Quick Answer: Does your company need an LGPD DPO / encarregado?
If your organization is a controller subject to the LGPD, Article 41 starts from the rule that the controller must appoint an encarregado. The major private-sector exemption is for qualifying small processing agents under ANPD Resolution No. 2/2022. That exemption is conditional: organizations that fall outside the regulation's small-agent eligibility rules—including relevant high-risk processing situations—cannot simply rely on the small-company label. A qualifying small agent that does not appoint an encarregado must still provide a communication channel for data subjects. ANPD's current specific rule for the function is Resolution No. 18/2024.
Key Takeaways
- The Brazilian role is called the encarregado. “DPO” is a useful international shorthand, but the Brazilian requirements come from the LGPD and ANPD rules.
- Controllers start from an appointment obligation. Operators may also designate an encarregado, but ANPD guidance distinguishes the controller's legal duty from an operator's optional designation.
- Qualifying small processing agents can be exempt. The exemption is not available simply because a company considers itself small.
- The encarregado can be internal or external, a natural person or a legal entity.
- No specific degree or certification is mandatory. The organization defines the qualifications needed based on its processing context, volume and risk.
- The identity and contact information must be public. A generic privacy inbox alone may not satisfy the identity requirement.
- The encarregado advises; the controller decides. ANPD guidance says the encarregado is not personally responsible before ANPD for the controller's processing compliance.
Global companies often approach this question by asking whether their existing GDPR DPO can simply “cover Brazil.” Sometimes the answer may be operationally yes. But the right analysis starts with the Brazilian rules, not the job title.
Brazil regulates who must appoint the role, how the appointment is documented, what information is disclosed publicly, how substitutes work, what resources and autonomy must be provided, and how conflicts of interest should be managed.
Who Must Appoint an Encarregado Under the LGPD?
Article 41 states that the controller must appoint an encarregado for personal-data processing. Article 41 also authorizes ANPD to establish complementary rules and exemptions based on factors such as the nature and size of the organization or the volume of processing operations.
ANPD's current guide on the role explains the practical distinction this way: appointment is an obligation of the controller and optional for the operator, subject to the small-processing-agent exemptions in Resolution No. 2/2022.
Article 41 imposes the appointment obligation on controllers, unless a valid ANPD exemption applies.
ANPD guidance describes operator appointment as optional, although contracts, group governance or operational needs may lead an operator to designate one.
Qualifying small processing agents can be exempt from appointment, but must satisfy Resolution 2/2022 and maintain a data-subject contact channel.
Brazil's Law No. 15,352/2026 transformed ANPD into the Agência Nacional de Proteção de Dados and updated the LGPD's terminology accordingly. The acronym ANPD remains the same.
The Small-Processing-Agent Exemption
Resolution CD/ANPD No. 2/2022 provides a differentiated compliance framework for qualifying agentes de tratamento de pequeno porte—small processing agents.
Article 11 of that regulation says qualifying small processing agents are not required to appoint the encarregado required by Article 41. If they choose not to appoint one, however, they must provide a communication channel through which data subjects can exercise the communication function addressed in Article 41.
The regulation defines the category broadly enough to include microenterprises, small businesses, startups, certain private legal entities including nonprofits, natural persons and private entities without legal personality, provided they fall within the regulatory conditions.
A company relying on the exemption should therefore keep a short written analysis showing:
- why it qualifies as a small processing agent;
- why none of the exclusion criteria applies;
- whether any high-risk processing is performed;
- what communication channel is available to data subjects; and
- when the exemption analysis was last reviewed.
This is a good example of why a foreign company should not assume that “small U.S. startup” equals “small processing agent” under Brazilian law. The exemption has to be mapped to the Brazilian regulation.
Who Can Serve as the LGPD Encarregado?
Resolution 18/2024 and ANPD's guide give organizations significant flexibility. The encarregado can be a natural person or a legal entity.
That means the role can potentially be performed by:
- an employee of the organization;
- a privacy professional within a group company;
- an external consultant;
- a specialized DPO-as-a-service provider; or
- a legal entity contracted specifically to act as encarregado.
Can the encarregado be outside Brazil?
ANPD's current guide includes an example of a professional working outside Brazil who can serve as encarregado when the person has strong LGPD knowledge and is able to communicate with data subjects and ANPD in Portuguese in an easy and timely manner.
The practical implication for a multinational is that physical residence in Brazil is not presented by ANPD as an absolute requirement in that example. But accessibility, Portuguese-language communication, time-zone coverage, availability, conflict management and operational effectiveness still matter.
Does the LGPD require an attorney, specific degree or DPO certification?
No. ANPD's guide says the function does not depend on registration with ANPD or a private association, and no specific professional education or certification is required.
Instead, the organization should define the qualifications needed based on the person's knowledge of privacy law and the context, volume and risk of the organization's processing. ANPD highlights useful multidisciplinary knowledge in areas such as risk management, data governance, compliance, audit, information security and the organization's core business.
