How much does a DPO cost? Complete guide: in-house DPO vs DPO as a Service

What a DPO is and what art. 41 of the LGPD says

The Personal Data Processing Officer — popularized by the acronym DPO, from the English Data Protection Officer — is the figure responsible for bridging the organization, the data subjects and the Brazilian National Data Protection Authority (ANPD). The General Personal Data Protection Law (Law No. 13.709/2018) establishes this role in article 41, which requires the controller to appoint an officer.

The same article states that the DPO's identity and contact information must be published clearly, preferably on the company's website. This means anyone can verify whether the organization meets this basic requirement — and the mere absence of an appointment already constitutes a breach subject to administrative sanction.

The DPO's legal duties include: accepting complaints and communications from data subjects, providing clarifications, advising employees on data protection best practices, carrying out the ANPD's directives and acting as the communication channel between the company and the regulator. In practice, this demands simultaneous knowledge of privacy law, information security and corporate governance.

Mandatory requirement: who needs a DPO

The LGPD makes no distinction by company size when it comes to the DPO requirement: every data controller — from a medical practice to a multinational — is subject to art. 41. What varies is the intensity of enforcement, the volume of operational obligations and, therefore, the profile of DPO required.

Through its resolutions and guidance notes, the ANPD has signaled that micro and small businesses may rely on simplified solutions, but they are not exempt from making an appointment. This has created a substantial market for DPO as a Service, since hiring a senior privacy professional full-time would be economically unfeasible for most Brazilian companies.

Companies that process sensitive data — health, biometrics, religious belief, racial origin, sex life, data of children and adolescents — must pay extra attention, since improper processing of these categories substantially raises the regulatory risk and potential fines.

Processors (companies that process data on behalf of controllers, such as software vendors or service providers) are also strongly encouraged to appoint an officer, even though the law directs the primary obligation to the controller.

In-house DPO: salary, structure and real cost

Hiring an in-house DPO means bringing onto the payroll a professional trained in law or information technology and specialized in privacy and data protection. In Brazil, the pay for this profile varies considerably depending on the city, the size of the company and the seniority required.

A junior-to-mid-level professional with a CDPO certification or equivalent earns between R$ 5.000 and R$ 9.000 in gross salary. A senior professional with solid experience in LGPD, GDPR and regulatory relations falls between R$ 10.000 and R$ 18.000. For large corporations or regulated sectors (finance, health), executive-level profiles can exceed R$ 25.000.

On top of the gross salary come the labor charges: FGTS (8%), employer INSS (20%), proportional vacation (1/3), 13th-month salary and, frequently, health insurance, meal vouchers and profit sharing. The real cost to the company is usually 1.6 to 1.8 times the nominal salary, raising an R$ 8.000 contract to an effective monthly expense in the R$ 12.800 to R$ 14.400 range.

Beyond personnel costs, the company still needs to provide the in-house DPO with access to specialized tools (privacy management platforms, comparative legislation databases), budget for ongoing training and certifications and, often, external legal support for more complex matters. Together, these push the total cost into the R$ 15.000 to R$ 30.000 monthly range in more complete scenarios.

DPO as a Service: how it works and what's included

The DPO as a Service model — also called outsourced DPO, virtual DPO or outsourced Officer — consists of hiring a specialized firm that formally assumes the functions required by art. 41 of the LGPD. The contracting organization publicly appoints the partner firm's representative as its Officer, meeting the legal requirement without an employment relationship.

The services usually included in a DPO as a Service contract cover: staffing the communication channel with data subjects (DSARs — Data Subject Access Requests), drafting and reviewing the Personal Data Protection Impact Assessment (DPIA), developing internal privacy and data-use policies, managing the data inventory (mapping data flows), periodic employee training, managing security incidents involving personal data and liaising with the ANPD in the event of notifications or requests.

The main difference compared to an in-house DPO is access to a multidisciplinary team. A DPO as a Service firm brings together lawyers specialized in privacy, information security consultants, compliance analysts and, in more sophisticated cases, specialists in data protection technologies (encryption, anonymization, pseudonymization). This set of competencies is hard to find in a single hired professional.

Scale is also a differentiator: DPO as a Service providers serve dozens or hundreds of clients at once, which lets them stay current on new ANPD resolutions, case law and international practices more nimbly than a professional dedicated exclusively to a single organization.

Cost comparison: in-house DPO vs DPO as a Service

The table below summarizes the main differences between the two models, considering a mid-sized company with data-processing operations of moderate complexity.

| Criterion | In-House DPO | DPO as a Service | |---|---|---| | **Monthly cost (SMB)** | R$ 8.000–R$ 22.000 | R$ 800–R$ 6.000 | | **Monthly cost (large company)** | R$ 18.000–R$ 35.000+ | R$ 3.000–R$ 15.000 | | **Labor charges** | Yes (FGTS, INSS, vacation, 13th) | No (B2B service contract) | | **Expertise available** | One professional | Multidisciplinary team | | **Regulatory updates** | Depends on the professional | Continuous team updates | | **Scalability** | Limited to the hired profile | Flexes with the scope | | **Conflict-of-interest risk** | Higher (internal pressure) | Lower (technical independence) | | **Implementation time** | 30–90 days (hiring + onboarding) | 7–15 days | | **Termination** | Notice period + severance | Per the service contract | | **Published ANPD channel** | Employee's name | Partner firm's representative |

It's worth noting that very large companies with large-scale data processing, international operations or in highly regulated sectors (banks, health plans, insurers) often opt for a hybrid model: a senior in-house DPO who coordinates a DPO as a Service team for specific operational functions. This approach combines business knowledge with external technical and legal specialization.

