Regulation of New Technologies
Do you need a DPO in Brazil? LGPD rules on the data protection officer
Guilherme Chambarelli
Published on
3 min read
In this article
Yes, in most cases. Brazil’s LGPD requires every controller of personal data to appoint a data protection officer (encarregado), unlike the GDPR, which requires one only in specific situations. The main exception is for small-scale processing agents, such as micro and small companies and startups, provided they offer a channel for data subjects and do not carry out high-risk processing. ANPD Resolution 18/2024 sets the rules for appointment, role and conflicts of interest.
Key points
- The duty is in Article 41 of the LGPD (Law 13,709/2018).
- The appointment must be formal, in writing, with a published contact.
- The DPO may be an individual or a company, in-house or outsourced.
- A substitute must be designated, and the DPO must communicate in Portuguese.
- Small-scale agents may be exempt, except for high-risk processing.
Who must appoint a DPO?
Every controller, that is, every organization that decides how and why personal data is processed. For processors acting on behalf of others, appointment is not mandatory but is considered good practice. A foreign company subject to the LGPD because it offers services to people in Brazil is also a controller for this purpose.
Who is exempt?
Under Resolution CD/ANPD 2/2022, small-scale processing agents, including micro and small companies, startups and individual micro-entrepreneurs, may skip the formal appointment if they provide a communication channel for data subjects. The exemption does not apply to high-risk processing, such as large-scale processing of sensitive data, systematic monitoring or innovative technologies with significant effects on individuals. A small health tech or fintech may therefore still need a DPO.
What does Resolution 18/2024 require?
- A written, dated and signed appointment describing how the DPO will act.
- Publication of the DPO’s identity and contact details in a prominent place on the website; for a company acting as DPO, its corporate name and the responsible individual.
- Communication with data subjects and the ANPD in Portuguese.
- A substitute for absences and vacancies.
- No conflict of interest, for example by combining the role with positions that decide on the processing being overseen.
- Adequate resources, autonomy and access to senior management.
No specific certification is required. The organization defines the qualifications according to the volume and risk of its processing.
What does the DPO do?
- receives complaints and requests from data subjects and coordinates responses;
- receives communications from the ANPD and takes action;
- guides employees and contractors on data protection practices;
- supports incident response, impact assessments, contracts and international transfers.
Compliance remains the controller’s responsibility. The DPO advises and coordinates but is not, as a rule, liable for the organization’s failures.
In-house or outsourced?
| Model | Advantages | Watch out for |
|---|---|---|
| In-house | Knows the business daily | Conflicts of interest and competing duties |
| Outsourced (DPO as a Service) | Expertise, independence, Portuguese-speaking contact | Needs a good information flow with internal teams |
| Group DPO | Consistency across countries | Must handle Portuguese and Brazilian deadlines |
For foreign groups, a common solution is a global privacy lead combined with a Brazilian DPO or a local outsourced service.
What happens without a DPO?
Failure to appoint a DPO is an LGPD infraction. The first fine imposed by the ANPD, in 2023, involved a small company that processed data without a legal basis and had no DPO. In late 2024, the ANPD also inspected large companies that lacked a DPO or contact channel.
Frequently asked questions
Can our EU DPO also act for Brazil?
Yes, if they can communicate in Portuguese, meet Brazilian deadlines and have no conflict of interest.
Does the DPO need to live in Brazil?
The LGPD does not require residence, but the DPO must be reachable by Brazilian data subjects and the ANPD in Portuguese.
How fast must data subject requests be answered?
Complete access requests must be answered within 15 days.
How Chambarelli Advogados can help
Our Regulation of New Technologies team assesses whether you need a DPO, formalizes the appointment and offers DPO as a Service in Portuguese and English, with support from our Foreign Desk. Book a meeting with one of our partners.
Informational content, updated October 2026. It does not replace advice on your specific case.
