Data Protection Officer: Who Can Serve and What They Answer For

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

The LGPD (Brazil’s General Data Protection Law) requires the controller to appoint a data protection officer for the processing of personal data, but it does not require that person to be a lawyer or an employee of the company. The law allows an individual or a legal entity to hold the role, and it requires the officer’s identity and contact information to be made public.

When a company learns that it must appoint a data protection officer, its first question is rarely about what the role involves. It is about who can fill it. A partner? An employee in the technology department? An outside law firm? A specialized company? The answer lies in how Law 13.709/2018 designed the position, and that design is more open than most people assume.

The starting point is the statutory definition. The LGPD describes the data protection officer as the person appointed by the controller and the processor to act as a communication channel among the controller, the data subjects, and the ANPD (Brazil’s National Data Protection Authority). Nothing more. There is no requirement of a degree, a professional license, an employment relationship, or full-time dedication.

Who the law allows to serve as data protection officer

The statutory definition speaks of a person who is appointed, with no restrictive qualifier. That lean wording has a direct practical consequence: the position is not reserved for individuals. A law firm, a governance consultancy, or an information security company can be appointed, as long as the service is real and the provider is identifiable. What the law demands is a working channel, not a particular type of contract.

That opens up three possible arrangements, each with its own cost. The first is an internal data protection officer, an employee already part of the company’s daily routine. This person knows how data actually flows, knows where the customer database is duplicated, and knows who has access to the spreadsheet of delinquent accounts. On the other hand, the officer holds the role alongside other duties and will rarely have time to respond to requests on a short deadline.

The second arrangement is an outsourced data protection officer, hired as a service. This officer brings experience built up across many clients and spreads the cost, which makes the model workable for small and mid-sized companies. The risk is distance: someone who does not know the internal process answers the data subject in generic terms, and a generic answer does not resolve a complaint.

The third is the hybrid arrangement, now the most common in mid-sized companies. An internal manager handles the contact point and knows the process, supported by outside advisors on technical and legal questions. The name disclosed to the public is still just one, because the data subject needs to know whom to approach.

The duties the law sets and the ones the contract adds

The law lists the data protection officer’s activities in four items, and that list is the floor of the role. The first is accepting complaints and communications from data subjects, providing clarifications, and taking action. The second is receiving communications from the national authority and taking action. The third is advising the entity’s employees and contractors on data protection practices.

The fourth item is the one that tends to go unnoticed at the time of hiring: carrying out the other duties assigned by the controller or set out in supplementary rules. In other words, the law establishes a minimum and leaves the rest to the contract and to regulation. A company that hires a data protection officer without expressly describing the scope ends up with a channel for receiving messages, not a compliance structure.

It is worth distinguishing the two layers when drafting the agreement. The statutory layer is not negotiable and cannot be reduced: the data protection officer must serve data subjects and the authority, and must advise those who process data within the company. The contractual layer is where you define response times, how often internal controls are reviewed, the preparation of compliance documents, participation in incident response, and any role in staff training.

The duty to disclose identity and contact information

Appointing a data protection officer and telling no one is the same as not appointing one. The LGPD requires that the officer’s identity and contact information be publicly disclosed, clearly and objectively, preferably on the controller’s website. This obligation has two distinct components: identity and contact. Publishing only a generic e-mail address satisfies half of the command.

In practice, the minimum acceptable disclosure includes the name of the person in the role, or the corporate name of the designated legal entity, and a means of contact that works and is monitored. A privacy policy page that ends in an anonymous form leaves data subjects not knowing who will read their message, and the text of the law itself calls for the opposite.

An anonymous channel does not satisfy the law: the LGPD requires disclosure of the data protection officer’s identity, not merely a form.

Placement also matters. The law names the website as the preferred medium, which means that burying the information in a hard-to-find document runs against the requirement of clarity. Companies that serve customers in person often repeat the information at their premises, a simple solution that is consistent with the purpose of the rule.

