On December 19, 2024, the National Data Protection Authority (“ANPD“) published the “Guide on the Role of the Data Protection Officer” (“DPO Guide” or “Guide“). The purpose of the DPO Guide is to provide specific guidelines on the role of the DPO under Law No. 13,709/2018 (Brazilian General Data Protection Law – “LGPD“), in order to assist data controllers and processors as well as society in general in the interpretation of Article 41 of the LGPD and Resolution CD/ANPD No. 18, of July 16, 2024, which provide for rules on the appointment, activities, and responsibilities of the DPO.
One of the relevant matters addressed under the Guide is the formal appointment of the DPO. The Guide presents detailed guidelines on which entities are required to appoint a DPO and the cases where certain small processing agents are exempted from appointing a DPO. It further details the criteria for issuing the DPO appointment term and the requirements for disclosing the identity and contact information of the DPO. In addition, the Guide also addresses the appointment of the substitute DPO in cases of absence, impediment, and vacancy of the principal DPO.
The DPO Guide also provides guidelines on other relevant matters related to the DPO’s role, including: (i) the duties of the controller to ensure that the DPO performs its functions with technical autonomy and adequate human, technical, and administrative resources; (ii) the desirable knowledge for the exercise of the DPO function; (iii) details of the activities and duties of the DPO; and (iv) measures for the prevention, identification, and remediation of situations of conflicts of interest in the exercise of the function of the DPO.
It is worth mentioning that, on December 13, 2024, ANPD initiated a monitoring proceeding against 20 large companies that did not disclose the contact of the DPO or did not provide adequate communication channels for data subjects to exercise their rights, as required by article 41 of the LGPD. Therefore, in a context where ANPD is carrying out enforcement actions to monitor compliance with the legal provisions related to the appointment and role of the DPO, the DPO Guide is especially relevant to assist controllers and processors, both private and public, in complying with the rules related to the DPO’s role provided for in Article 41 of the LGPD and Resolution CD/ANPD No. 18/2024.
For more information about the DPO Guide and other rules on the appointment and role of the DPO, please contact Saud Advogados.