22/7/2024
The National Data Protection Authority (ANPD) in Brazil has published a new regulation concerning the Data Protection Officer (DPO) on Wednesday, July 17, The new regulation, known as Resolution CD/ANPD No.18, provides comprehensive binding rules regarding the appointment, responsibilities, and roles of the DPO under the General Personal Data Protection Law (LGPD). The DPO is the primary focus of this new regulation.
The Resolution is already in effect and includes additional rules for individuals or entities (such as ‘DPO as a Service’ providers) acting as a DPO. It outlines the obligations of data processing agents, such as companies and organizations operating in Brazil or processing personal date of data subjects located in Brazil. The resolution is a result of the normative powers granted to the ANPD by the LGPD and introduces guidelines and specifications that were not previously explicitly defined by statutory law.
The main innovations introduced by the resolution include:
- Formal appointment of the DPO and their substitute by data processing agents.
- The possibility of holding multiple roles, provided there is no conflict of interest
- Specific qualification requirements for the DPO.
- Clear definition of main DPO’s responsibilities.
- Public disclosure of the DPO’s contact information, preferably on the controller’s website.
- Specific procedures for communication between the DPO and data subjects, including response times and communication methods.
- The need for the DPO to constantly provide guidance and training to the controller’s employees regarding data protection practices.
- Details on how the DPO should cooperate with the ANPD, including participation in audits and the implementation of corrective measures.
- The DPO is not personally liable for data processing compliance with the LGPD.
- The duties of data processing agents in relation to the DPO are specified.
In light of these new rules and guidelines, companies and organizations are advised to conduct a detailed assessment of their DPO’s performance in Brazil and make necessary adjustments to their privacy policies, information security, and data governance to comply effectively with the new regulation. This will ensure compliance with the General Personal Data Protection Law (LGPD) and ANPD regulation.
L.O. Baptista’s Privacy and Data Protection team is available to assist your organization in these urgent actions and to ensure compliance with the new Resolution 18/2024.
For a practical discussion or to access a preliminary assessment survey on the level of compliance and urgent demands for improvement and next steps in your company, you can also contact partners Esther Jerussalmy Cunha and Fabricio Polido.
Co-authored by: Fabricio Polido e Larissa Fernandes Ackerman.
