Data Protection Officer (DPO)
Definition
The person designated by a controller or processor to advise on, monitor and support compliance with data protection law and to act as contact point for individuals and authorities.
Under the GDPR (Arts. 37-39), designating a DPO is mandatory for public authorities and for organisations whose core activities involve large-scale regular monitoring of individuals or large-scale processing of special categories. The DPO informs and advises the organisation, monitors compliance, advises on DPIAs, cooperates with the supervisory authority and is the contact point for data subjects. The role must be independent: the DPO receives no instructions on how to perform these tasks, cannot be dismissed for performing them and reports to the highest management level.
The LGPD calls this person the encarregado (Art. 41), and ANPD rules set out the role, conflicts of interest and cases where small processing agents are exempt.
Neither the GDPR nor the LGPD requires the DPO to hold any specific certification. They require expert knowledge of data protection law and practice, proportionate to the processing. Certifications such as the DPAI can demonstrate knowledge, but they do not qualify or appoint anyone as DPO.
Where this term is assessed
Assessed in the Data Protection & AI Professional (DPAI), domain 3: Accountability tools.
Also covered in: Responsible AI Foundation (RAIF)
Primary sources
- GDPR Arts. 37-39
- LGPD Art. 41
- Resolução CD/ANPD nº 18/2024