Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Brazil: ANPD publishes updated guidance on data controllers, processors, and DPOs

The Brazilian data protection authority ('ANPD') published, on 27 April 2022, the Version 2.0 of its Guidance for Personal Data Processing Agents and Data Protection Officers ('DPO'), which was initially published on 28 May 2021. In particular, the updated guidance focuses primarily on the definitions of the concepts introduced in Law No. 13.709 of 14 August 2018, General Personal Data Protection Law (as amended by Law No. 13.853 of 8 July 2019) ('LGPD') introduces, such as who are the processing agents (data controllers and processors) and their responsibilities, which are one of the most discussed topics.

Furthermore, the ANPD noted that the update guidance is necessary to:

  • clarify some concepts under the LGPD and previous guidance; 
  • include practical examples and provide explanations on who can perform the roles of the data controller, data processor, and DPO, as well as their responsibilities; 
  • provide clarifications on the DPO's attributions and discuss the lack of necessity to register the DPO's identity before the ANPD;
  • provide updates following the Resolution CD/ANPD No. 2 of 27 January 2022 for a Regulation on the application of the LGPD to small processing agents; and 
  • introduce concepts found in more complex chains, such as the sub-operator, to demonstrate how they can be used.

You can read the press release here and the updated guidance here, both only available in Portuguese.