The National Data Protection Authority (ANPD) has defined the new guidelines for the role of the Data Protection Officer. Resolution CD/ANPD 18, published on July 16, 2024, clearly outlines the responsibilities and expectations for this essential professional in the Brazilian landscape.
The regulation determines relevant issues and reinforces points already brought up in the General Data Protection Law (LGPD) regarding who can occupy the role of Data Protection Officer, the duties of organizations, the requirements for the appointment and qualification of the Data Protection Officer, as well as the need to maintain transparent and efficient communication with the ANPD and data subjects.
For lawyer Camila Camargo, consultant at Andersen Ballão Advocacia, “it is essential that the Manager acts with the necessary technical autonomy and access to the organization’s senior management. The company, on the other hand, must ensure that the Manager has the necessary resources to effectively perform his/her duties. In this scenario, we recall the previous guidelines from ANPD regarding the importance of having a multidisciplinary Committee to support the Manager.”
Another point highlighted by the resolution is that the organization must appoint the Data Officer through a formal act, documenting their responsibilities and ensuring the availability of a substitute Data Officer in cases of absence or impediment of the primary Officer. Additionally, it is mandatory to publicly disclose the contact personal data of the Data Protection Officer, facilitating communication regarding data protection issues.
The Regulation also emphasizes that the Officer must be able to communicate clearly and precisely with the ANPD and data subjects, and no specific certification is required for the position. These provisions allow for cases where the company wishes to appoint a DPO to act on behalf of the economic group, even if outside Brazil, as long as effective communication in Portuguese is maintained.
Lawyer Camila Camargo considers the approval of the Regulation an expected and important milestone to leverage the relevance of the figure of the Officer within the privacy governance program and highlights that the appointment is a mandatory measure for companies to comply with the LGPD, in addition to ensuring responsible and transparent management regarding the protection of personal data.