Price ranges by company size and how to evaluate proposals

The Brazilian DPO as a Service market is still maturing, which produces considerable price variation. The main factors influencing the value of the monthly subscription are: the number of data subjects whose data the company processes, the volume of subject requests expected per month, the complexity of the data flows (third-party integrations, international transfers), the sensitivity of the data processed and the need for included legal support.

For micro-businesses and early-stage startups, processing customer and employee data without great complexity, the market charges between R$ 800 and R$ 2.500 per month. This tier generally covers the formal appointment of the officer, the communication channel with data subjects, an initial data mapping and annual training.

Small and mid-sized companies with more structured operations, e-commerce, SaaS or B2B services with access to their clients' customers' data (data of data) fall in the R$ 2.500 to R$ 6.000 monthly range. At this level, full coverage of the compliance cycle is expected: DPIA, policies, incidents, training and active management of the channel.

Large companies, corporate groups, health plan operators or financial institutions seeking DPO as a Service usually contract through customized projects, with values above R$ 8.000 per month and a negotiated scope. Before signing any proposal, verify: whether the contract specifies an SLA for handling data subjects, who signs as the Officer on the ANPD Portal, the maximum number of tickets included and whether there is coverage for security incidents with mandatory notification to the ANPD within 72 hours.

Key terms

DPO (Data Protection Officer)

The professional or firm designated by the data controller to act as the Personal Data Processing Officer, as required by art. 41 of the LGPD. It is the official point of contact between the organization, the data subjects and the ANPD.

DPIA (Personal Data Protection Impact Assessment)

A document required by the LGPD in higher-risk data-processing situations, describing the processing operations, the security measures adopted and the risks to data subjects' rights. The DPO is technically responsible for preparing it.

ANPD (National Data Protection Authority)

The Brazilian federal agency created by the LGPD, linked to the Presidency of the Republic, responsible for overseeing compliance with the law, issuing complementary rules and applying administrative sanctions. The DPO is the official channel between the company and the ANPD.

DSAR (Data Subject Access Request)

A data subject request — when a customer, employee or any person whose data the company processes asks for access, correction, portability, deletion or information about the use of their data. The LGPD sets deadlines for responding, and the DPO is responsible for managing this flow.

How to decide and hire well

1. Map the volume and sensitivity of the data your company processes. Before quoting any service, run a basic inventory: how many data subjects are in your database, which categories of data you collect (ordinary, sensitive, children's), and whether there is international transfer. This mapping defines the size of the service needed and keeps you from contracting less than you require.
2. Assess whether the in-house or as-a-service model is viable for your size. If your company has fewer than 200 employees and does not operate in a highly regulated sector, DPO as a Service almost always delivers more value. Use this guide's comparison table to calculate the total cost of the in-house model (salary + charges + tools) and compare it against subscription proposals.
3. Request at least three proposals with a detailed scope. Ask each proposal to specify: who will be the Officer appointed to the ANPD, how many monthly hours are included, the SLA for responding to data subjects, whether the DPIA is included, how security incidents are handled and what the ticket limits are. Vague proposals hide extra costs.
4. Verify the provider's credentials and references. Check whether the provider has lawyers with active OAB registration specialized in digital law and whether the security consultants hold recognized certifications. Ask for references from clients of the same size and sector as yours. Sector experience is especially important in health, finance and digital retail.
5. Negotiate the contract with attention to liability and confidentiality clauses. A DPO as a Service contract should provide for: confidentiality over the company's data and that of its subjects, the provider's liability in case of failure to meet regulatory deadlines, an immediate-notification clause in the event of an incident and a transition procedure if the contract is terminated — including handover of the history of subject requests and the documentation produced.
6. Formalize the appointment on the website and keep the channel active. After contracting, the DPO appointment must be published clearly and be easily accessible on the company's website — ideally in the privacy policy and the footer. The communication channel (email or form) must be actively monitored by the provider. Periodically review the contracted scope as the business grows, since the volume of data and requests tends to increase.

Frequently asked questions

References

• ›Law No. 13.709/2018 — General Personal Data Protection Law (LGPD), art. 41
• ›ANPD — National Data Protection Authority: Guidance for Small-Scale Processing Agents
• ›ANPD — Resolution CD/ANPD No. 4/2023: Security Incident Notification Regulation
• ›gov.br — ANPD Portal: appointment of the Personal Data Processing Officer