Brazil: Closed consultation on ANPD draft Regulation on the role of the data protection officer under LGPD

On 7 December 2023, the National Data Protection Authority (ANPD) closed the public consultation on the draft Regulation on the role of the data protection officer under the Law on General Personal Data Protection (LGPD). The draft Regulation specifies that data controllers are required to appoint a data protection officer and outlines rules regarding the appointment, duties and performance of a data protection officer. In particular, the draft rules specify that data controllers are required to make public the contact information of the data officer to enable data subjects to submit complaints and for the ANPD to notify of measures that have to be adopted. The data officer is not required to register with any entity or have any certification or specific professional training but should be able to communicate in Portuguese with the ANPD. Furthermore, the data controllers are required to provide the data officer with the necessary human, technical and administrative resources to fulfil the duties and maintain independence. Finally, the draft rules outline the duties of the data officer, including processing complaints, reparation of reports regarding security incidents, reports on risk assessment and analysis of mechanisms used for personal data transfers.