding personal data on customers and users, 63% use it to contact customers directly, 39% to check credit, 22% to analyze behavior and build profiles and 20% in advertising and marketing campaigns (Cetic.br, XP010). Commercial use is the rule, and transparency about it is the exception: among companies with a website, 34% publish a privacy policy and only 7% show the name and contact of the data protection officer (Cetic.br, XP16). Since July 2024, ANPD Resolution No. 18 has required the officer’s identity and contact details to appear on the website “in a prominent and easily accessible place”, as the ANPD points out in its monitoring report.

The respondents themselves acknowledge the gap. Only 37% fully agree that their internal team is prepared to answer data subjects’ questions, while 59% fully agree that their systems have adequate protection mechanisms (Cetic.br, XP01C and XP01D). The data subject’s question, however, reaches the salesperson, the support desk or CS before it reaches any system.

ANPD enforcement by the numbers

The ANPD, now Brazil’s National Data Protection Agency, publishes data on requests from data subjects, reported incidents and enforcement and sanctioning proceedings. The most complete source is the 3rd Monitoring Cycle Report, which covers July 1, 2023 to June 30, 2025, complemented by the review of the 2024-2025 Priority Topics Map, signed in August 2026, and by the Enforcement Dashboard spreadsheet, updated in October 2026.

Requests: data subjects started to complain

In the July 2023 to June 2025 cycle, the ANPD received 9,629 requests, split between 7,080 complaints and 2,549 data subject petitions. Volume jumped after July 2024, when the agency launched its own platform on Gov.br: 616 requests in the first half of 2024, 3,413 in the second and 4,956 in the first half of 2025, a record for the series. The report attributes the increase to the easier channel, and the jump coincides with the system change.

The most complained-about sectors were banks, lenders and card issuers (746 admissible requests), services (684), data aggregators (545), retail (518) and telecommunications (394). Among complaint types, the top ones are exposure of personal or sensitive data (1,013), difficulty exercising the right to deletion (795) and data leaks (789). Taken together, difficulties exercising any LGPD right add up to 1,610 records. Of the 1,508 requests the ANPD forwarded to companies for a response, 427 went unanswered, or 28.3%, and the report warns that a lack of response can be a criterion for choosing whom to inspect.

Reported security incidents

Year	Security incident reports received
2021	186
2022	275
2023	352
2024	336
First half of 2025	198

Source: ANPD, 3rd Monitoring Cycle Report.

Since April 2024, the incident reporting regulation (ANPD Resolution No. 15) has given controllers three business days to report to the ANPD any incident that may cause relevant risk or harm to data subjects. Over 2021 to 2025, ransomware without data exfiltration is the most reported type, with 263 cases, but in the latest cycle credential theft and social engineering moved into first place. For commercial teams, this has an address: a salesperson’s CRM login and email inbox are credentials. Cetic.br shows that 7% of companies contacted the ANPD to report an incident, up from 4% in 2021 (Cetic.br, XP17).

ANPD sanctions: how many and against whom

Through October 2026, the Enforcement Dashboard spreadsheet lists 37 sanctioning proceedings, 8 of them closed. Ten received a first-instance decision, and nine of those decisions imposed a sanction. Seven targeted public bodies, which under the LGPD cannot be fined (art. 52, § 3) and received warnings, publication of the violation and corrective measures, almost always for failing to notify data subjects of an incident.

The first fine imposed by the ANPD came in July 2023, against Telekall Infoservice, for R$ 14,400. The second, in August 2026, imposed on ByteDance Brasil, owner of TikTok, fines totaling R$ 153,769,671.33 for violations of three LGPD provisions in the processing of children’s and adolescents’ data, plus deletion of data on adolescents registered without proper authorization (ANPD, Decision No. 27/2026). It is a first-instance decision, and the company filed an appeal in September, according to the dashboard. The LGPD caps a simple fine at 2% of revenue in Brazil, up to R$ 50 million per violation, and the total exceeded that ceiling because it combined different violations.

