Guidelines for the Personal Data Protection Officer

On August 11, 2026, the following were published in the Official Gazette: “Guidelines for the Personal Data Protection Officer”These guidelines, issued by the State Cybersecurity Agency (ACE), the competent authority for personal data protection, came into effect on August 20, 2026. However, the Legislative Assembly approved significant reforms to the Personal Data Protection Law (LPDP) that substantially modify the regulatory framework for the Personal Data Protection Officer.

Article 15 of the LPDP (Law on the Protection of Personal Data) established the obligation for obligated entities to appoint a Data Protection Officer. However, recent reforms have repealed Articles 15 and 17 of the LPDP, eliminating the general obligation to appoint an Officer for the private sector. According to the new Article 47, only public institutions retain the obligation to appoint a Data Protection Officer, who may be the same as the Information Officer of the corresponding institution.

Implications for the private sector

Following the implementation of the reforms, private sector entities subject to the law are no longer legally required to appoint a Data Protection Officer. However, the Guidelines issued by the ACE on August 11, 2026, remain in effect insofar as they do not contradict the reformed law. Therefore, companies that voluntarily choose to maintain or appoint a Data Protection Officer may use these guidelines as a reference for establishing their profile, functions, and operating procedures. The obligations related to processing ARCO-POL rights now fall directly on the obligated entities, in accordance with the amended Article 16 of the LPDP.

Obligations for public institutions

According to the new Article 47 of the LPDP, public institutions must appoint a data protection officer to oversee the exercise of the rights established by law. This officer may be the same person as the Information Officer of the relevant institution, which facilitates compliance with this obligation by allowing the same individual to perform both functions.

Who are the obligated parties under the LPDP?

In accordance with the amended Article 2 of the LPDP, all natural or legal persons, whether public or private, who carry out activities related to or connected with the processing of personal data, whether manually, partially or fully automated, or through third parties, are considered obligated parties. This includes those who carry out such activities without complying with the requirements and limitations established by law.

Profile of the Data Protection Officer (reference for voluntary or public sector appointments)

According to the Guidelines issued by the ACE (which can serve as a reference for public institutions and for those private entities that voluntarily decide to appoint a Delegate), to be appointed as a Delegate, the following is required at a minimum:

1. Have a university degree, preferably in Legal Sciences.
2. Be over 21 years old.
3. Demonstrate professional or work experience in personal data protection, risk management, regulatory compliance or cybersecurity.
4. Not having been convicted, by final judgment, for intentional crimes; nor having been sanctioned, by final resolution, for violations of the LPDP.
5. Submit to and pass the “Personal Data Protection Officer Certification Program” issued by the ACE.

Formalities for the appointment of the Delegate (reference for voluntary or public sector appointments)

1. In the case of legal entities, the appointment must be recorded in the minutes of the Board of Directors, the Sole Administrator or the highest authority that corresponds.
2. In the case of natural persons, the appointment must be recorded in a document with a signature legalized by a notary or with a certified electronic signature.
3. The appointment must include the Delegate's details, the start date of their duties, and their powers.
4. The appointment must be notified to the Delegate within 3 business days following its designation.
5. Prior to accepting the position, the Delegate must sign a sworn statement regarding the existence or non-existence of conflicts of interest.

Delegate Modalities (reference for voluntary or public sector appointments)

1. It can be internal or external.
2. It can be a natural person or a legal entity.
3. A foreign Delegate may be appointed.
4. Groups of related companies may share the same Delegate.
5. More than one Delegate may be appointed, as well as substitute Delegates.

Powers, independence and prohibitions of the Delegate (reference for voluntary or public sector appointments)

In accordance with the ACE Guidelines, the Delegate is responsible for managing and processing requests to exercise ARCO-POL rights. It is important to note that, following the reforms, Article 16 of the LPDP establishes that the obligations related to processing ARCO-POL rights fall directly on the obligated entities, who must assist and guide their departments or suppliers and establish internal guidelines for the efficient management of these requests. The Delegate acts with autonomy and functional independence and reports directly to the highest level of management of the data controller. They cannot represent the data controller before the ACE nor make decisions regarding the purposes or means of data processing. ARCO-POL rights requests must be resolved within 20 business days, with the possibility of an extension of another 20 business days for justified reasons. The Delegate maintains a duty of confidentiality that remains in effect even 5 years after leaving office.

Termination, replacement and continuing training (reference for voluntary or public sector appointments)

The Data Protection Officer's profile must be reviewed at least every three years. In the event of resignation, death, or any other cause of termination, a new Data Protection Officer must be appointed within 10 business days of the event. Furthermore, the Data Protection Officer must receive training on personal data protection at least once a year.

Update Note: This article was originally published on September 11, 2026. It has been updated on September 29, 2026 to reflect the reforms to the Personal Data Protection Act.