The controller must appoint an encarregado (data protection officer), whose identity and contact information are published clearly and objectively, preferably on the controller's website. The encarregado accepts complaints and communications from data subjects, gives explanations and takes action; receives communications from the ANPD and acts on them (routing them internally, advising the agent and naming the agent's representative in ANPD proceedings where that is someone else); guides employees and contractors on data protection practices; and performs other duties assigned by the agent or by complementary rules. Resolution 18/2024 adds that the encarregado may be an employee, an external natural person or a legal entity, must communicate clearly in Portuguese with data subjects and the ANPD, needs no registration or certification, and assists the agent on incident records and communication, the record of processing, impact reports, internal oversight and risk mitigation, security measures, internal policies, contracts, international transfers, governance programmes, and privacy by design and by default; performing these activities does not make the encarregado responsible to the ANPD for the controller's compliance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.