Brazil: ANPD publishes updated guidance on data controllers, processors, and DPOs
The Brazilian data protection authority ('ANPD') published, on 27 April 2022, the Version 2.0 of its Guidance for Personal Data Processing Agents and Data Protection Officers ('DPO'), which was initially published on 28 May 2021. In particular, the updated guidance focuses primarily on the definitions of the concepts introduced in Law No. 13.709 of 14 August 2018, General Personal Data Protection Law (as amended by Law No. 13.853 of 8 July 2019) ('LGPD') introduces, such as who are the processing agents (data controllers and processors) and their responsibilities, which are one of the most discussed topics.
Furthermore, the ANPD noted that the update guidance is necessary to:
- clarify some concepts under the LGPD and previous guidance;
- include practical examples and provide explanations on who can perform the roles of the data controller, data processor, and DPO, as well as their responsibilities;
- provide clarifications on the DPO's attributions and discuss the lack of necessity to register the DPO's identity before the ANPD;
- provide updates following the Resolution CD/ANPD No. 2 of 27 January 2022 for a Regulation on the application of the LGPD to small processing agents; and
- introduce concepts found in more complex chains, such as the sub-operator, to demonstrate how they can be used.