--- title: "Brazil — Controller/Processor Duties | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/brazil/controller-processor-duties/ source_html: /jurisdictions/brazil/controller-processor-duties/index.html description: "Brazil — Controller/Processor Duties: controller_processor_duties Controller/Processor Duties 7 sub-modules 8 claims Amber ▾ # Core duties are legislated and increasingly detailed by ANPD resolutions (DPO, breach, dosimetr" generated_at: 2026-10-25T04:46:50Z content_sha256: 2fac6b0ff422f78599c75827c6c9acf6758058e9fcd29038bf7e5761e6de0ca7 generator: "fe-fleet/md-twin@1.0" --- # Brazil — Controller/Processor Duties | Data Protection Monitor ### D4Controller/Processor Duties7 sub-modules8 claimsAmber▾# Core duties are legislated and increasingly detailed by ANPD resolutions (DPO, breach, dosimetry), but explicit statutory retention/disposal timelines remain unresolved and enforcement of Art. 48/49 duties shows continuing public-sector immaturity. Primary framework LGPD Arts. 37–50; ANPD Resolutions CD/ANPD 15/2024, 18/2024, 02/2022 Supervisory authority [Agência Nacional de Proteção de Dados (ANPD)](https://www.gov.br/anpd/) Traffic-light rationale — Amber Core duties are legislated and increasingly detailed by ANPD resolutions (DPO, breach, dosimetry), but explicit statutory retention/disposal timelines remain unresolved and enforcement of Art. 48/49 duties shows continuing public-sector immaturity. #### Sub-modules (7) #### Accountability And DpiaGreen DPIAs ('relatório de impacto') are expressly contemplated when processing relies on legitimate interest (Art. 10 §3) or involves sensitive data (Art. 38); the Digital Government Secretariat (SGD) guideline also recommends DPIAs for location tracking, profiling, automated decision-making with legal effects, and processing involving children/teenagers. Claims (1): - The LGPD expressly contemplates DPIAs where processing is based on legitimate interest or involves sensitive data, and ANPD may at any time request a DPIA from the controller in those instances. #### Dpo RequirementsGreen Resolution CD/ANPD No. 18/2024 requires all controllers to designate a DPO via a formal written act, grant technical autonomy, and ensure Portuguese-language communication; small-scale controllers are exempt but must maintain a data-subject communication channel; processors are not required to appoint a DPO. Claims (2): - Under ANPD Resolution CD/ANPD No. 18/2024, all organisations acting as a controller must designate a DPO through a formal written, dated and signed act; exemptions are granted only for small-scale controllers, which must instead maintain a channel for data-subject requests. - The DPO must be able to communicate with ANPD and data subjects in Portuguese and is not personally liable for the controller's processing of personal information. #### Ropa RequirementsAmber A simplified ROPA template for small processing agents was developed under Resolution CD/ANPD 02/2022 following public consultation. Claims (1): - ANPD developed a draft simplified ROPA (record of processing activities) template specifically for small processing agents under Resolution CD/ANPD No. 02/2022. #### Joint Controller ArrangementsGreen Controllers and processors can be jointly and severally liable for security incidents and unauthorized/improper data use; a processor's liability may be limited to its contractual and security obligations if it does not itself violate LGPD rules. Claims (1): - Controllers and processors can be jointly and severally liable for information-security incidents and improper/unauthorized data use, though a processor's liability may be limited to its contractual and security obligations. #### Security MeasuresAmber Article 49 requires security in systems operationalising personal data processing; three of ANPD's early sanctioning decisions concerned Article 49 security violations. Claims (1): - Three of ANPD's published sanctioning decisions to date have dealt with Article 49 violations relating to ensuring security in systems operationalising personal data processing. #### Breach NotificationGreen Article 48 requires notification of security incidents to ANPD within a reasonable timeframe depending on severity, potentially triggering data-subject notification and public disclosure; Resolution CD/ANPD 15/2024 (April 2024) defines incidents and clarifies criteria, timeline and methods for notification. Claims (2): - Article 48 of the LGPD requires mandatory data-breach notification to ANPD within a reasonable timeframe, which may, depending on severity, require notifying affected data subjects and public disclosure of the incident. - ANPD Resolution CD/ANPD No. 15 of 24 April 2024 defines security incidents and clarifies the criteria, timeline and methods for breach notification. #### Retention And DisposalRed No specific statutory retention-period schedule was identified in this research pass beyond the general purpose-limitation principle; ANPD has not published a dedicated retention/disposal regulation comparable to its DPO or breach-notification resolutions. Category narrative 57 words Controllers must appoint a DPO (Resolution CD/ANPD 18/2024) unless qualifying as a small-scale controller; ROPA obligations apply with a simplified template for small agents; DPIAs are recommended/required for legitimate-interest and sensitive-data processing and for profiling/tracking/children's-data scenarios; breach notification to ANPD is mandatory within a reasonable timeframe under Resolution CD/ANPD 15/2024; joint controller/processor liability follows a GDPR-like split. no periodic updates on record for this sub-brief Evidence 8 Sources and claims (8) - Confirmed[IAPP](https://iapp.org/news/a/brazils-new-regulation-on-international-data-transfers) — The LGPD expressly contemplates DPIAs where processing is based on legitimate interest or involves sensitive data, and ANPD may at any time request a DPIA from the controller in those instances.observed 2026-08-03 - Confirmed[IAPP](https://iapp.org/news/a/anpd-publishes-new-regulation-on-dpo-role) — Under ANPD Resolution CD/ANPD No. 18/2024, all organisations acting as a controller must designate a DPO through a formal written, dated and signed act; exemptions are granted only for small-scale controllers, which must instead maintain a channel for data-subject requests.observed 2026-08-03 - Confirmed[IAPP](https://iapp.org/news/a/anpd-publishes-new-regulation-on-dpo-role) — The DPO must be able to communicate with ANPD and data subjects in Portuguese and is not personally liable for the controller's processing of personal information.observed 2026-08-03 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/news/brazil-anpd-requests-public-comments-draft-ropa) — ANPD developed a draft simplified ROPA (record of processing activities) template specifically for small processing agents under Resolution CD/ANPD No. 02/2022.observed 2026-08-03 - Confirmed[IAPP](https://iapp.org/news/a/the-new-brazilian-general-data-protection-law-a-detailed-analysis) — Controllers and processors can be jointly and severally liable for information-security incidents and improper/unauthorized data use, though a processor's liability may be limited to its contractual and security obligations.observed 2026-08-03 - Confirmed[IAPP](https://iapp.org/news/a/lessons-from-brazilian-dpa-sanctions-to-date) — Three of ANPD's published sanctioning decisions to date have dealt with Article 49 violations relating to ensuring security in systems operationalising personal data processing.observed 2026-08-03 - Confirmed[IAPP](https://iapp.org/news/a/the-new-brazilian-general-data-protection-law-a-detailed-analysis) — Article 48 of the LGPD requires mandatory data-breach notification to ANPD within a reasonable timeframe, which may, depending on severity, require notifying affected data subjects and public disclosure of the incident.observed 2026-08-03 - Confirmed[IAPP](https://iapp.org/news/a/anpd-s-regulation-on-security-incidents) — ANPD Resolution CD/ANPD No. 15 of 24 April 2024 defines security incidents and clarifies the criteria, timeline and methods for breach notification.observed 2026-08-03