Data protection officer (DPO): what they do, how much they earn, and how to become one

The data protection officer, also called the DPO, is the professional responsible for being the bridge between the company, the holders of personal data, and Brazil's National Data Protection Authority (ANPD). It is a role created by Brazil's General Data Protection Law (LGPD), in Article 41, and it has become one of the careers that has grown the most in recent years in Brazil. If you work with data, compliance, legal, or information security and want to understand what a data protection officer does, how much they earn, and how to become one, this guide was made for you.

I'm going to treat the topic the way I treat everything in data governance: without loose legalese and without the idea that it is enough to appoint someone for the problem to be solved. In practice, the data protection officer only works when the company knows where the data is, who owns it, and whether it can be trusted. And that is exactly where most companies stumble.

What a data protection officer is

The data protection officer is the person designated by the company to act as the communication channel on personal data protection. The LGPD calls the company the controller, that is, whoever makes the decisions about how and why personal data is processed. The DPO is the one who answers for that controller when someone asks what is being done with the data.

The term DPO comes from English and became popular because of the GDPR, the European data protection law. In Brazil, the official expression in the LGPD is "encarregado pelo tratamento de dados pessoais" (the person in charge of personal data processing). In market practice, the two terms are used as synonyms. When you see a DPO job posting, it is the same role as the data protection officer provided for by law.

The point few people notice is that the DPO is not a technical technology position. It is a governance role. They don't need to know how to code or configure a server. They need to understand personal data, risk, process, and above all, know how to talk with very different areas inside the company. A good DPO moves between legal, IT, HR, marketing, and the board without getting lost in any of them.

What a data protection officer does in practice

Article 41 of the LGPD defines four groups of duties. The DPO accepts complaints and communications from data subjects, provides clarifications, and takes action. Receives communications from the ANPD and takes the necessary measures. Guides employees and areas of the company on data protection practices. And performs the other duties the controller defines.

Translated to the day to day, the DPO's work is much less glamorous and much more operational than it seems. When a customer asks to know what data the company holds about them, or asks for their data to be deleted, the DPO is the one who ensures that request is handled within the deadline. When a breach happens, they are the one who coordinates the response and notifies the ANPD. When marketing wants to launch a campaign using a contact list, they are the one who asks where that list came from and whether there is a legal basis to use it.

Let me give an example that comes up a lot in companies. The sales team decides to enrich the customer master with data bought from third parties to improve segmentation. It sounds like a good business idea. The DPO is the one who has to raise a hand and ask: was this data collected with valid consent, does the purpose match the original one, and can we prove it if the ANPD asks. Without someone asking that question at the right time, the company discovers the problem when it has already become a fine.

And here comes the connection I always make. The DPO can only answer these questions if the company has a minimum of organization in its data. They need an inventory of personal data, they need to know in which systems the customer's CPF (Brazil's individual taxpayer ID) is stored, they need to know which area owns that record. If the same customer's data is duplicated across five systems, with different spellings, the DPO has no way to guarantee that a deletion request was truly fulfilled. Data protection starts with data governance. There is no way to separate the two.

DPO, data owner, and data steward: who is who

A common question is how the DPO fits in among the other data governance roles. The data owner is the owner of the data within a business area, who answers for the rules of that domain. The data steward is the one who takes care of quality and standardization day to day. The DPO has a different focus: they look specifically at personal data and compliance with the LGPD.

In practice, these roles work together. When the DPO needs to handle a data subject request, they depend on the data owner to know what data that area holds and on the data steward to ensure the record is clean and findable. In more mature companies, there is also the Chief Data Officer coordinating the entire data strategy from above. The DPO doesn't replace any of these roles. They are the personal data protection layer inside a governance structure that has to exist underneath.

Who needs a DPO and where they sit in the structure

The LGPD requires the controller to appoint a DPO. On the strictest reading, this applies to practically any company that processes personal data, which includes almost everyone. The ANPD, through Resolution CD/ANPD No. 18/2024, brought clearer rules on the DPO's role and relaxed the requirement for small-scale processing agents, such as microenterprises and startups, which are exempt from formally appointing a DPO, although they must maintain a communication channel with data subjects.

The DPO can be an individual or a legal entity. It can be an internal employee or a contracted service. What the law requires is that the DPO's identity and contact details be disclosed clearly and publicly, normally on the company's website, in the privacy policy. If you have ever seen a website footer with a privacy contact email, that channel usually ends up with the DPO.

An important concern is independence. The DPO needs to have autonomy to raise problems without fear of retaliation and direct access to senior management. Putting the DPO under the very area that processes the most personal data, with no independence at all, is a recipe for the role to become decoration. It exists on the org chart, but it can't stop anything.

Internal or outsourced: the DPO as a Service model

There are two main hiring models. The internal DPO is a professional from the company itself, generally under the CLT regime (Brazil's formal employment regime), who takes on the role in addition to other duties or dedicates part of their time to it. The advantage is closeness to operations and deep knowledge of internal processes. The disadvantage is the cost and the difficulty of finding someone with the full profile.

The other model is DPO as a Service, or the outsourced DPO. A specialized company or independent professional takes on the role with responsibilities defined in a contract. This model has grown considerably among midsize companies that need to comply with the LGPD but don't have the volume to justify a full-time dedicated professional. The risk here is hiring an outsourced DPO who issues generic opinions and doesn't truly know the company's operation. PowerPoint compliance doesn't protect anyone.

