Brazil's Encarregado Regulation: The Appointment Paperwork, the Website Notice and the Conflict Rules

About the Translations Here

Resolution CD/ANPD No. 18 exists only in Portuguese. The ANPD has published English versions of some of its instruments, but not this one. Every rendering of the Regulation below is this publication's own translation of the text as published in the Diário Oficial da União of 17 July 2024 (Section 1, page 42), and the same applies to the ANPD's December 2024 guidance document discussed alongside it. Where a word matters, the Portuguese original is given next to the translation.

What Article 41 Left to the Authority

Article 41 of the LGPD is short. The controller must appoint an encarregado; the identity and contact information must be published clearly and objectively, preferably on the controller's website; four activities are listed; and paragraph 3 authorises the national authority to issue complementary rules on the definition and duties of the role, including cases in which appointment is waived according to the nature and size of the entity or its volume of processing. A fourth paragraph, added by Law 13.853 of 2019, was vetoed.

The ANPD's Board of Directors used that paragraph 3 power, together with Article 55-J, XIII, when it approved the Regulation on the role of the encarregado as the annex to Resolution No. 18. The resolution's Article 2 made it effective on the date of publication. The ANPD's own table of regulations, read on 21 September 2026, lists the resolution with the status Vigente (in force) and records no amending instrument, unlike several neighbouring resolutions in the same table that carry amendment notes.

The Regulation has 21 articles in three chapters: preliminary definitions, the obligations of processing agents, and the encarregado. It defines a conflict of interest as a situation that may improperly compromise, influence or affect the objectivity and technical judgement of the encarregado in performing the role.

The Formal Act of Appointment

Article 3 requires appointment by a formal act (ato formal) of the processing agent that states how the encarregado will operate and which activities they will carry out. Paragraph 1 defines the term: a written, dated and signed document that clearly and unequivocally shows the agent's intention to designate a natural person or a legal entity as encarregado. Paragraph 2 requires the document to be presented to the ANPD when requested.

The ANPD's guidance on the role of the encarregado (version 1.0, December 2024) reads paragraph 2 narrowly. In the authority's words, as translated here, there is no need to communicate the appointment to the ANPD, and the formal act does not need to appear on the controller's website. It suggests the act can take the form of an administrative ordinance in the public sector, or a contract or specific private instrument for an employee or an outside firm, and annexes two model texts. One worked example treats an addendum to an existing employee's contract, kept in the personnel file, as sufficient.

Article 4 adds a continuity rule. During the encarregado's absences, impediments or vacancy, the role is exercised by a formally designated substitute, and none of those situations may obstruct data subjects' rights or responses to the ANPD. The guidance describes designating the substitute at the same time as the principal as a way to reduce the risk of interruption, and notes that where the encarregado is a firm, a substitute is also named for the responsible individual.

Public bodies publish the appointment in an official gazette

Article 5 sets a separate track for public-law legal entities covered by Brazil's access-to-information law. They must appoint an encarregado when they process personal data, preferably a public servant or employee of unblemished reputation, and paragraph 1 requires the appointment to be published in the federal, state, district or municipal official gazette as appropriate. Paragraph 3 presumes that an encarregado appointed by a sub-unit covers the whole structure below it unless the act says otherwise. The guidance gives the example of a state university whose appointment appeared only in an internal staff bulletin, and describes that as insufficient.

What the Public Notice Must Contain

Article 41 said only that identity and contact details must be public. Articles 8 and 9 of the Regulation give that a floor:

Article 8 adds that the information must be kept up to date. The guidance applies the rule to a hypothetical startup offering AI-based credit analysis that published only an email address on its data protection page, and concludes that the notice was deficient: an address is contact information, not identity. For organisations without a website it mentions physical notices, signs, displays and leaflets as possible channels.

