Controller vs Operator Under LGPD: A Practical Business Guide

The Legal Definitions

Article 39 adds the central operator rule: the operator must process personal data according to the controller's instructions, while the controller verifies compliance with its instructions and applicable rules.

Roles Are Defined Per Processing Operation

This is probably the most important point in ANPD's guidance. The Agency says processing-agent status should be assessed for each personal-data processing operation.

The same organization can therefore be:

This is why a global statement such as: “Vendor X is our processor” can be incomplete.

A better record says:

“Vendor X acts as operator for Activity A and as controller for Activity B.”

Contract labels are not conclusive

A contract can help demonstrate the intended relationship and establish instructions, but calling a company “processor,” “service provider” or “operator” does not override what the company actually does.

If a party independently decides to use the data for a new purpose, it may become a controller for that separate processing even if the contract still calls it an operator.

Which Decisions Belong to the Controller?

ANPD distinguishes between essential and non-essential processing decisions. The controller does not need to make every technical choice. It must, however, retain influence over the essential elements.

Who determines the legal basis?

For controller-directed processing, the controller should determine and document the legal basis for its purpose. The operator should understand the instructions and avoid using the data outside that framework.

If the operator separately processes data for its own independent purpose, it needs its own controller analysis, including purpose, legal basis, transparency, retention and rights obligations for that separate processing.

Are Employees Operators?

Usually not when they act as part of the legal entity and under its authority. ANPD explains that, in the context of a legal entity, the organization itself is generally the processing agent because it establishes the processing rules that representatives, employees or agents execute.

Employees, administrators, partners, public servants and other people whose actions express the organization's activity should not normally be classified as separate operators merely because they touch personal data.

What Is Joint Controllership Under the LGPD?

The LGPD does not expressly define “joint controller.” ANPD nevertheless considers joint controllership implicitly recognized in the Brazilian framework, including through Article 42's liability structure.

ANPD defines joint controllership as the joint, common or convergent determination by two or more controllers of the purposes and essential elements of personal-data processing, through an arrangement that establishes their respective LGPD responsibilities.

ANPD's three practical criteria

Joint controller vs independent controllers

Two companies sharing personal data are not automatically joint controllers. They may be independent controllers where each separately determines its own purpose and essential means.

Example: a retailer sends shipping information to an independent carrier. Depending on the actual facts, the carrier may process some information for its own regulatory and transport purposes rather than merely following the retailer's instructions. That can produce separate-controller analysis instead of a classic controller-operator relationship.

Role classification should therefore be based on the real decisions made by each party, not a generic rule that every supplier is an operator.

What Is a Suboperator?

The LGPD itself does not expressly define the term suboperator. ANPD uses it as a practical concept for complex processing chains.

A suboperator is a party hired by the operator to assist it in processing personal data on behalf of the controller. Its direct contractual relationship is normally with the operator rather than the controller.

ANPD recommends that the operator obtain formal authorization from the controller before engaging a suboperator. The authorization may be specific or general and can be included in the controller-operator contract.

What should a subprocessor clause address?

A practical clause should address:

• whether authorization is specific or general;
• how new subprocessors are notified;
• which processing they perform;
• security requirements;
• confidentiality;
• data-subject-rights support;
• incident escalation;
• retention/deletion;
• international-transfer requirements; and
• how downstream obligations are imposed contractually.

For international transfers, Resolution 19/2024 also contains its own “subcontracted party” concept within the Brazilian SCC framework. That transfer-specific term should not be casually treated as identical to every domestic suboperator scenario without examining the applicable instrument.

Practical Business Examples

1. SaaS platform

A Brazilian retailer uses a U.S. CRM SaaS to store customer names, email addresses and support history. The retailer determines why those customer records exist and how they will be used for its customer relationship. The SaaS follows those instructions.

Likely starting point: retailer = controller; SaaS = operator for the hosted customer data.

If the SaaS separately uses account-admin contact details to manage its own billing, fraud controls or legal compliance, it may act as controller for those separate activities.

2. Cloud infrastructure provider

A software company hosts its database with a cloud provider. The software company defines the product purpose, customer data and retention. The cloud provider chooses technical infrastructure, redundancy and security implementation.

