ANPD publishes regulation on the role of the person responsible for processing personal data

ANPD publishes regulation on the role of the person responsible for processing personal data

On 17 July, the National Data Protection Authority (ANPD) published Resolution CD/ANPD No. 018 approving the Regulation on the role of the person in charge of processing personal data. The document comes into force on the date of its publication and aims to establish complementary rules detailing the appointment, definition, duties and actions of the person in charge of processing personal data, in accordance with the provisions of Law No. 13,709/2018 (General Data Protection Law).

The first highlight of the regulation is the formalization of the appointment of the person in charge. According to Article 3, the appointment must be made by formal act of the processing agent, detailing the forms of action and activities to be carried out. Small processing agents that are exempt from appointing a person in charge must provide a communication channel with data subjects, as stipulated by the LGPD Implementing Regulation for Small Processing Agents. Likewise, Art. 4 states that in the event of absences, impediments or vacancies of the person in charge, the function will be exercised by a formally appointed substitute.

Article 7 also states that it is up to the processing agent to establish the professional qualifications required to fulfil the duties of the person in charge, taking into account their knowledge of data protection legislation, as well as the context, volume and risk of the processing operations carried out.

Next, in Articles 15 and 16, the ANPD defines the duties of the data controller. Among the main ones are: accepting complaints and communications from data subjects, providing clarifications and adopting appropriate measures in response to requests from data subjects; receiving communications from the ANPD and adopting the necessary measures to fulfil their requests, internally forwarding the demands to the competent units and providing guidance to the processing agent; providing guidance to the processing agent’s employees and contractors on personal data protection practices; and assisting in the creation and implementation of internal processes and policies that ensure compliance with the LGPD, including security measures, recording of data processing operations and personal data protection impact reports.

Another important point of the regulation is the need to disclose the identity and contact details of the person in charge. Article 9 establishes that this information must be disclosed in a clear and objective manner, in a prominent place on the website of the processing agent or by other available means of communication, when there is no website. In addition, the regulation also addresses the issue of conflicts of interest, according to Article 18. From this perspective, the person in charge must also act with ethics, integrity and technical autonomy, avoiding situations that could constitute a conflict of interest. In the event of a possible conflict, the caregiver must adopt measures to avoid the risk, such as not appointing the person in charge or replacing the designated person in charge. Article 19 provides for the possibility of the person in charge being able to accumulate functions and carry out their activities for more than one treatment agent, as long as it is possible to fully fulfil their duties.

Finally, the document emphasizes the responsibility of the processing agent for the compliance of the processing of personal data, in accordance with the LGPD. However, although the controller has various duties, it is not responsible to the ANPD for the compliance of the processing of personal data carried out by the controller, under the terms of Art. 17 of the LGPD.

The ANPD Regulation can be accessed via the link: Resolução CD/ANPD nº 018

Note: For quick release, this English version is provided by automated translation without human review.