{"id":24058,"date":"2025-01-02T14:21:10","date_gmt":"2025-01-02T17:21:10","guid":{"rendered":"https:\/\/lefosse.azurewebsites.net\/anpd-publishes-guidance-on-the-role-of-the-data-protection-officer\/"},"modified":"2025-12-11T16:01:22","modified_gmt":"2025-12-11T19:01:22","slug":"anpd-publishes-guidance-on-the-role-of-the-data-protection-officer","status":"publish","type":"post","link":"https:\/\/lefosse.com\/en\/news\/guide\/anpd-publishes-guidance-on-the-role-of-the-data-protection-officer\/","title":{"rendered":"ANPD Publishes Guidelines on the Role of the Data Protection Officer (DPO)"},"content":{"rendered":"

On December 19, 2024, the Brazilian National Data Protection Authority (ANPD) published a supplementary guideline, in Portuguese, to Resolution No. 18, entitled “Role of the Data Protection Officer (DPO)<\/a><\/span>” (“Guidelines<\/strong>“). These Guidelines aim to clarify specific aspects related to the appointment and role of the DPO.<\/p>\n

The Guidelines provide ANPD’s interpretation and understanding of issues regulated by Resolution CD\/ANPD No. 18\/2024<\/strong>, which approved the Regulation on the Role of the Data Protection Officer (DPO) (“Resolution<\/strong>“).<\/p>\n

Following the publication of the Resolution, Lefosse has prepared an informational resource<\/a><\/span> to assist in understanding key points of the new Resolution on the DPO\u2019s role, offering analysis and recommendations for companies and private-sector entities.<\/p>\n

In this document, we now present additional insights into the primary points outlined in the Guidelines, which may impact on data protection governance frameworks:<\/p>\n

1.<\/span> Guidance on the Appointment of the DPO<\/h2>\n

As per the Resolution, the appointment of the DPO must be formalized through a “formal act”<\/strong> that specifies the scope of duties and activities to be performed by the DPO. The Guidelines clarify that, while this formal act does not need to be submitted to the ANPD, it must be retained by the organization and made available to the authority upon request.<\/p>\n

Additionally, the Guidelines provide two document templates for the formal appointment of a DPO: one tailored for individuals and another for legal entities.<\/p>\n

2.<\/span> Appointment of a Substitute DPO<\/h2>\n

The Guidelines recommend appointing a substitute DPO at the same time as the primary DPO<\/strong>, rather than waiting to designate one individual or entity only in case absence of the primary DPO. This approach ensures the continuity of the DPO’s functions without interruption if the primary DPO becomes temporarily or permanently unavailable.<\/p>\n

There are no restrictions on appointing an external service provider as a substitute DPO (referred to as “DPO as a Service<\/strong>“). This option can be particularly useful in scenarios where an internal substitute is not readily available when needed.<\/p>\n

3.<\/span> DPO Profile and Role<\/h2>\n

The Resolution establishes, and the Guidelines reinforce, that the DPO can be either an individual or a legal entity retained by the organization as a service provider. If a legal entity is appointed, an individual within that entity must be designated as the person responsible for fulfilling the DPO role<\/strong>. This individual must possess comprehensive knowledge of the organization\u2019s data protection practices and be capable of acting autonomously and independently.<\/p>\n

Furthermore, the Guidelines highlight key capacities expected from the DPO to effectively perform his or her duties, as follows:<\/p>\n

\u00a0 \u00a0 \u00a0 (I)<\/span> Proficiency in the Portuguese Language<\/strong><\/p>\n

According to the Guidelines, the DPO must be able to communicate effectively in Portuguese with both data subjects and the ANPD.<\/strong> While the ANPD acknowledges that the DPO may collaborate with a data protection team or committee, the Guidelines emphasize the importance of the DPO’s proficiency in Portuguese. Therefore, appointing someone who relies on an interpreter or translator to carry out his or her duties is not advisable<\/strong>.<\/p>\n

\u00a0 \u00a0 \u00a0 (II)<\/span> Qualifications of the DPO<\/strong><\/p>\n

The DPO must have a thorough understanding of the Brazilian General Data Protection Law (LGPD), ANPD regulations<\/strong>, and the nature of the data processed by the organization. Additionally, the Guidelines suggest that the DPO should ideally have expertise in risk management, information security, compliance, and auditing<\/strong>, as these are closely related to data protection. The Guidelines further clarify that specific certifications are not required for the DPO role.<\/p>\n

4.<\/span> Conflict of Interest Situations<\/h2>\n

The Resolution previously stated that the DPO may hold multiple roles within the organization, provided that there is no conflict of interest. However, it offered limited guidance on which practical situations might result in such a conflict.<\/p>\n

The Guidelines now clarify that a conflict of interest arises when the DPO holds senior, managerial, or executive positions responsible for defining the means and purposes of data processing. These roles could undermine the objectivity and technical independence essential to the DPO\u2019s responsibilities.<\/p>\n

To prevent such conflicts, the ANPD recommends establishing a “separate organizational unit” for the DPO<\/strong>, distinct from the areas responsible for strategic decisions regarding data processing. This approach would ensure that the DPO\u2019s decisions are not influenced by conflicting interests.<\/p>\n

In this context, hiring an external DPO can be an effective solution for organizations, allowing them to benefit from a qualified and experienced professional without requiring the establishment of an internal team solely dedicated to these tasks. Furthermore, from the ANPD\u2019s multidisciplinary perspective, outsourcing the DPO role could offer access to a broader range of regulatory and technical expertise, without the need to hire internal staff focused exclusively on data protection<\/strong>.<\/p>\n

5. <\/span>Other Key Considerations<\/h2>\n