As the largest economy in Latin America and the world's sixth-largest internet user market, Brazil is becoming an increasingly important target for Chinese companies expanding overseas. Since the full implementation of Brazil's General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, LGPD) in September 2020, a systematic framework for personal data protection has been established. The Encarregado system (i.e., DPO) under the LGPD requires all data controllers to appoint dedicated personnel, making it one of the top compliance priorities for Chinese companies entering the Brazilian market. With the Brazilian National Data Protection Authority (ANPD) intensively issuing supporting regulations and enforcement actions in 2024, the practical requirements of the Encarregado system have become increasingly clear and stringent.
Article 41: Mandatory Appointment of a Data Protection Officer for All Personnel
Article 41 of the LGPD stipulates that data controllers (controlador) shall appoint an Encarregado pelo Tratamento de Dados Pessoais, responsible for handling complaints and communications from data subjects, receiving and addressing notifications and measures from the ANPD, guiding the data protection practices of the organization's employees and contractors, and fulfilling other duties determined by the controller or specified by other regulations. Unlike the conditional mandatory model of the GDPR, the original text of the LGPD imposes the obligation to appoint an Encarregado on all data controllers, without setting thresholds based on size or industry. Notably, the LGPD's Encarregado requirement applies only to data controllers (controlador) and not to data processors (operador), which differs from the GDPR's DPO model that applies to both controllers and processors.
Resolution CD/ANPD No. 18/2024: A Landmark Supporting Regulation
In July 2024, the ANPD issued Resolution CD/ANPD No. 18/2024 (Regulations on the Role of the Encarregado), one of the most significant supporting regulations for the Encarregado since the implementation of the LGPD. This resolution clarifies and refines several key aspects of the Encarregado system, addressing various ambiguities left in the original text of the LGPD.
- ›Both natural and legal persons may serve as the Encarregado: Resolution 18 explicitly confirms that the Encarregado can be either a natural person (pessoa natural) or a legal person (pessoa jurídica). This clarification provides a solid legal foundation for outsourcing models, allowing companies to engage professional DPO service providers to act as the Encarregado. ---ITEM--- May serve multiple controllers simultaneously: Resolution 18 permits the same natural or legal person to serve as the Encarregado for multiple data controllers concurrently. This is significant for the DPO-as-a-Service model, enabling service providers to offer Encarregado services to multiple companies at scale. ---ITEM--- No personal liability: Resolution 18 explicitly excludes personal legal liability for the Encarregado. The Encarregado is not subject to personal penalties for actions performed in their role, as compliance responsibilities under the LGPD rest with the data controller. This provision aligns with the GDPR's stance and helps attract professionals to DPO roles. ---ITEM--- Conflict of interest management: Resolution 18 requires data controllers to ensure that the Encarregado has no conflicts of interest. If the Encarregado holds other positions concurrently, these roles must not conflict with their responsibilities as the Encarregado.
Language Requirement: Proficiency in Brazilian Portuguese communication is a mandatory condition.
Although the LGPD does not explicitly stipulate language requirements in its legal provisions, in practical operations, the Encarregado must be able to communicate effectively with the ANPD and data subjects in Brazilian Portuguese. This requirement stems from the core functions assigned to the Encarregado under the LGPD—receiving and handling complaints and inquiries from data subjects, as well as receiving and responding to notifications and measures from the ANPD—all of which are conducted in Brazilian Portuguese. For Chinese companies, this means that proficiency in English or Chinese alone is insufficient to meet the operational requirements of the Encarregado. Enterprises must ensure that the Encarregado possesses fluent Brazilian Portuguese skills or opt for an outsourced service provider with such language capabilities.
Obligation to Disclose Identity and Contact Information
Article 41(1) of the LGPD stipulates that the identity and contact information of the Encarregado must be publicly disclosed on the data controller's website and presented in a clear and accessible manner. Resolution CD/ANPD No. 18/2024 further clarifies that the publicly disclosed information should at least include the Encarregado's full name (for individuals) or company name (for legal entities), as well as a valid contact email or other electronic means of communication. For subsidiaries or branches established by Chinese companies in Brazil, it is essential to ensure that the contact information of the Encarregado is included on both their local Brazilian website and their global website. Failure to comply with this disclosure obligation may result in administrative penalties imposed by the ANPD.
2024 ANPD Enforcement Trends
In November 2024, the ANPD initiated a concentrated enforcement action targeting companies that had not appointed a Data Protection Officer (Encarregado), with approximately 20 companies included in the regulatory review list. This marks the ANPD's first systematic enforcement effort regarding the obligation to appoint an Encarregado, signaling a new phase in Brazil's data protection enforcement. In its announcement, the ANPD emphasized that appointing an Encarregado is a fundamental compliance requirement under the LGPD, and all data controllers should proactively comply before becoming subject to ANPD enforcement actions. This enforcement action covered companies across various industries and sizes, indicating that the ANPD is not solely focused on large enterprises, and small and medium-sized enterprises also face enforcement risks.
The core responsibilities of the Data Protection Officer (DPO).
- ›Receive and handle complaints and communications from data subjects, including responding to inquiries regarding the processing of their personal data. ---ITEM--- Receive and address notifications and measures from the ANPD, ensuring the organization promptly responds to regulatory requirements and investigations. ---ITEM--- Guide the organization's employees and contractors on best practices for personal data protection, fostering the development of a data protection culture. ---ITEM--- Fulfill other responsibilities designated by the controller, as well as additional duties required by applicable laws and regulations. Resolution 18 introduces expanded functions such as compliance oversight and data protection policy recommendations.
Compliance Recommendations for Chinese Enterprises Going Global
- ›Prioritize the Appointment of an Encarregado: Given the enforcement trends of the ANPD in 2024, Chinese companies entering the Brazilian market should prioritize the appointment of an Encarregado as a key requirement for market access, rather than waiting to react passively after regulatory scrutiny. ---ITEM--- Leverage Outsourcing Models: Resolution 18 provides a clear legal basis for legal entities to serve as Encarregados. Chinese companies can opt for DPO service providers with proficiency in Brazilian Portuguese and expertise in the LGPD. ---ITEM--- Ensure Language Compliance: The Encarregado must be able to communicate in Brazilian Portuguese, which is an unavoidable practical requirement. If appointing an internal staff member, ensure their Portuguese proficiency; if outsourcing, verify the language coverage of the service provider. ---ITEM--- Timely Disclosure of Contact Information: Clearly and visibly publish the identity and contact details of the Encarregado on local Brazilian websites to fulfill the LGPD’s disclosure obligations.
Conclusion
The Encarregado system under Brazil's LGPD is transitioning from legal text to enforcement practice. The introduction of Resolution 18 in 2024 and the concentrated enforcement actions by ANPD mark a new phase of more standardized and stringent data protection compliance in Brazil. Chinese companies expanding overseas should seize the compliance window, proactively plan their Encarregado arrangements, and enter and deepen their presence in the Brazilian market with a robust compliance posture. DataAigis, with its proficiency in Brazilian Portuguese and expertise in LGPD compliance, offers efficient Encarregado outsourcing services for Chinese enterprises venturing abroad.