Five Things the Organisation Owes Its Encarregado

Article 10 turns the relationship around and lists duties of the processing agent rather than of the encarregado:

1. Provide the means needed to perform the role, including human, technical and administrative resources
2. Seek the encarregado's assistance and guidance when carrying out activities and taking strategic decisions about personal data processing
3. Guarantee the technical autonomy needed for the role, free from undue interference, particularly in guidance on data protection practices
4. Ensure data subjects have fast, effective and adequate means to communicate with the encarregado and exercise their rights
5. Guarantee direct access to the highest levels of the organisation, to those taking strategic decisions affecting processing, and to the organisation's other areas

Two provisions then allocate responsibility. Article 11 states that the processing agent is responsible for the compliance of its processing under the LGPD. Article 17 states that performing the activities in Articles 15 and 16 does not make the encarregado responsible, before the ANPD, for the compliance of the controller's processing. The guidance repeats the point in its own words: the encarregado has no decision-making competence over processing, because those decisions belong to the controller.

The Duties the Regulation Lists

Article 15 restates the four activities from Article 41, paragraph 2, and then adds a sole paragraph on communications from the ANPD. On receiving one, the encarregado is to route the demand internally to the competent units, give the agent the guidance and assistance needed, and expressly identify the agent's representative before the ANPD in administrative proceedings where the encarregado does not play that role personally.

Article 16 is the longer list. Drawing on the Article 10 duty to seek the encarregado's input, it assigns the encarregado to assist and guide the agent in preparing, defining and implementing, as the case may be: incident records and communications; the record of processing operations; data protection impact reports; internal supervision and risk-mitigation mechanisms; technical and administrative security measures; internal processes and policies for LGPD and ANPD compliance; contractual instruments on data processing; international data transfers; good-practice and governance rules and privacy governance programmes under Article 50; products and services designed to LGPD principles, including privacy by default and data minimisation; and other strategic decisions on processing.

The verbs matter. The Article 16 role is to assist and guide (prestar assistência e orientação), which is consistent with Article 17's statement that responsibility for compliance stays with the agent.

Who can hold the role

Article 12 allows the encarregado to be a natural person, inside or outside the organisation, or a legal entity. Article 13 requires the encarregado to be able to communicate with data subjects and the ANPD clearly and precisely in Portuguese. Article 14 states that the role does not presuppose registration with any body or any specific certification or professional training, and Article 7 leaves it to the agent to set the professional qualifications required, taking account of knowledge of data protection law and the context, volume and risk of the processing. The guidance adds that an organisational unit without legal personality cannot be appointed, because Article 12 names only natural persons and legal entities.

Conflicts of Interest

Articles 18 to 21 are the part of the Regulation with the clearest sanction attached. Article 18 requires the encarregado to act with ethics, integrity and technical autonomy and to avoid situations that could amount to a conflict of interest. Article 19 permits accumulation of functions and service to more than one processing agent, provided each can be fully served and no conflict exists. Its paragraph 1 identifies two places a conflict can arise: between functions exercised within one agent or across different agents; and where the encarregado also carries out activities involving strategic decisions about the controller's processing, other than the operations inherent in the encarregado role itself.

Paragraph 2 of Article 19 states that the existence of a conflict is assessed case by case and may give rise to a sanction against the processing agent under Article 52 of the LGPD. The sanction runs to the organisation, not to the encarregado. Article 20 places a declaration duty on the encarregado, who must disclose to the agent any situation that might amount to a conflict and is responsible for the truth of that disclosure. Article 21 then gives the agent three responses once a possible conflict is identified: not appointing the person, implementing measures to remove the risk, or replacing the person designated.

The guidance identifies where the ANPD expects conflicts to appear most often: an encarregado who also holds a leadership, management or direction post that determines the means and purposes of processing, naming human resources, information technology, finance and health as examples. It describes a separate organisational unit for the encarregado as a good practice for mitigating that risk.

Processors and Small Processing Agents

The Regulation reaches two groups that Article 41 does not mention by name. Article 6 makes appointment optional for processors and treats it as a good governance practice for the purposes of Article 52, paragraph 1, IX of the LGPD and Article 13, II of the annex to Resolution CD/ANPD No. 4 of 2023, the sanctions-calculation regulation. That Article 13, II provides a 20% reduction of a simple fine for implementing a good-practice and governance policy, up to the first-instance decision.

Article 3, paragraph 3, links the Regulation to the earlier rules for small processing agents. Those exempted from appointing an encarregado must instead provide a communication channel with data subjects under Article 11 of the Regulation annexed to Resolution CD/ANPD No. 2 of 2022. Who qualifies for that exemption, and which high-risk processing removes it, is the subject of a separate post on the small processing agents regulation.

Frequently Asked Questions