On July 16, 2024, the Brazilian National Data Protection Authority (“ANPD” or “Brazilian DPA”) published Resolution CD/ANPD no. 18 (“Regulation”), which sets forth the rules for the role of the Data Protection Officer (“DPO”), named “Encarregado” under the General Data Protection Law (“LGPD”), establishing the DPO and the data processing agents’ obligations and responsibilities.
Among the main points of the Regulation, we highlight the need for a written document establishing the appointment of the DPO, detailing the role and activities to be performed. Furthermore, the Regulation determines that the DPO will act with technical autonomy, avoiding situations of conflicts of interest, as described in the text.
The Regulation follows the LGPD’s provision that the DPO can be a natural or legal person, with its identity available on the data processing agent’s website. Thus, if the DPO is a natural person, the person’s full name will be displayed on the agent’s website. On the other hand, if the DPO is a legal person, the website will show the company’s name and the full name of the person responsible for the DPO’s company.
Finally, the Regulation outlines the duties of the DPO and data processing agents, allowing other obligations to be established between the parties, which can be done through the DPO’s appointment document.
Among the duties of the DPO are: (i) acting as a communication channel with data subjects, receiving complaints and requests, and providing clarifications; (ii) receiving communications from the ANPD and taking the necessary actions; (iii) guiding the data processing agent’s staff on issues related to personal data protection; and (iv) providing assistance, guidance, and support to the data processing agent in developing and implementing records, reports, security mechanisms, internal processes and policies, and contractual instruments, among others.
Our team is at your disposal for further clarifications and to assist with complying with LGPD and ANPD regulatory requirements.
Gustavo Flausino Coelho – gustavo@bastilhocoelho.com.br
Fernando Naegele – fernando@bastilhocoelho.com.br