Formal Appointment, Public Identity and Contact Information
One of the most concrete requirements in Resolution 18/2024 is that the encarregado be designated through a formal act.
ANPD's guide explains that this means a written, dated and signed document that clearly demonstrates the organization's intention to designate a natural person or legal entity. Depending on the relationship, this can be an internal act, an employment-related instrument, a contract, or another specific written designation.
Create the Formal Designation
Identify the controller, the appointed encarregado, the effective date, the scope of the role, and the relevant responsibilities. Keep the signed document available for ANPD if requested.
Publish the Encarregado's Identity
Article 41 requires public disclosure of identity and contact information, clearly and objectively, preferably on the controller's website.
If the encarregado is a natural person, the minimum identity disclosure is the person's full name. If the encarregado is a legal entity, ANPD says the disclosure should include the legal entity's business name or establishment title and the full name of the natural person responsible.
privacy@company.com or dpo@company.com. ANPD's guide explains that an email address is contact information, not the identity of the encarregado.Publish Effective Contact Information
The contact information must enable data subjects to exercise their rights and allow ANPD to communicate effectively. Email and phone are common options, but ANPD allows other methods if they provide effective communication.
Designate a Substitute
Absence, impediment or vacancy must not block data-subject rights or ANPD communications. ANPD requires the duties to be performed by a formally designated substitute in those situations and recommends designating the substitute at the same time as the primary encarregado.
If a legal entity is appointed as encarregado, a substitute should also be identified for the natural person responsible for representing that entity in the role.
What Does the Encarregado Actually Do?
Article 41 lists four core activities:
- receive complaints and communications from data subjects, provide explanations and take appropriate action;
- receive communications from ANPD and take appropriate action;
- guide employees and contractors about personal-data protection practices; and
- perform other duties assigned by the controller or established in complementary rules.
Resolution 18/2024 expands the practical advisory role. ANPD's guide describes the encarregado as supporting and advising the organization on areas such as processing records, security incidents, internal policies, contracts, international transfers, governance and data-protection impact work.
The organization must give the role real resources
Resolution 18/2024 imposes duties on the processing agent that make a purely symbolic appointment difficult to defend. ANPD says the organization should:
- provide the human, technical and administrative means necessary for the role;
- request the encarregado's assistance and guidance in strategic activities involving personal-data processing;
- provide the technical autonomy needed to perform the function without improper interference;
- give data subjects fast and effective ways to communicate with the encarregado; and
- give the encarregado direct access to senior decision-makers and relevant organizational areas.
Depending on processing scale and complexity, ANPD's guide notes that the role may need a support team or committee and adequate time, budget and infrastructure.
Conflicts of Interest: One of the Most Important 2024 Rules
Resolution 18/2024 defines conflict of interest as a situation capable of improperly compromising, influencing or affecting the objectivity and technical judgment needed to perform the encarregado's duties.
This is particularly important when the company appoints an existing executive to the role. ANPD's guide explains that positions involving strategic decisions about the purposes and means of personal-data processing can conflict with the independence needed for the encarregado function.
| Scenario | Risk | What to review |
|---|---|---|
| Head of IT is also encarregado | IT leadership may determine key means and objectives of processing while also being expected to assess privacy practices objectively. | Decision authority, technical autonomy, escalation, separation of duties, actual processing responsibilities. |
| Head of HR is also encarregado | HR may determine purposes and means for large amounts of employee personal data. | Strategic authority, employee-data decisions, investigation roles, autonomy. |
| CFO / finance leader is encarregado | Finance leadership can make strategic decisions involving customer, employee or transaction data. | Decision-making scope and ability to challenge the same decisions independently. |
| External DPO serves competitors | Potential conflicting obligations or exposure to privileged/strategic information. | Client portfolio, confidentiality, sector overlap, capacity, conflict procedures. |
| One group DPO covers many subsidiaries | Not automatically prohibited, but capacity and conflicts can become operational issues. | Workload, language, accessibility, local processing knowledge, escalation and competing interests. |
ANPD does not say that every manager is automatically conflicted. The analysis is fact-specific. Its guide says conflicts can exist within one organization or across organizations where the same encarregado serves multiple entities.
Can one person be DPO / encarregado for multiple companies?
Yes. ANPD says there is no general prohibition on one encarregado working for more than one organization. The organization should assess capacity and conflicts, including the industries involved, types of processing, strategic information and whether the person can actually fulfill the function for each organization.
12-Point LGPD DPO / Encarregado Appointment Checklist
Not sure whether the DPO question is your first gap?
Run the broader 25-point LGPD Compliance Checklist for Foreign Companies to review scope, data mapping, legal bases, vendors, transfers, rights, security and governance alongside the encarregado requirement.
Foreign Company Example
Imagine a U.S. SaaS company that serves Brazilian business customers. It acts as an operator for customer-uploaded content, but as a controller for account administration, billing, security monitoring and its own marketing.
A practical encarregado analysis might proceed like this:
- Confirm the LGPD territorial scope for the Brazil-facing activities.
