LGPD DPO (Encarregado): Appointment Rules and Duties

All controllers processing personal data under the LGPD, Brazilian or foreign, of any size, except small processing agents (micro-enterprises, small businesses, and startups as defined in Resolution 2/2022) who may substitute a published contact channel. Processors (operadores) are not required to appoint one, but the ANPD recommends it and Resolution 18/2024 contemplates it. A foreign company with no Brazilian entity but in-scope processing still needs one; nothing requires Brazilian residency or Portuguese nationality, though the role must actually function for Portuguese-speaking data subjects.

Yes. Resolution 18/2024 expressly allows a legal entity to serve as encarregado, so DPO-as-a-service firms and law firms can hold the role, and one person or entity can serve multiple companies if capacity and conflicts are managed. The appointment must be by formal documented act (board resolution, contract), and the controller remains responsible for giving the encarregado autonomy, resources, and direct access to the highest management level. What cannot be outsourced is accountability: sanctions land on the controller.

The identity (name of the individual or entity) and contact information of the encarregado, in a clear, objective, and easily accessible way, in practice, on the privacy notice or a dedicated page of the controller's website. Email is the minimum viable channel; it must be monitored, because it is the intake for both data subject requests on the 15-day clock and ANPD communications. An unpublished or dead DPO contact is the single easiest LGPD violation for anyone to detect, and it featured in the ANPD's first sanction.

Article 41(2) lists four: accept complaints and communications from data subjects, provide clarifications, and take action; receive communications from the ANPD and take action; orient employees and contractors about data protection practices; and perform other duties set by the controller or in complementary rules. Resolution 18/2024 adds that the controller must ensure the encarregado can act with technical autonomy and without conflict of interest, the executive who owns the data-monetization P&L is a poor choice. It is an advisory and interface role; operational compliance stays with the business.

Resolution 18/2024 requires controllers to prevent conflicts: the encarregado should not hold positions where they decide the purposes and means of the processing they would be reviewing (CEO, CTO, head of marketing are the classic problem cases). Where a potential conflict exists it must be managed and documented. For outsourced DPOs, the entity must manage conflicts across its client base. The dosimetry regulation treats governance failures as aggravating factors, so a paper DPO with an obvious conflict can worsen an otherwise routine sanction.