On August 19, Leonardi Advogados attended the 3rd ANPD DPOs’ Meeting, held in Brasília. The event brought together representatives from the National Data Protection Agency (ANPD), the Federal Government, the private sector, academia, and civil society to discuss three agendas that are redefining the role of data protection officers: the use of generative artificial intelligence, incident response, and the implementation of the Digital Statute for Children and Adolescents – the Digital ECA.
The meeting’s main message was that these agendas can no longer be addressed in isolation. Data protection, security, AI governance, and the protection of minors affect the same products, processes, vendors, and business decisions. This convergence increases the relevance of the data protection officer, who acts not only as a point of contact for data subjects and the ANPD, but also as a liaison among legal, product, technology, information security, compliance, marketing, human resources, and senior management.
This does not mean assigning the DPO exclusive responsibility for all these matters. On the contrary, the meeting reinforced that data protection is an organizational responsibility. The data protection officer’s strategic role lies precisely in connecting the different departments involved, translating legal requirements into operational criteria, and helping ensure that risks are identified and addressed before relevant decisions become definitively embedded in products and processes.
AI governance: from experimentation to structured risk management
The first panel addressed data protection in the use of generative artificial intelligence by public and private sector organizations. One of the main warnings was that AI tools should not be understood merely as productivity resources. Their use involves the processing of information at different stages, including data entered into prompts, documents used as context, generated outputs, usage records, logs, and information shared with vendors.
For organizations, this requires visibility into the use cases actually adopted, including those implemented directly by business departments. Vendor agreements and generic use policies are insufficient when the company does not know the purposes, the data used, the transfers carried out, the retention criteria, and the potential effects of the outputs produced by the systems.
The discussions also reinforced the need for controls proportionate to the risk of each application. Use cases capable of affecting rights, access to services, or relevant decisions require greater explainability, documentation, human oversight, and mechanisms for challenging decisions. Governance must cover the system’s entire lifecycle, from its conception to post-implementation monitoring, and should not be limited to a legal assessment carried out at the end of the project.
This discussion takes on particular importance in light of Bill No. 2,338/2023, which seeks to establish a legal framework for artificial intelligence in Brazil. Regardless of the final design of the future legislation, the discussions already point to growing expectations for demonstrable governance, with defined responsibilities, risk assessments, documentation, and appropriate oversight.
Security incidents: the DPO as the coordinator of the organizational response
The second panel highlighted that security incidents are not limited to data leaks or unauthorized access affecting data confidentiality. They may also involve compromises to the integrity, availability, or authenticity of personal data, requiring a broader assessment of the impacts on data subjects.
The response to these events should not be assigned exclusively to the data protection officer but should involve other relevant departments within the organization, such as Information Security, Technology and Commercial teams, Legal, and Corporate Communications. In this context, the DPO acts as a liaison among these areas, reducing gaps and promoting a consistent response.
The ANPD also reiterated that reporting an incident does not automatically result in the application of a sanction. The organization’s prior preparedness, diligence in responding, proportionality of the measures adopted, cooperation with the Agency, and ability to demonstrate the decisions made are relevant elements in regulatory proceedings.
Therefore, incident response is built before any incident occurs. Formally approved plans, defined roles, escalation criteria, preservation of evidence, communication flows, and simulation exercises are essential to enable the organization to act quickly, in a coordinated manner, and with appropriate documentation when a specific situation arises.
Digital ECA: from privacy by design to comprehensive safety by design
The third panel discussed the new challenges arising from the joint application of the LGPD and the Digital ECA. The discussions pointed to an expansion of the traditional privacy by design approach toward a broader safety by design approach.
From this perspective, it is not enough for products and services to protect the personal data of children and adolescents. Their design must also consider potential impacts on safety, health, well-being, development, and the exercise of rights, particularly in features involving content recommendations, advertising, communications between users, purchases, engagement mechanisms, and parental supervision.
One of the models discussed was the development of progressive journeys according to age group, with levels of autonomy, transparency, and protection adapted to the user’s development. This is a practical way of operationalizing principles such as the best interests of the child, protection by default, and progressive autonomy, while avoiding both undue exposure and the indiscriminate exclusion of children and adolescents from digital environments.
In this regard, the regulatory agenda is already concrete. The ANPD has been granted authority to regulate and enforce the Digital ECA and has been working on topics such as age-assurance mechanisms, obligations applicable to providers of digital products and services, and enforcement and sanctioning procedures. For companies offering services accessible or likely to be accessed by minors, the matter should be treated as a current and priority implementation workstream, rather than merely as a future regulatory expectation.