Brazilian Data Protection Authority (ANPD) publishes Guidance on the Role of the Person in Charge

In brief

On December 19, 2024, the Brazilian Data Protection Authority (“ANPD”) published the Guidance on the Role of the Person in Charge (“Person in Charge”) (“Guideline“) in addition to Resolution CD/ANPD No. 18, of July 16, 2024, which establishes the regulation on the role of the Person in Charge. The Guideline provides additional guidance on the role of the Person in Charge, to help with the interpretation of the legislation and proposes some good practices related to data protection and privacy for processing agents.

In more detail

The Guideline presents more detail about the responsibilities of the Person in Charge, good practices for processing agents and gives some practical examples. It also includes ANPD guidelines on the appointment of the Person in Charge and its replacement, as well as regarding the prevention of conflicts of interest.

Below, we have included some relevant information about the role/appointment of the Person in Charge that were indicated in the Guideline:

• The Guideline provides more information on the formal act for appointment of the Person in Charge and also offers template suggestions;
• According to the ANPD, it is not necessary to communicate the appointment of the Person in Charge to the ANPD, but the document must be kept by the processing agent and presented to the ANPD if requested;
• In addition to disclosing the identity and contact details of the Person in Charge to the external public, the ANPD recommends that this information also be shared with the company’s employees;
• Once again, the ANPD emphasizes that it is essential that the Person in Charge is able to communicate with the data subject and the ANPD in Portuguese, in a timely and easy manner;
• The Guideline indicates that the Person in Charge role does not require registration with the ANPD or any private associations, nor does it require specific professional training or specific certifications;
• Regarding conflicts of interest, the ANPD indicated that, in general, there may be a conflict “when the Person in Charge accumulates positions of leadership, management or board, which is responsible for determining the means and purposes of the personal data processing, such as sectors responsible for human resources management, information technology, finance or health”.