{"id":989734,"date":"2026-09-01T18:30:41","date_gmt":"2026-09-01T18:30:41","guid":{"rendered":"https:\/\/legalspotsv.com\/?p=989734"},"modified":"2026-10-19T20:02:02","modified_gmt":"2026-10-19T20:02:02","slug":"data-protection-officer-duties-guidelines","status":"publish","type":"post","link":"https:\/\/legalspotsv.com\/en\/el-delegado-de-proteccion-de-datos-importancia-funciones-y-nuevos-lineamientos\/","title":{"rendered":"The Data Protection Officer: Importance, Duties and New Guidelines"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In the business world, information has become a valuable asset. Data consists of <\/span>intangible assets<\/b>: They have no physical form, but they have value; they can be stored, transmitted, processed, and analyzed, and based on them, we can make decisions that are critical to our companies. <\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Although the 2024 Act already established the requirement for its appointment, the new guidelines issued by the State Cybersecurity Agency (ACE) and published in the Official Gazette on August 11, 2026, elaborate on fundamental aspects of their operation, including their profile, requirements, appointment, certification, and powers. This represents the implementation of the data protection provisions set forth in the Personal Data Protection Act (LPDP). <\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In light of these new guidelines, the following questions arise: <\/span>Who is subject to these obligations? Is my company subject to this new obligation?<\/b>\u00a0 It's time to answer these questions: From the moment a company engages in data processing, which is understood to mean<\/span> any operation or activity performed on personal data<\/b>, from the time they are collected until they are disposed of. This provision is governed by Article 2 of the LPDP, which establishes its framework of application.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Any operation that collects, stores, or uses information that can identify an individual constitutes a <\/span>processing of personal data<\/b>. This includes actions such as <\/span>collect, record, organize, store, access, use, modify, share, transfer, block, or delete<\/b> information about a person. In the day-to-day operations of businesses, it r<\/span>ecopila collects a customer's name, DUI, phone number, and email address, as well as employment or medical records, purchase histories, and contracts of any kind, and subsequently uses this information to provide a service or contact the customer<\/b>. This is why it is essential to appoint a Data Protection Officer (DPO) in your companies or organizations.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Now that this point has been clarified, the following question arises: \u00bf<\/span>What does a delegate do?<\/b> The Data Protection Officer (DPO) oversees and guides an organization to ensure that the processing of personal data is carried out in accordance with the law, identifying risks, promoting protective measures, and serving as a liaison on data protection matters. And under the new guidelines, the DPO acts as a liaison between your organization and the ACE.\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Who can be a delegate?<\/b><\/h3>

<\/b>The Guidelines establish requirements regarding the delegate's profile, which are as follows:\u00a0<\/span><\/p>

A) Hold a college degree, preferably in legal studies.\u00a0<\/span><\/p>

B) Be at least 21 years old\u00a0<\/span><\/p>

C) Demonstrate professional or work experience in data protection, administrative procedures, regulatory compliance, risk management, information technology, information security, or cybersecurity.\u00a0\u00a0<\/span><\/p>

D) Have no final, non-appealable criminal convictions.\u00a0<\/span><\/p>

E) Approve the \u00abPersonal Data Protection Officer Certification Program\u00bb to be implemented by the ACE<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The appointment must be made by resolution of the organization\u2019s highest authority and must be reported by the person in charge to the Agency\u2019s Office of Personal Data Protection. The deadline for reporting this appointment is September 17 of this year; failure to report the appointment may result in a violation.\u00a0<\/span><\/p>

\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

At Legal Spot, we are ready to help you comply with these new regulations and assist you in implementing data protection policies and procedures, assessing regulatory compliance, adapting internal processes, and providing guidance on the appointment and duties of the Data Protection Officer.<\/b><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

Actualizaci\u00f3n (septiembre de 2026): el 17 de septiembre de 2026 la Asamblea Legislativa reform\u00f3 la Ley para la Protecci\u00f3n de Datos Personales y elimin\u00f3 la obligaci\u00f3n de las empresas privadas de nombrar un delegado de protecci\u00f3n de datos. Las instituciones p\u00fablicas s\u00ed deben mantenerlo. La ACE tambi\u00e9n dej\u00f3 sin efecto la fecha l\u00edmite de nombramiento….<\/p>","protected":false},"author":1,"featured_media":989901,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,56],"tags":[],"class_list":["post-989734","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-articulos","category-articulos-de-opinion"],"_links":{"self":[{"href":"https:\/\/legalspotsv.com\/en\/wp-json\/wp\/v2\/posts\/989734","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/legalspotsv.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/legalspotsv.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/legalspotsv.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/legalspotsv.com\/en\/wp-json\/wp\/v2\/comments?post=989734"}],"version-history":[{"count":12,"href":"https:\/\/legalspotsv.com\/en\/wp-json\/wp\/v2\/posts\/989734\/revisions"}],"predecessor-version":[{"id":990781,"href":"https:\/\/legalspotsv.com\/en\/wp-json\/wp\/v2\/posts\/989734\/revisions\/990781"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/legalspotsv.com\/en\/wp-json\/wp\/v2\/media\/989901"}],"wp:attachment":[{"href":"https:\/\/legalspotsv.com\/en\/wp-json\/wp\/v2\/media?parent=989734"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/legalspotsv.com\/en\/wp-json\/wp\/v2\/categories?post=989734"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/legalspotsv.com\/en\/wp-json\/wp\/v2\/tags?post=989734"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}