Brazil: Controller/Processor Duties

Accountability And DpiaGreen

DPIAs ('relatório de impacto') are expressly contemplated when processing relies on legitimate interest (Art. 10 §3) or involves sensitive data (Art. 38); the Digital Government Secretariat (SGD) guideline also recommends DPIAs for location tracking, profiling, automated decision-making with legal effects, and processing involving children/teenagers.

Claims (1):

• The LGPD expressly contemplates DPIAs where processing is based on legitimate interest or involves sensitive data, and ANPD may at any time request a DPIA from the controller in those instances.

Dpo RequirementsGreen

Resolution CD/ANPD No. 18/2024 requires all controllers to designate a DPO via a formal written act, grant technical autonomy, and ensure Portuguese-language communication; small-scale controllers are exempt but must maintain a data-subject communication channel; processors are not required to appoint a DPO.

Claims (2):

• Under ANPD Resolution CD/ANPD No. 18/2024, all organisations acting as a controller must designate a DPO through a formal written, dated and signed act; exemptions are granted only for small-scale controllers, which must instead maintain a channel for data-subject requests.
• The DPO must be able to communicate with ANPD and data subjects in Portuguese and is not personally liable for the controller's processing of personal information.

Ropa RequirementsAmber

A simplified ROPA template for small processing agents was developed under Resolution CD/ANPD 02/2022 following public consultation.

Claims (1):

• ANPD developed a draft simplified ROPA (record of processing activities) template specifically for small processing agents under Resolution CD/ANPD No. 02/2022.

Joint Controller ArrangementsGreen

Controllers and processors can be jointly and severally liable for security incidents and unauthorized/improper data use; a processor's liability may be limited to its contractual and security obligations if it does not itself violate LGPD rules.

Claims (1):

• Controllers and processors can be jointly and severally liable for information-security incidents and improper/unauthorized data use, though a processor's liability may be limited to its contractual and security obligations.

Security MeasuresAmber

Article 49 requires security in systems operationalising personal data processing; three of ANPD's early sanctioning decisions concerned Article 49 security violations.

Claims (1):

• Three of ANPD's published sanctioning decisions to date have dealt with Article 49 violations relating to ensuring security in systems operationalising personal data processing.

Breach NotificationGreen

Article 48 requires notification of security incidents to ANPD within a reasonable timeframe depending on severity, potentially triggering data-subject notification and public disclosure; Resolution CD/ANPD 15/2024 (April 2024) defines incidents and clarifies criteria, timeline and methods for notification.

Claims (2):

• Article 48 of the LGPD requires mandatory data-breach notification to ANPD within a reasonable timeframe, which may, depending on severity, require notifying affected data subjects and public disclosure of the incident.
• ANPD Resolution CD/ANPD No. 15 of 24 April 2024 defines security incidents and clarifies the criteria, timeline and methods for breach notification.

Retention And DisposalRed

No specific statutory retention-period schedule was identified in this research pass beyond the general purpose-limitation principle; ANPD has not published a dedicated retention/disposal regulation comparable to its DPO or breach-notification resolutions.