The National Data Protection Authority (ANPD) has defined the new guidelines for the role of the Data Protection Officer. A Resolução CD/ANPD 18, published on July 16, 2024, clearly outlines the responsibilities and expectations for this essential professional in the Brazilian context
The regulation determines relevant issues and reinforces points already brought up in the General Data Protection Law (LGPD) about who can hold the position of Data Protection Officer, the duties of organizations, the requirements for the appointment and qualification of the Officer, as well as the need to maintain transparent and efficient communication with the ANPD and data subjects
For lawyer Camila Camargo, consultant at Andersen Ballão Advocacia "it is essential that the Officer acts with the necessary technical autonomy and access to the senior management of the organization. The company, on the other hand, must ensure that the Officer has the necessary resources for the effective performance of their duties. In this scenario, we recall the previous guidelines from the ANPD regarding the importance of having a multidisciplinary committee to support the Data Protection Officer.”
Another point highlighted by the resolution is that the organization must appoint the Data Protection Officer through a formal act, documenting your responsibilities and ensuring the availability of a substitute Officer in cases of absence or impediment of the main Officer. Furthermore, it is mandatory to publicly disclose the contact personal data of the Data Protection Officer, facilitating communication for issues related to data protection
The Regulation also emphasizes that the Officer must be able to communicate clearly and precisely with the ANPD and data subjects, not requiring a specific certification for the position. These provisions open the way for cases where the company wishes to appoint a DPO to act on behalf of the economic group, even being outside Brazil, as long as it maintains effective communication in Portuguese
Lawyer Camila Camargo considers the approval of the Regulation an expected and important milestone to enhance the relevance of the Data Protection Officer within the privacy governance program and emphasizes that the appointment is a mandatory compliance measure for companies with the LGPD, in addition to ensuring responsible and transparent management regarding the protection of personal data
