Resolution CD/ANPD 18, dated July 16, 2024, sets forth essential guidelines regarding the role of the data protection officer, supplementing the provisions of the General Personal Data Protection Law (LGPD)[1]. As is well known, Article 41 of the LGPD stipulates that the data controller must appoint a data protection officer, whose identity and contact information must be disclosed publicly, in a clear and objective manner, preferably on the data controller’s website.
A similar provision is contained in Article 23, III, of the LGPD, regarding entities subject to the regime governing the public processing of personal data. According to João Victor Rozatti Longhi, “what can at least be emphasized is that the government is required to appoint a data protection officer whenever data processing occurs, pursuant to Article 39 of the Law (the one referred to in Article 23, III, of the LGPD), always bearing in mind that data protection impact assessments must be requested by the ANPD from those falling under the exception to legal protection (Article 4, item III, in conjunction with paragraph 3, of the LGPD)”[2].
In general, in line with the concept set forth in Article 5, VIII, of the LGPD, it can be said that the data protection officer’s activities include accepting complaints and communications from data subjects, receiving communications from the ANPD, providing guidance to employees on data protection practices, and performing other duties determined by the data controller or provided for in supplementary regulations[3].
Article 3 of the resolution establishes that the appointment of the data protection officer must be made through a formal act by the processing agent, being mandatory for the controller but optional for the processor, “considered a policy of good governance practices for the purposes of the provisions of Article 52, paragraph 1, subparagraph IX, of Law No. 13.709, of August 14, 2018, and in Article 13, item II, of the annex to Resolution CD/ANPD No. 4, dated February 24, 2023[4], provided that the rules of this Regulation are observed” (Article 6 of the resolution). This formal act is defined as a written, dated, and signed document that clearly and unequivocally demonstrates the processing agent’s intention to designate a natural or legal person as a data protection officer. This formality appears to be in line with the principle of transparency (Article 6, subparagraph VI, of the LGPD), as it aims to ensure clarity in the designation of the person who will serve as the focal point for communication with data subjects regarding the positive outcome of personal data processing activities, ensuring that their functions and activities are clearly defined.
Paragraph 1 of Article 3 further specifies that the document must be clear and unambiguous, reinforcing the importance of transparent and precise communication regarding the appointment of the data protection officer. Paragraph 2 provides that this document must be available for submission to the ANPD upon request. Furthermore, the new regulation reinforces the requirement to appoint a data protection officer for all entities that process personal data, with the exception of small-scale processing agents, to whom the provisions of ANPD Resolution No. 2, dated January 27, 2022[5], apply. For these entities, paragraph 3 adapts the requirement, exempting them from appointing a data protection officer but requiring them to provide a communication channel with data subjects. This ensures that, even in smaller-scale situations, the rights of data subjects are respected and upheld.
Article 5 of the resolution, meanwhile, establishes the requirement that public-law legal entities designate a data protection officer when conducting operations in this context. The regulation specifies that the appointment should preferably be made from among public servants or employees with an unblemished reputation, ensuring transparency and accountability in the process. The appointment must be published in the Official Gazette corresponding to the entity’s level of government—whether federal, state, district, or municipal.
Articles 12, 13, and 14 of the resolution address the conditions for assuming the role of data protection officer, making it clear that this role may be filled by either a natural person—whether internal or external to the organization— or a legal entity, providing flexibility in selecting the professional or entity best suited to the controller’s needs, while supporting the understanding expressed in Statement 680 of the 9th Civil Law Conference of the CJF, according to which the appointment of a depersonalized entity would be permissible.[6] Article 13 emphasizes the importance of clear and precise communication in Portuguese with data subjects and the ANPD, ensuring accessibility and transparency. Finally, Article 14 eliminates the requirement for registration with specific entities or certifications, focusing instead on the data protection officer’s practical competence, which facilitates the appointment process and promotes a more inclusive and practical approach to data protection.
Furthermore, confirming various interpretations already included in its “Guidance on the Definitions of Personal Data Processing Agents and the Data Protection Officer,” version 2.0, the ANPD has consolidated the understanding that the data protection officer’s duties include, but are not limited to, receiving complaints from data subjects, providing clarifications, taking appropriate measures, guiding employees on data protection practices, and other duties established by the controller or provided for in complementary regulations; it is essential to clearly and objectively indicate the identity and contact information of the data protection officer.
Section II of Chapter III of the resolution (Articles 15, 16, and 17) is entirely devoted to the activities and duties of the data protection officer, and it is clear that, in addition to the duties already defined in the LGPD, the data protection officer is responsible for assisting in the preparation of security incident logs, impact assessments, security measures, and internal policies, as well as assisting with international data transfers and ensuring compliance with ANPD regulations. It is important to note that, in performing these functions, the data protection officer is not directly accountable to the ANPD for the compliance of the data processed by the data controller; rather, the officer acts as a facilitator and advisor to ensure that the processing agent meets legal and regulatory requirements.
This professional must have adequate knowledge of data protection and information security practices. Therefore, selecting a qualified Data Protection Officer is key to the controller’s compliance with the law, as the appointed individual will serve as the point of contact with data subjects and the ANPD. In fact, Article 41, paragraph 2, of the LGPD already establishes that one of the data protection officer’s main functions is to receive complaints and communications from data subjects, as well as to provide clarifications and take appropriate measures, which aligns with the principle of responsibility and accountability, as provided for in Article 6, X, of the LGPD.
Another positive aspect is the emphasis on employee training and awareness. The data protection officer must promote programs that ensure all employees are aware of their responsibilities and best security practices. This is essential, as information security depends not only on technology but also on human behavior.
