On 17 July 2024, the National Data Protection Authority (ANPD)’s regulation on the role of the data protection officer under the Law on General Personal Data Protection (LGPD) entered into force. The regulation specifies that data controllers are required to appoint a data protection officer and outlines rules regarding the appointment, duties and performance of a data protection officer. In particular, the rules specify that data controllers are required to make public the contact information of the data officer to enable data subjects to submit complaints and for the ANPD to notify of measures that have to be adopted. The data officer is not required to register with any entity or have any certification or specific professional training but should be able to communicate in Portuguese with the ANPD. Furthermore, the data controllers are required to provide the data officer with the necessary human, technical and administrative resources to fulfil the duties and maintain independence. Finally, the rules outline the duties of the data officer, including processing complaints, reparation of reports regarding security incidents, reports on risk assessment and analysis of mechanisms used for personal data transfers.
Original source