ANPD approves regulation on the performance of the Data Protection Officer

The National Data Protection Authority (ANPD) has defined the new guidelines for the role of the Data Protection Officer. Resolution CD/ANPD 18, published on July 16, 2024, clearly brings the responsibilities and expectations for this essential professional in the Brazilian scenario.

The regulation determines relevant issues and reinforces points already brought in the General Data Protection Law (LGPD) on who can occupy the role of Charge, the duties of organizations, the requirements for the appointment and qualification of the Chargee, as well as the need to maintain transparent and efficient communication with the ANPD and data subjects

For the lawyer Camila Camargo, consultant of Andersen Ballao Advocacia “it is essential that the In-Chief acts with the necessary technical autonomy and access to the top management of the organization. The company, on the other hand, must ensure that the In-Charge has the necessary resources for the effective performance of their functions.In this scenario, we remind the previous guidelines of the ANPD of the importance of the existence of a multidisciplinary Committee to support the In-Charge.”

Another point highlighted by the resolution is that the organization must appoint the Data Controller through a formal act, documenting its responsibilities and ensuring the availability of a substitute Officer in cases of absence or impediment of the Data Controller.In addition, it is mandatory to publicly disclose the contact personal data of the Data Controller, facilitating communication for issues related to data protection.

The Regulation also reinforces that the Responsible must be able to communicate clearly and precisely with the ANPD and the data subjects, and no specific certification is required for the position. These provisions open space for cases in which the company wishes to appoint a DPO that acts on behalf of the economic group, even if outside Brazil, provided that it maintains effective communication in Portuguese.

The lawyer Camila Camargo considers the approval of the Regulation an expected and important milestone to leverage the relevance of the figure of the In-charge within the privacy governance program and highlights that the indication is a mandatory measure of compliance of companies with the LGPD, in addition to ensuring responsible and transparent management with regard to the protection of personal data.