The resolution also addresses the need for continuous monitoring and internal audits. The data protection officer must conduct regular audits to assess compliance with data protection policies and identify potential vulnerabilities. This proactive approach is vital for preventing security incidents and ensuring the effectiveness of protective measures. In the event of security incidents that compromise personal data, the resolution stipulates that the data protection officer must act promptly to mitigate the impacts by notifying the data controller, the ANPD, and the affected data subjects. This requirement is in line with Article 48 of the LGPD[7], which mandates the reporting of security incidents that may pose a significant risk or cause significant harm to data subjects.
Ongoing interaction with the ANPD is another key point. The data protection officer must maintain open communication with the regulatory authority, reporting significant violations and cooperating in investigations. This transparency is crucial for maintaining public trust and ensuring that organizations take the protection of personal data seriously.
Finally, the resolution outlines the penalties for noncompliance with the established guidelines, which may include fines and operational restrictions, as provided for in the LGPD. It is the data protection officer’s responsibility to ensure that all legal obligations are met, thereby avoiding sanctions that could compromise the entity’s reputation and operations.
Articles 18 through 21 of the resolution address the issue of conflicts of interest in the performance of the duties of the data protection officer. These provisions reinforce the need for the data protection officer to act with ethics, integrity, and technical autonomy, ensuring that their activities are not compromised by conflicts that could tarnish the upright and impartial conduct expected of them. Thus, the resolution allows the data protection officer to hold multiple positions and work for more than one processing agent, provided that they can fully fulfill their duties without incurring conflicts. Furthermore, conflicts of interest may arise both internally, within a single processing agent, and between different processing agents, especially if the data protection officer has influence over strategic data processing decisions.
To ensure transparency and impartiality, the data protection officer must disclose any situation that could constitute a conflict of interest. The resolution also outlines the duty assumed by the processing agent to prevent the data protection officer from performing functions that could result in conflicts, requiring that measures be adopted to mitigate these risks—such as not appointing that person, implementing mitigation measures, or replacing the data protection officer. As a last resort, should a conflict of interest be identified, the processing agent may face sanctions under Article 52 of the LGPD, underscoring the importance of careful and ethical management in the processing of personal data.
In conclusion, Resolution CD/ANPD No. 18 of July 16, 2024, represents a significant step forward for the protection of personal data in Brazil, as it details the role of one of the most important figures involved in personal data processing activities. The implementation of these guidelines is essential to strengthen the culture of data protection in the country and ensure that data subjects’ rights are respected, protected, and enforced.
________________
- BRASIL. Autoridade Nacional de Proteção de Dados. Resolução CD/ANPD nº 18, de 16 de julho de 2024. Aprova o Regulamento sobre a atuação do encarregado pelo tratamento de dados pessoais. Diário Oficial da União: seção 1, Brasília, DF, 17 jul. 2024. Disponível em: https://www.in.gov.br/en/web/dou/-/resolucao-cd/anpd-n-18-de-16-de-julho-de-2024-572632074 Acesso em: 18 jul. 2024.
- LONGHI, João Victor Rozatti. Artigo 41. In: MARTINS, Guilherme Magalhães; LONGHI, João Victor Rozatti; FALEIROS JÚNIOR, José Luiz de Moura (coord.). Comentários à Lei Geral de Proteção de Dados Pessoais (Lei nº 13.709/2018). 2. ed. Indaiatuba: Foco, 2024, p. 395.
- For more details on this topic, please see QUEIROZ, Renata Capriolli Zocatelli. Encarregado de proteção de dados pessoais - DPO: regulamentação e responsabilidade civil. São Paulo: Quartier Latin, 2022.
- BRASIL. Autoridade Nacional de Proteção de Dados. Resolução CD/ANPD nº 4, de 24 de fevereiro de 2023. Aprova o Regulamento de Dosimetria e Aplicação de Sanções Administrativas. Diário Oficial da União: seção 1, Brasília, DF, 27 fev. 2023. Disponível em: https://www.in.gov.br/en/web/dou/-/resolucao-cd/anpd-n-4-de-24-de-fevereiro-de-2023-466146077 Acesso em: 18 jul. 2024.
- BRASIL. Autoridade Nacional de Proteção de Dados. Resolução CD/ANPD nº 2, de 27 de janeiro de 2022. Aprova o Regulamento de aplicação da Lei nº 13.709, de 14 de agosto de 2018, Lei Geral de Proteção de Dados Pessoais (LGPD), para agentes de tratamento de pequeno porte. Diário Oficial da União: seção 1, Brasília, DF, 28 jan. 2022. Disponível em: https://www.gov.br/anpd/pt-br/documentos-e-publicacoes/regulamentacoes-da-anpd/resolucao-cd-anpd-no-2-de-27-de-janeiro-de-2022 Acesso em: 18 jul. 2024.
- Statement 680/CJF - “The General Personal Data Protection Law does not preclude the possibility of the controller appointing a legal entity, a depersonalized entity, or more than one natural person to perform the role of data protection officer.” (Approved at the 9th Civil Law Conference).
- See BRASIL. Autoridade Nacional de Proteção de Dados. Resolução CD/ANPD nº 15, de 24 de abril de 2024. Aprova o Regulamento de Comunicação de Incidente de Segurança. Diário Oficial da União: seção 1, Brasília, DF, 25 abr. 2024. Disponível em: https://www.in.gov.br/en/web/dou/-/resolucao-cd/anpd-n-15-de-24-de-abril-de-2024-556243024 Acesso em: 18 jul. 2024.