On July 16th, 2024, the Brazilian National Data Protection Authority (“ANPD”) published the Resolution No.º 18 that regulates the role of the Data Protection Officer (“DPO”) under the Brazilian General Data Protection Law (“LGPD”). The resolution broadens the interpretation of Art. 41 of the LGPD detailing the role of the DPO.

According to the LGPD, DPO are persons appointed by the controller to act as a communication channel between the controller, data subjects, and the ANPD. Essentially, the DPO is responsible for advising on all practices to be taken in relation to the protection of personal data.

ANPD’s resolution details requirements for the appointment of the DPO, their characteristics and identity, duties, related obligations and situations of conflicts of interest, among other factors. Among the obligations provided, it became necessary to formally appoint the DPO through a written instrument. Furthermore, a relevant point expressly provided in the resolution is the possibility of the DPO being a legal entity - there was already an understanding in this regard in guidelines, but formalization in specific regulation was highly anticipated.

The standard additionally stipulates, among other duties, that it is necessary for the DPO to be able to communicate in Brazilian Portuguese language (a factor that is not made explicit by the LGPD), and there is no need for a specific degree or registration in any professional organization.

Considering the rapid globalization and evolution of technology, the DPO role is essential to the legal compliance of organizations and for the consolidation of a data protection culture in Brazil. The regulation comes into force immediately.

We will continue to monitor ANPD’s publications and we look forward to soon bringing more updates on the evolution of data protection standards in Brazil.