- Asian Investment Desk
- Banking and Finance
- Banking Regulation
- Capital Markets
- Corporate and Commercial
- Corporate Compliance
- Energy
- Environmental
- ESG | Environmental, Social and Governance
- Fintech
- Fishery
- Forestry
- Immigration
- Infrastructure and Concessions
- Insurance and Reinsurance
- Intellectual Property
- International Trade and Customs
- Labor & Employment
- Life Sciences
- Maritime and Aviation
- Mergers and Acquisitions
- Mining
- Oil & Gas
- Privacy and Data Protection
- Project Development
- Project Finance
- Public Law
- Public Procurement
- Public Services Regulation
- Real Estate Investment
- Restructuring and Insolvency
- Tax
- Telecom, Media & Technology (TMT)
- Venture Capital and Entrepreneurship
- Water Resources and Sanitation
- Wealth Management
Privacy and Data Protection Alert - January 2026
For more information, contact:
Themes
DIRECTIVE ON THE APPOINTMENT AND FUNCTIONS OF THE DATA PROTECTION OFFICER
On December 31, 2025, the Directive establishing the provisions for the appointment, performance, and functions of the Data Protection Officer (the “Directive”) was published.
As a reminder, the Data Protection Officer is the person appointed by a company to verify, advise on, and implement compliance with the legal framework for the protection of personal data.
The Regulations of the Personal Data Protection Law stipulated the obligation to appoint a Data Protection Officer when a company: (i) processes large volumes of personal data; and/or (ii) carries out core business activities that involve the processing of sensitive data.
However, until the publication of the Directive, the National Data Protection Authority had not issued criteria for determining whether a company was required to appoint a Data Protection Officer. In this regard, the Directive fills this gap and establishes the following:
- The Directive establishes the criteria for determining whether a company is required to appoint a Data Protection Officer. These criteria include: (i) the number of data subjects; (ii) the type and sensitivity of the data; (iii) the purpose of the processing and associated risks; (iv) the frequency, duration, and continuity of the processing; and (v) the geographical scope of the processing.
- The Directive also establishes the mechanism by which the company must appoint the Data Protection Officer, as well as the requirements that must be met for a person to be appointed as such. It includes criteria for determining whether the person appointed as Data Protection Officer has knowledge and experience in personal data protection, as well as how to demonstrate this knowledge and experience.
- Finally, the Directive establishes the minimum content of the communication that the company must send to the National Data Protection Authority to inform it of the appointment of the Data Protection Officer. It also establishes that the Data Protection Officer must be accessible to the competent authority and specifies the minimum information about the Data Protection Officer that the company must make public after their appointment.