What ECCON does

ECCON (legal name José Edson Costa Junior Consultoria em Tecnologia da Informação Ltda.) is a privately-held Brazilian consulting firm headquartered in São Paulo, founded in 2015, with a team of 22 professionals. The company delivers specialized advisory services in Privacy, Data Protection, Information Security, Governance, Risk, and Compliance, with a particular focus on helping organizations comply with Brazil's LGPD (Lei nº 13.709/2018) and the EU's GDPR (EU 2016/679). Its core product is outsourced Data Protection Officer services (DPO as a Service), supplemented by outsourced CISO (Information Security Officer) services, GRC consulting, LGPD/GDPR adequacy diagnostics, ISO 27001-aligned information security programs, and EXIN-aligned training/certification preparation.

Technically, ECCON is not a software or SaaS company; it is a methodology-driven professional services firm. It operates a dedicated Privacy, Data Protection and Information Security Competency Center that studies and applies international reference methodologies, and its consulting practices are built around EXIN-certified competencies (ISFS, PDPF, PDPP). The leadership holds EXIN Accredited Trainer status, enabling ECCON to deliver official certification preparation. No APIs, proprietary platforms, or productized tooling are publicly disclosed.

ECCON generates revenue through per-engagement consulting fees with no publicly disclosed pricing. Its go-to-market is sales-led and direct: clients are reached via the company website, email, and WhatsApp/phone. The customer base is organized into two primary verticals — organizations requiring LGPD/GDPR compliance (any size) and Brazilian educational institutions needing IT and educational technology consulting — though no specific enterprise customer logos are publicly named.

Name

ECCON

Legal name

José Edson Costa Junior Consultoria em Tecnologia da Informação Ltda.

Website

https://eccon.com.br

Company type

Private

Founded year

2015

Operating status

Operating

Headcount range

11–50 employees

Short description

ECCON is a São Paulo-based Brazilian consulting firm offering DPO-as-a-Service, CISO-as-a-Service, GRC, LGPD/GDPR compliance, and information security services to organizations and educational institutions in Brazil.

Ownership category

akta.pro rank

Product category

Privacy and Data Protection Consulting

NAICS

Management, Scientific, and Technical Consulting Services (5416), Professional, Scientific, and Technical Services (541)

SIC

Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Data Privacy & Data Protection (e.g., GDPR/CCPA) (EDABADAC)

akta.pro secondary industries

Information Security, Privacy & IT Governance (CISSP CPE, Privacy CE) (EDAAALAL), Information Technology (IT) & Cybersecurity Certifications (EDAAANAA)

Keywords

• Data privacy consulting
• LGPD compliance services
• GDPR compliance consulting
• DPO as a service
• Information security consulting

Headquarters

HQ city

São Paulo

HQ country

Brazil

HQ region

Latin America

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Marketing or Sales

Revenue model

1. Consulting Services (GRC, LGPD/GDPR, Information Security): ECCON generates revenue through consulting engagements providing GRC advisory, LGPD/GDPR adequacy, information security, and outsourced DPO/CISO services to client organizations.

Go-to-market motion1 record

Distribution channels1 record

Marketing channels1 record

Core offering

ECCON provides outsourced privacy, data protection, and information security consulting services to organizations in Brazil, including DPO as a Service, CISO as a Service, GRC consulting, LGPD/GDPR compliance adequacy, and information security governance aligned with ISO 27001. All engagements are delivered by internationally EXIN-certified DPO professionals operating through a dedicated Privacy, Data Protection and Information Security Competency Center. The firm also offers EXIN-accredited training for DPO certification (ISFS, PDPF, PDPP).

Product overview

ECCON is a consulting services firm offering a portfolio of specialized services centered on data privacy, information security, and governance risk and compliance. The core offering includes DPO as a Service, which provides certified Data Protection Officers to organizations, complemented by GRC consultancy, LGPD/GDPR compliance services, and Information Security services. Additional offerings include CISO as a Service for security leadership and training/certification preparation courses for privacy and data protection credentials.