- Document controller and operator roles by processing activity.
- Determine whether any Resolution 2/2022 exemption is genuinely available.
- If appointment is required, assess whether the existing global DPO can perform the Brazilian function.
- Confirm Portuguese-language accessibility and appropriate time-zone coverage.
- Check for conflicts with the person's other management responsibilities.
- Execute the formal designation and appoint a substitute.
- Publish the required identity and contact information.
- Provide access to senior management, the data map, vendors, incident process and rights workflow.
- Review the arrangement when the business model, processing risk or organizational structure changes.
This is much more defensible than merely adding “Brazil” to the existing GDPR DPO's signature line.
How This Fits With GDPR DPO Governance
Organizations with an established GDPR DPO can often reuse substantial governance infrastructure: privacy committees, escalation channels, data inventories, training, DPIA processes, rights workflows and incident procedures.
But the Brazilian layer should still document:
- Article 41 applicability and any small-agent exemption;
- Resolution 18/2024 formal designation;
- the Brazilian public identity/contact disclosure;
- Portuguese-language communication capability;
- the designated substitute;
- Brazil-specific conflict analysis;
- ANPD-facing workflow; and
- the role's integration with Brazilian processing, contracts, transfers and rights.
For the broader comparison, see LGPD vs GDPR: 15 Differences Global Companies Need to Know.
Turn the DPO Question Into a Complete LGPD Governance Review
The Brazil LGPD Compliance Playbook — 2026 Edition includes guidance on the encarregado, a 100-point compliance audit, a 30-day implementation roadmap and 16 practical tools for data mapping, processing records, legal bases, vendor reviews, transfers, requests, incidents, privacy notices, retention and quarterly governance.
Frequently Asked Questions
Does every company subject to LGPD need a DPO or encarregado?
Article 41 starts from the rule that the controller must appoint an encarregado. Qualifying small processing agents can be exempt under Resolution 2/2022, subject to the regulation's eligibility limits. A qualifying small agent that does not appoint one must still provide a data-subject communication channel.
Is the LGPD encarregado the same as a GDPR DPO?
The roles are comparable at a high level, but the legal tests and detailed obligations are not identical. Global companies should map an existing DPO arrangement to Article 41, Resolution 18/2024 and other ANPD rules rather than assume automatic equivalence.
Can the encarregado be an external consultant or company?
Yes. ANPD says the encarregado may be a natural person or a legal entity contracted for that purpose. A formal written, dated and signed designation is required.
Does the encarregado have to live in Brazil?
ANPD's guide gives an example of a professional outside Brazil serving as encarregado when able to communicate with Brazilian data subjects and ANPD in Portuguese in an easy and timely manner. Organizations should still verify effective availability and governance.
Does the LGPD require a DPO certification?
No specific certification, degree, ANPD registration or private-association registration is required. The organization should select qualifications appropriate to the law, context, volume and risk of its processing.
Do we have to publish the DPO's name?
Yes. Article 41 requires the identity and contact information of the encarregado to be public. If the encarregado is a natural person, ANPD says the person's full name is the minimum identity disclosure. If it is a legal entity, publish its business name or establishment title and the full name of the natural person responsible.
Is a generic privacy email enough?
Not by itself for the identity requirement. ANPD's guide explains that an email address is contact information, not the identity of the encarregado. The required identity information should also be disclosed.
Does the company have to tell ANPD when it appoints the encarregado?
ANPD's guide says the formal appointment does not need to be communicated to ANPD merely because the designation occurred. The organization should retain the formal act and present it if requested.
Can the head of IT or HR also be the encarregado?
Possibly, but the organization must analyze conflict of interest in the actual circumstances. ANPD specifically notes that management roles determining purposes or means of personal-data processing—such as IT, HR, finance or health leadership—can create conflict risks requiring careful assessment.
Is the encarregado personally responsible for LGPD compliance?
No. ANPD describes the role as advisory and says the encarregado is not responsible before ANPD for the controller's personal-data processing compliance merely by holding the role. Processing decisions remain the controller's responsibility.
Official Sources Used for This Guide
- Law No. 13,709/2018 — LGPD, current compiled text Primary source for the definition of encarregado and Article 41 appointment, disclosure and core activities.
- Law No. 15,352/2026 Primary source for the 2026 transition from Autoridade Nacional de Proteção de Dados to Agência Nacional de Proteção de Dados and related LGPD wording updates.
- ANPD — Current Regulations Official regulatory index confirming Resolution CD/ANPD No. 18/2024 is currently in force.
- ANPD — Guide to the Role of the Encarregado Official guidance used for formal appointment, external/legal-entity encarregados, Portuguese communication, substitutes, public identity, qualifications, resources, autonomy, duties and conflicts of interest.
- ANPD Resolution CD/ANPD No. 2/2022 — Small Processing Agents Primary regulatory source for the small-agent appointment exemption, communication-channel requirement and eligibility limits.