The Brazilian data protection authority ('ANPD') published, on 28 May 2021, Guidance for Personal Data Processing Agents and Data Protection Officers ('DPOs') and has requested public comments on the same. In particular, the guidance notes that it aims to resolve some of the main questions regarding processing agents and DPOs. Specifically, the guidance outlines non-binding guidelines for data processing agents and explain who may exercise the role of data controller, operator, and/or DPOs, as well as their respective liability regimes, legal definitions, concrete cases that exemplify the ANPD's explanations, and frequently asked questions on the same. 

Public comments can be submitted to [email protected]. 

You can read the press release here and the guidance here, both only available in Portuguese.