Differentiator

Problem solved

Functional benefit

Products and services

• DPO as a Service (Encarregado de Proteção de Dados externo) Provides external Data Protection Officer (DPO) services in a 'DPO Office' delivery model, assigning certified DPO professionals to help Brazilian organizations comply with LGPD (Lei nº 13.709/2018) and GDPR (EU 2016/679) requirements, including accepting complaints and notifications from ANPD and data subjects, training staff, and establishing data protection norms and procedures.
• CISO as a Service (Information Security Officer as a Service) Provides outsourced Information Security Officer leadership, helping organizations that cannot afford a full internal information security department establish and maintain information security governance aligned with ISO 27001 best practices, covering the full information lifecycle (not just IT systems).
• GRC Consultancy (Consultoria em GRC) Governance, Risk, and Compliance consulting services helping organizations establish frameworks and processes for managing organizational governance, risk management, and regulatory compliance.
• Data Privacy Services (LGPD / GDPR) Diagnostic assessment of organizational data protection maturity levels and risks, followed by alignment services to achieve compliance with Brazil's LGPD (Lei nº 13.709/2018) and the EU's GDPR (EU 2016/679).
• Information Security (Segurança da Informação) Information security services focused on ensuring confidentiality, integrity, and availability of information, following ISO 27001 best practices and addressing the broader business information lifecycle (digital and non-digital) rather than just IT systems.
• Training, Courses, and Lectures (Treinamentos, Cursos e Palestras) Educational offerings including EXIN Data Protection Officer certification preparation covering Information Security Foundation (ISFS), Privacy and Data Protection Foundation (PDPF), and Privacy and Data Protection Practitioner (PDPP) modules, delivered through ECCON's EXIN Accredited Trainer.

Named customers1 record

Segments2 records

Ideal customer profiles2 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature1 record

Partnerships

One partnership is on record.

• EXIN (Examination Institute)coreTechnology or IntegrationECCON's team members are internationally certified through EXIN's DPO certification program (ISFS, PDPF, PDPP). Edson Costa holds official EXIN Accredited Trainer status, allowing ECCON to deliver EXIN-certified training. EXIN badges are displayed on the company's website as a credential signal.

Scale indicators1 record

Recent moves5 records

Expansion highlights4 records

Broad incumbents

• Ernst & Young (EY): Big 4 professional services firm with a dedicated cybersecurity and privacy practice that competes for LGPD/GDPR compliance and outsourced DPO engagements in Brazil — directly overlapping ECCON's core market but at vastly larger scale.
• OneTrust: Large US privacy, security, and GRC platform with a Brazilian presence, providing privacy management software and professional services — competes head-on with ECCON's compliance and DPO-as-a-Service offerings from a platform-plus-services angle.
• KPMG: Big 4 advisory firm with a dedicated privacy and information security practice in Brazil, competing on LGPD compliance, GRC, and risk consulting — same service categories as ECCON, but with global delivery infrastructure.
• PwC: Big 4 firm with an established cybersecurity, privacy, and risk consulting practice in Brazil, offering LGPD/GDPR compliance and DPO-as-a-Service style engagements to enterprise clients across multiple verticals.
• Accenture: Global consulting leader with a sizable security and compliance practice in Brazil, addressing LGPD, GDPR, ISO 27001, and GRC — overlapping with ECCON's service portfolio at the enterprise end of the market.
• Deloitte: Global Big 4 with a substantial Risk & Compliance and privacy practice in Brazil, delivering LGPD adequacy, GRC advisory, and information security services to mid-market and enterprise clients — a broad incumbent competing for the same mandates.
• TrustArc: US-based privacy compliance platform and consultancy offering privacy program management, GDPR/CCPA tooling, and advisory services — a directly comparable privacy-services specialist, though technology-led rather than pure advisory.

Regional players

• Stefanini: Brazilian-origin global IT services and consulting firm with a cybersecurity and compliance practice, offering LGPD-aligned consulting and managed services — a regional player with both domestic reach and global delivery capability.
• CI&T: Brazilian-born digital transformation and consulting firm with growing capabilities in data governance, security, and compliance — a regional player whose technology-led consulting approach overlaps with ECCON's adjacent advisory services.
• Serpro: Brazilian federal government IT services company that has expanded into LGPD-related consulting and software offerings — a regional player with privileged public-sector access that competes with ECCON's education and enterprise engagements.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat3 records

Key risks7 records

Key highlights6 records

Customer concentration

• LinkedInlinkedin.com/company/eccon-br

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about ECCON