Of the 25 sanctioning proceedings opened in 2026, 20 are against public bodies and 5 against private organizations, and 23 list among the conduct under investigation LGPD article 41, which covers the appointment of the data protection officer and their duties. Before them, the ANPD notified 20 large companies in 2024 over a missing identified officer or a missing channel for data subjects, 6 of which received notices to fix gaps, and in October 2025 it opened a new monitoring process on the same topic with another 20 controllers.

Enforcement in 2026 and 2027: profiling and AI

The 2026-2027 Priority Topics Map, approved in December 2025, matters to marketing and sales on two points. Topic 1 plans 5 enforcement activities on the “secondary use of personal data to deliver targeted commercial advertising”, especially through profiling. Topic 4 plans 20 activities on the processing of personal data in artificial intelligence systems and emerging technologies. In the previous cycle, the ANPD had already inspected the use of personal data to train generative AI. The regulatory context for AI, with the AI Act and Brazil’s Bill 2338/2023, is in AI regulation.

Summary of the sources cited

Source	Year	Sample and method	Main finding
Cetic.br/NIC.br, TIC Empresas 2025, privacy module	2025, released in 2026	4,174 companies with 10 or more employees, 1,775 in the module; phone, Feb/2025 to Jan/2026; self-reported	14% appointed a DPO (17% in 2021); 15% built an inventory
Cetic.br, Painel TIC 2025, privacy	2025	2,500 internet users aged 16 or older, online questionnaire in Dec/2025	37% of AI users shared personal data; 66% worry about its use
ANPD, 3rd Monitoring Cycle Report	Jul/2023 to Jun/2025	Administrative enforcement records	9,629 requests; 723 incidents; 28.3% unanswered by companies
ANPD, Technical Note No. 1/2026, review of the 2024-2025 map	2024 and 2025	Internal assessment of enforcement activities	84 enforcement activities; team of 8 people at the end of 2025
ANPD, Enforcement Dashboard (Oct/2026 spreadsheet)	2020 to 2026	Database of enforcement and sanctioning proceedings, pilot project	37 sanctioning proceedings, 25 in 2026, 23 citing art. 41
ANPD, Resolution No. 30/2025	2026 and 2027	Regulatory act	Enforcement targets on profiling for advertising (5) and AI (20)

What these numbers mean for anyone keeping leads in a CRM and using AI

The CRM holds the data that shows up in complaints to the ANPD. In commercial operations, difficulty with deletion, the second most common complaint in the cycle, takes a familiar form: the contact who asks to be removed and keeps receiving nurture emails or prospecting calls. If the company does not record in the CRM the lead’s source, the legal basis for the contact and the data subject’s request, the commercial team cannot prove what it did or carry out the request across every list and integration where that contact appears. That is why I treat a data subject’s request as a CRM process, with an owner, a deadline and a record, and not as an email forwarded to legal.

The second point is the origin of the database. Data aggregators are among the most complained-about sectors and formed an entire enforcement topic in the last two-year cycle, with proceedings still open. Whoever buys a prospecting list inherits its origin problems, and an import without rules becomes a compliance question: where did each contact come from and for what purpose did it enter the CRM.

The third is AI. Cetic.br’s survey of internet users shows that 37% of those who used AI tools in 2025 have shared personal data such as name, address or CPF (Brazil’s taxpayer ID), and that 66% are worried or very worried about how AI companies use that data. With the ANPD planning 20 enforcement activities on AI and 5 on profiling for advertising through 2027, an agent that scores leads, personalizes campaigns or summarizes customer conversations needs written criteria, a list of fields it may read and an entry in the data protection officer’s records. The team’s usage rules belong in the AI usage policy, and the scoring design in lead scoring.

What these data do not say

Cetic.br’s numbers are self-reported by one respondent per company, who may not know what other departments do. The drop in DPO appointments from 19% to 14% between 2023 and 2025 should be read with care: Cetic.br’s tables do not state whether the difference is statistically significant, each edition has its own sample and the question measures formal appointment without saying whether the appointed officer works on the topic. The survey also does not separate B2B from B2C companies or say whether customer data sits in a CRM, a spreadsheet or an ERP.

