DPO (Encarregado)
Who must appoint, and how it is announced
The controller must appoint an encarregado and publicly disclose the identity and contact details, preferably on its website (Art. 41). A processor is not obliged to appoint one unless it also acts as a controller. The role may be filled by an individual or a legal entity, internally or externally, in Brazil or abroad - the law does not require a lawyer or a local resident.
Statutory duties (Art. 41 §2)
- Receive complaints and communications from data subjects, clarify and adopt measures;
- Receive communications from the ANPD;
- Advise employees and contractors on data protection practices;
- Perform other duties assigned by the controller or by regulation.
In practice, the DPO is the published contact point for data subjects and the ANPD, and the internal channel through which incident and rights-request processes run.
Autonomy and independence
ANPD guidance stresses autonomy, access to senior management and adequate resources. The role should not be combined with functions that create a conflict - for example, being the person who decides the marketing campaigns the DPO must oversee - and the DPO should not be personally exposed for the organisation's compliance failures; accountability stays with the controller.
Small agents (Resolution CD/ANPD nº 2/2022)
Micro and small enterprises, startups and similar small processing agents are excused from appointing a DPO, provided they keep a channel for data subjects. The waiver does not cover high-risk processing as defined in the regulation, such as large-scale sensitive data or processing with significant effect on subjects' interests.
Worked example
A 30-person online retailer appoints its legal counsel as encarregado and publishes a dedicated address ([email protected]). That is acceptable: the role can be internal and combined with legal work, since counsel does not decide the marketing purposes. If instead the sales director were appointed, the arrangement would be questioned, because that director approves the campaigns the DPO must independently oversee.
Traps
- Publishing the DPO's personal mobile number instead of a dedicated contact channel.
- Assuming the DPO must be a lawyer, a Brazilian resident, or a natural person.
- Requiring processors to appoint a DPO in every contract.
- Treating the small-agent exemption as covering high-risk processing.
- Holding the DPO personally liable for fines imposed on the controller.
Security, breach notification and ANPD enforcement
Security duty (Arts. 46–49)
Controllers and processors must adopt technical and administrative measures able to protect personal data from unauthorised access and from accidental or unlawful destruction, loss, alteration or disclosure. Systems should be built for security and confidentiality, with access control and traceability. The duty can be waived only by law.
Breach notification (Art. 48)
The controller must notify the ANPD and the affected data subjects when a security incident may cause relevant risk or damage. The notification states the nature of the data, the subjects involved, the technical measures used (subject to trade secrecy), the risks, the reasons for any delay and the measures adopted. Under ANPD Resolution CD/ANPD nº 15/2024 the deadline is 3 business days from the controller's knowledge of the incident, and the controller keeps a record of incidents for at least five years, including those not notified.
The regulator
Since 2022 the ANPD is a federal autarquia with a Diretoria Colegiada, the CNPD and the power to regulate, inspect, request information, run audits and sanction.
Sanctions (Art. 52)
Warning with a deadline for corrective measures; simple fine of up to 2% of the revenue of the company, group or conglomerate in Brazil in the last fiscal year, excluding taxes, capped at R$50 million per infraction; daily fine subject to the same cap; publicising the infraction; blocking or deletion of the data; suspension of the database or of the processing activity for up to six months, extendable once; partial or total prohibition of the activity. Dosage weighs gravity, good faith, advantage obtained, economic condition, recidivism, damage, cooperation, internal governance mechanisms and prompt corrective action - the criteria operationalised by the dosimetry regulation in force since 2024.
Worked example
A ransomware attack encrypts an HR server holding salaries and medical certificates. Salaries and health data, plus credential exposure, mean relevant risk: the controller notifies the ANPD within 3 business days of learning of the attack and informs the affected employees, then records the incident. Delaying to complete a forensic report is a classic error.
Traps
- Importing the GDPR's 72 hours; the LGPD standard is 3 business days under the ANPD regulation.
- Notifying every incident regardless of relevant risk.
- Assuming notification to data subjects can substitute for notifying the ANPD.
- Forgetting that daily fines share the R$50 million cap.
- Believing the ANPD can only fine - it has nine sanction types.