Data Protection Officer (DPO)

No. Article 50 of Law 19.628, as amended by Law 21.719, states that the data controller may appoint a data protection officer: it is a voluntary decision, and the law contemplates no infringement for not appointing one. The appointment becomes required when the company adopts the infringement prevention model of Article 49, whose first element is precisely that appointment.

The person appointed by the controller's highest directive or administrative authority to watch over personal data protection within the organization (Article 50, Law 19.628). The DPO must have autonomy from management in matters governed by the law, meet suitability, capability and specific-knowledge requirements, and serves as the contact point for data subjects. The DPO is bound by strict secrecy over the data they learn.

An internal or external person meeting suitability, capability and specific-knowledge requirements (Article 50). In micro, small and medium companies, the owner or top authorities may personally assume the tasks. A corporate group may appoint a single DPO if all its entities operate under the same standards and the DPO is accessible to all of them. The DPO may hold other functions, provided they create no conflict of interest.

Article 50 assigns informing and advising the controller, processors and staff; promoting and participating in the data processing policy; supervising compliance with the law and that policy; ensuring ongoing training of personnel; assisting in identifying processing risks and their measures; and developing an annual work plan with accountability.

The appointment is the first element of the Article 49 infringement prevention model. That model, certified by the Agency, lists the company in the National Registry of Sanctions and Compliance (Article 51) and evidences the diligent compliance the law recognizes as a mitigating circumstance (Article 36 No. 5). Before the Agency and data subjects, it is the verifiable signal of data governance.