The ANPD’s numbers are administrative records and depend on the agency’s own capacity. The team that runs most inspections had 7 people at the start of 2024 and 8 at the end of 2025, according to the review, and the dashboard is a pilot project with data subject to correction. Few sanctions do not mean low noncompliance, and the jump in requests follows the change of service channel, which rules out reading the series as a rise in violations. The number of reported incidents measures companies’ willingness to report, which grew after the 2024 regulation; the total number of incidents in the country remains unknown.

Nor is there an established causal link between having a DPO and suffering fewer incidents or complaints, and the August 2026 fine may still change on appeal.

What leadership does with these numbers

The roadmap starts with what enforcement already demands.

1. Confirm the data protection officer and their page on the website. Check that there is a formal appointment, that the name and contact appear prominently, as Resolution No. 18 requires, and that someone reads and answers that channel’s inbox.
2. Define who answers the data subject and how fast. Sales, marketing, support and CS receive the request first; write down the path to the officer, the deadline and how each request is recorded in the CRM.
3. Inventory the CRM. List the fields with personal data, the integrations that write to the database, the imported lists and the purpose of each use, including the AI agents that read customer history.
4. Write the retention and disposal rule. Decide with the officer and legal when a contact with no interaction leaves the database, when it is anonymized and what stays because of a legal obligation.
5. Review the origin of prospecting databases. Before the next list purchase or import, ask the supplier where the data came from and record each contact’s source in the CRM.
6. Test the incident response with the commercial team. Simulate a compromised CRM login and check whether people know whom to alert, because the deadline to report to the ANPD is three business days.

LGPD and L&D: what HR needs to assess

For HR, the useful data point is this: the in-house officer usually comes from IT, administration or legal, and data protection training offered by the company itself reaches 35% of companies (Cetic.br, XP04). The people who deal with data subjects every day, however, are the salesperson, the marketing analyst and the CS team, who register, import, export and send messages from the CRM. The need shows when a deletion request sits in a salesperson’s inbox or when nobody knows who approved the last import.

The program needs to bring together commercial leaders, the CRM administrator and the data protection officer, with legal helping to build the rules. To measure it, record before and after the response time to data subject requests, the share of contacts with a source filled in the CRM and the number of imports done outside the approved flow.

The LGPD by the numbers shows companies that keep customer data to sell and communicate, with little structure to answer for it, and an agency that has started to demand that structure. This work runs through the CRM and the people who operate it, and it is the focus of the in-company CRM adoption training, built on your company’s database and processes. The group leaves with the CRM best practices guide, which covers lead source, recording of data subject requests and import rules, and with the account and database management manual, including the retention and disposal routine agreed with the data protection officer.

Frequently asked questions

How many Brazilian companies have a data protection officer?

According to Cetic.br’s TIC Empresas 2025, 14% of companies with ten or more employees that hold data on individuals have appointed a data protection officer. The share is 40% among large companies, 21% among medium-sized ones and 12% among small ones.

How many fines has the ANPD imposed?

Through October 2026, the ANPD has fined two private companies: Telekall Infoservice, R$ 14,400 in 2023, and ByteDance Brasil, R$ 153.7 million in August 2026, a first-instance decision under appeal. The other seven decisions with sanctions targeted public bodies, which under the LGPD receive warnings and other measures, without fines.

How many security incidents are reported to the ANPD each year?

The ANPD received 186 reports in 2021, 275 in 2022, 352 in 2023, 336 in 2024 and 198 in the first half of 2025. The number measures the incidents companies chose to report, not the total number of incidents in the country.

Does a small company need a data protection officer?

The ANPD has simplified rules for small processing agents, including an exemption from appointing an officer in some cases, as long as the company keeps a communication channel open for data subjects. Whether it applies to you depends on how your company qualifies and should be validated with legal counsel.

What does the LGPD require of a CRM?

The law does not mention CRM, but it applies to the personal data stored in it: a defined purpose, a legal basis, only the data needed, respect for data subject rights and security. In practice, that calls for recording each contact’s source, a flow for deletion and correction requests, a retention rule and access control.

How do I prepare the team to handle the LGPD day to day?

Start with situations the team lives through: the lead who asks to leave the list, the purchased spreadsheet, the customer who asks what data the company holds. Train sales, marketing and CS on the company’s flow for each case, with the data protection officer helping build the content, and measure response time to requests after the training.