In the public sector, the duty is just as explicit. The LGPD makes data processing by public-law legal entities conditional on appointing a data protection officer whenever they carry out processing operations. It also requires clear, up-to-date information on the legal grounds, purposes, and practices adopted, preferably on their websites.

Exemption for small-scale processing agents

The LGPD itself contemplated that the obligation could not be identical for everyone. The text authorizes the national authority to establish supplementary rules on the definition and duties of the data protection officer, including cases in which appointment is not required, depending on the nature and size of the entity or the volume of data processing operations.

On the basis of that authorization, the ANPD issued its own regulation for small-scale processing agents, exempting them from formally appointing a data protection officer. The exemption does not eliminate the channel, however: those who qualify must still provide a means of communication with the data subject, disclosed in an accessible way.

Two misunderstandings come up often here. The first assumes that the exemption covers the entire LGPD, and it does not: legal bases, data subject rights, information security, and the duty to report incidents remain fully in force. The second assumes that qualification is automatic based on revenue, when the regulation works with its own criteria, including the type of data processed and the risk involved.

There is also a practical effect that calls for caution. An exempt company that grows, changes its line of business, or begins processing sensitive data at scale falls outside the exemption without anyone notifying it. Companies that review their own classification periodically avoid learning about the change through a complaint that has already been filed.

Independence, conflict of interest, and who answers

The question that comes up most often in hiring meetings is whether the data protection officer is personally liable for a failure in data processing. The answer comes from the structure of the law itself. The LGPD defines processing agents as the controller and the processor, and those are the agents to whom it directs the administrative sanctions the national authority may apply, ranging from a warning to a fine of up to two percent of revenue, capped at R$ 50.000.000,00 per violation.

The data protection officer does not appear in that definition. The same logic applies to compensation: the obligation to repair property, moral, individual, or collective damage caused by a violation of data protection legislation falls on the controller or the processor. The exposure of the person in the role is therefore contractual and functional, within the limits of the employment relationship or the services agreement.

That does not make the position a mere formality. A company that appoints someone with no autonomy, no access to processing decisions, and no budget to act has bought a name published on its website and nothing else. When the authority asks questions, what gets examined is whether the channel is effective and whether action was taken, not whether the role exists on the org chart.

That brings us to independence. The person who decides the purpose of the processing and the person who receives complaints about that same decision should not be the same. A partner who sets the marketing policy and also serves as data protection officer ends up reviewing his or her own act, which weakens the channel exactly where it should be useful. The solution does not require an expensive structure: simply separate the roles and document that separation in writing.

Companies that treat the appointment as a governance decision, and not as a box to check on a form, tend to arrive at three simple definitions. Who the person is, with a disclosed name. Whom that person reports to, preferably outside the department that processes the data. And what the internal deadline is for responding to the data subject, which needs to be shorter than the legal deadline, because the response depends on information from others inside the company.

Frequently Asked Questions

Does the data protection officer have to be a lawyer or hold a certification?

No. The LGPD defines the data protection officer by the function performed, as a communication channel among the controller, data subjects, and the ANPD, and it does not impose any educational requirement, professional license, or certification. Legal and technical knowledge is desirable given the nature of the work, but the lack of a specific degree does not invalidate the appointment.

Can the company hire a data protection officer from outside its staff?

Yes. The statutory definition speaks of a person who is appointed, does not require an employment relationship, and allows a legal entity. Outsourcing is valid and common in small and mid-sized companies. What outsourcing does not change is the duty to publicly disclose the officer’s identity and contact information, or the need to respond to the data subject and the authority within an appropriate time.

If there is a data leak, does the data protection officer pay the fine?

Not under the design of the law. The LGPD’s administrative sanctions fall on the processing agents, which the law itself defines as the controller and the processor, and the duty to repair damages points in the same direction. The data protection officer answers on a contractual or functional basis to whoever appointed them, according to the terms of the relationship.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.