Which tools support the DPO's work

The DPO doesn't live on common sense. They need tools that support the work. The foundation of it all is the personal data inventory, also called the RoPA, the record of processing activities. It is the map that answers where each piece of personal data is, what it is for, and under what legal basis it is processed.

In the market there are privacy platforms that help maintain this inventory, manage consent, and respond to data subject requests, such as OneTrust and similar solutions. On the governance side, catalog and mapping tools such as Collibra, Alation, and Microsoft Purview help locate and classify sensitive information inside systems. And this is where the link to master data comes in. Master Data Management platforms such as SAP Master Data Governance, Informatica, Stibo Systems, Reltio, Semarchy, Profisee, and Ataccama ensure that the customer master is unified and free of duplicates. Without that, the DPO is never sure they have located all the records of the same person. I mention these tools for information, because the choice depends on context. The right tool is the one that solves the real problem, not the trendiest one.

How to become a data protection officer

There is no mandatory degree to be a data protection officer. That is good news, because it opens the door to people with different profiles. I see three backgrounds that work well. Law professionals who understand the LGPD and regulation. Information security and IT professionals who understand risk and how data circulates in systems. And data governance and master record maintenance professionals, who already know from the inside where information lives and how it falls into disorder.

The study path involves mastering the LGPD in practice, understanding the GDPR as an international reference, and knowing the ANPD's resolutions. On the certification side, there are recognized options such as EXIN's data protection and privacy certifications, and IAPP's international certifications, such as CIPP and CIPM, aimed more at those who want to work in global environments. For those coming from the data side, DAMA's CDMP certification helps build the governance foundation that supports the protection work.

But no certification replaces the skill most lacking in this market: knowing how to translate. A good DPO takes a legal requirement and explains to the marketing team what it can and can't do, without paralyzing the business. They talk to the board in the language of risk and money, not in articles of law. Whoever only knows how to recite the law doesn't last. Whoever knows how to connect the law with operations and the business becomes indispensable.

How much they earn and what the opportunities are

Demand for data protection officers has grown along with ANPD enforcement and the fear of fines, which can reach millions. That pushed salaries up. In Brazil, a data protection officer's pay usually hovers around ten thousand reais a month and can reach double that, or more, in large companies and in senior positions with broad scope. Recent news reports already cite DPOs earning around sixteen thousand reais in prominent positions.

The amount varies by size, sector, and level of responsibility. More regulated sectors, such as finance, healthcare, and technology, tend to pay more because the risk is higher. Beyond the CLT model, there is the whole DPO as a Service market, which opens room for independents and consultancies to serve several companies at once. It is a career on the rise, with demand greater than the supply of truly prepared people. And the trend is for demand to keep growing, because data protection has stopped being one-off compliance and become a permanent topic for any company that handles information.

Main questions about the data protection officer

Are "encarregado" and DPO the same thing? Yes. Encarregado is the term used by the Brazilian LGPD. DPO, or Data Protection Officer, is the international term established by the European GDPR. In market practice, both names refer to the same role.

Does every company need a data protection officer? The general rule of the LGPD is that the controller appoints a DPO. Resolution CD/ANPD No. 18/2024 exempted small-scale processing agents, such as microenterprises and startups, from formal appointment, though they still need to maintain a communication channel with data subjects.

Can the DPO be outsourced? Yes. The role can be performed by an individual or a legal entity, internal or external. The outsourced DPO model is known as DPO as a Service and is widely used by midsize companies.

Does the DPO need to be a lawyer or from IT? There is no mandatory background. The ideal profile combines knowledge of the LGPD, a sense of risk, an understanding of how data circulates in systems, and above all, the ability to communicate with different areas of the company.

What is the difference between a DPO and a data steward? The DPO specifically takes care of compliance with personal data protection. The data steward takes care of data quality and standardization day to day, within a domain. The two roles support each other, but they are not the same thing.

MDM Academy: where governance underpins data protection

There is a point I want to make clear to anyone considering this career. The data protection officer doesn't work in a vacuum. They depend on a data governance foundation that most companies still don't have. And that is why MDM Academy exists.

MDM Academy is the governance and master data school of 4MDG, created to train the professionals the Brazilian market needs and can't find. We teach data governance, Master Data Management, data quality, material master and customer master, and the connection of all this with the LGPD, in practical language and with real project examples, not textbook theory. For someone who wants to be a DPO, understanding how data is organized, duplicated, and lost inside systems is what separates the professional who recites the law from the professional who solves the problem.

If that is the path you want to follow, get to know MDM Academy and join the Data Club. It is where we exchange knowledge, discuss real cases, and train the next generation of data professionals in Brazil.

Conclusion

The data protection officer is one of the most important roles the LGPD created and one of the most promising careers for those who like data, risk, and business at the same time. But the truth few people tell is that this professional is only as good as the data governance that exists underneath them. You can't protect what you can't find, and you can't trust what is duplicated and disorganized.

That is why, if you want to enter this field, don't study only the law. Study the data. Understand how it is born, how it spreads, and why it rots inside companies. That is the perspective that turns a DPO from an extra into a central piece. And that is the difference between complying with the LGPD on paper and truly protecting people's information.