Skip to content
AI Policy Generator

ESWhat applies

Brazil · Resolution

ANPD data protection officer (encarregado) regulation

In forceANPD Res. 18/2024 (DPO)

Summary

It regulates the appointment, duties and public disclosure of the encarregado, Brazil's data protection officer. Small-scale agents are exempt unless they carry out high-risk processing, but must keep a channel for individuals.

Who it applies to

Controllers and, where applicable, processors subject to the LGPD.

Penalties

Those under the LGPD (art. 52).

Official name
Resolução CD/ANPD nº 18, de 16 de julho de 2024 – Regulamento sobre a atuação do encarregado pelo tratamento de dados pessoais
Official reference
Resolução CD/ANPD nº 18/2024, DOU julio de 2024
Regulator
National Data Protection Authority (ANPD)
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Appoint and publish the data protection officerLGPD, art. 41; Res. CD/ANPD 18/2024, arts. 3, 8 a 10 y 18In forceAlready applicableIf you are not a small-scale agent, or if you are but carry out high-risk processing (sensitive data, automated decisions, biometrics, monitoring).Verified in the official source on November 4, 2026
Contact channel for small-scale agentsRes. CD/ANPD 2/2022, arts. 3 y 11In forceAlready applicableIf you are a micro or small business and did not appoint an officer.Verified in the official source on November 4, 2026

Appoint and publish the data protection officer

LGPD, art. 41; Res. CD/ANPD 18/2024, arts. 3, 8 a 10 y 18In force

Already applicable

When it relates
If you are not a small-scale agent, or if you are but carry out high-risk processing (sensitive data, automated decisions, biometrics, monitoring).
What the rule provides
  • Formally appoint the officer and publish their identity and contact details on the website.
  • Give them autonomy, resources and access to senior management; avoid conflicts of interest.
Typical evidence
  • Appointment act and website disclosure.
Verification
Verified in the official source on November 4, 2026Checked against the LGPD (art. 41, Chamber of Deputies text) and the text of CD/ANPD Res. 18/2024 published by the ANPD on gov.br: art. 3 (formal appointment), 9 (publish identity and contact on the website), 10 (resources and technical autonomy) and 18 (conflict of interest).

Contact channel for small-scale agents

Res. CD/ANPD 2/2022, arts. 3 y 11In force

Already applicable

When it relates
If you are a micro or small business and did not appoint an officer.
What the rule provides
  • Keep a communication channel so individuals can exercise their rights.
Typical evidence
  • Published channel.
Related base documents
Verification
Verified in the official source on November 4, 2026Checked against CD/ANPD Res. 2/2022 published by the ANPD on gov.br: art. 11 (a small agent without an officer must offer a communication channel) and art. 3 (not available to those carrying out high-risk processing, except under art. 8).

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)