LexLint.ioBeta

Know the law your code answers to.

Law / Brazil

ANPD Regulation on the Data Protection Officer (Resolution CD/ANPD No. 18/2024)

Resolução CD/ANPD nº 18 de 16 de julho de 2024 (Regulamento sobre a atuação do encarregado pelo tratamento de dados pessoais), Anexo, arts. 3º, 5º, 8º-10 and 19-21

In force since .

A comprehensive regime rule binding public and private bodies.

Obligation class
Governance, Disclosure
Audit expectation
none

What it requires

  • Appoint a data protection officer by a formal written, dated and signed act that states how the officer acts and what the officer does, and give the act to the ANPD when it asks.
  • If you are a public body that processes personal data, appoint an officer and publish the appointment in the official gazette of the Union, the state, the Federal District or the municipality.
  • Publish the officer's identity and contact details on your website, clearly and prominently, and keep them current; the contact details must let data subjects exercise their rights and let the ANPD reach the officer.
  • Give the officer the human, technical and administrative means to work, technical autonomy, and direct access to senior management, and give data subjects fast and effective ways to reach the officer.
  • Do not give the officer duties that create a conflict of interest, and if one arises, decline to appoint the person, take measures to remove the risk, or replace the officer.

These lines are LexLint's reading of the law's text.

What it makes you log

Logging duty

The Regulation sets the appointment, publication and conduct rules for the data protection officer; it names the controller's records only as something the officer helps to prepare, and sets no duty to keep a log or a record.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 3 requires the appointment of a data protection officer, called the encarregado, to be made by a formal written, dated and signed act that states how the officer acts and what the officer does. A public body must appoint an officer when it processes personal data, and article 5 requires the appointment to be published in the official gazette of the Union, the state, the Federal District or the municipality. Appointment of an officer by a processor is optional.

Small-scale processing agents exempted from appointing an officer must offer data subjects a communication channel. Article 9 requires the officer's identity and contact details to be published clearly and prominently on the agent's website. Article 10 requires the agent to give the officer the human, technical and administrative means to work, technical autonomy, and direct access to senior management.

Article 19 allows the officer to hold other roles and to serve several agents only if the duties can be fully performed and no conflict of interest arises, such as a role that decides strategically on the processing. A conflict of interest can lead to an administrative sanction under article 52 of the LGPD.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example  ·  Lint your app

Page updated .