Likely starting point: software company = controller or operator depending on its customer relationship; cloud provider = operator/suboperator for the hosted processing.

The cloud provider does not become controller merely because it chooses technical equipment or security mechanisms.

3. Payroll provider

An employer sends employee payroll data to an outsourced payroll company that calculates payroll according to the employer's instructions.

Likely starting point: employer = controller; payroll vendor = operator for payroll execution.

If the payroll provider has separate legal obligations involving records it must independently maintain, those separate activities may require a different role analysis.

4. Marketing agency

A company gives an agency a customer list and detailed campaign instructions. The agency configures ad platforms and creative execution for the company's campaign.

Possible structure: company = controller; agency = operator for the directed campaign.

But if the agency takes that list and independently builds its own cross-client audience product, that independent reuse can move the agency into a controller role for that new purpose.

5. Analytics platform

A website sends user events to an analytics vendor. Whether the vendor is only an operator depends on what it does with the events.

If it processes solely to provide customer-directed analytics, operator status can fit. If it independently combines data across customers for its own advertising or profiling purposes, controller analysis becomes relevant for that separate use.

6. Payment provider

A merchant transmits payment information to a payment service. It is unsafe to assume every payment provider is simply an operator.

Payment companies may have independent anti-fraud, regulatory, anti-money-laundering, accounting or network obligations. The actual role can differ by processing purpose.

7. Recruiting agency

If an employer instructs a recruiter to source candidates under tightly defined criteria and process applications for the employer's hiring purpose, an operator relationship may exist for some activities.

If the recruiter independently maintains a candidate database for its own future placements across clients, it may be controller for that separate database.

8. AI service provider

A company sends customer-support tickets to an AI provider only to generate summaries. If the AI provider processes strictly under instructions and does not reuse the data for its own model development, operator analysis can fit.

If the provider independently uses prompts or outputs for model training, benchmarking or other product-development purposes, that separate purpose must be classified independently.

Does the LGPD Require a DPA?

The LGPD does not contain a GDPR Article 28-style provision saying that every controller-operator relationship must have a contract with a fixed statutory field list.

ANPD nevertheless treats a written contract as a good practice. Its guidance explains that contractual clauses can limit the operator's actions, objectively allocate responsibilities and reduce uncertainty.

ANPD identifies useful contract topics including:

• object of processing;
• duration;
• nature of processing;
• purpose;
• types of personal data;
• rights and obligations; and
• responsibilities related to LGPD compliance.

A practical LGPD DPA should usually go further

How the Role Changes Operational Obligations

ROPA applies to both

Article 37 expressly requires both controllers and operators to maintain records of processing operations, especially where legitimate interest is used.

An operator's ROPA should not be a copy of the controller's register. It should reflect the systems, suboperators, locations, access, retention and processing the operator actually performs.

See LGPD ROPA: How to Build a Record of Processing Activities.

Incident responsibilities are different

Under Resolution 15/2024, the controller is responsible for external communication to ANPD and affected data subjects when the reportability threshold is met. The operator must notify the controller without unjustified delay and provide the information needed for assessment.

This is why incident clauses should require vendor escalation well before the controller's external three-business-day deadline.

See LGPD Data Breach Notification.

DPO / encarregado treatment also differs

Current ANPD guidance under the encarregado regulation says controller appointment is generally mandatory, while operator appointment is optional and can be treated as a good practice, subject to applicable small-agent exemptions and other specific rules.

See Does Your Company Need an LGPD DPO?.

Controller and Operator Liability

Role classification matters because liability is not identical.

Article 42 provides that an operator can be jointly liable for damage caused by processing when it fails to comply with data-protection legislation or fails to follow the controller's lawful instructions, subject to the statutory exclusions in Article 43.

Article 42 also provides joint liability among controllers directly involved in processing that causes damage, again subject to Article 43.

What if the operator acts outside instructions?

If a vendor takes customer data and uses it for an independently chosen purpose, that conduct can change the role analysis for that processing. ANPD guidance treats a party that exercises essential decision-making power as controller for the relevant activity.

The compliance response should therefore do more than say: “the processor breached the DPA.” It should assess whether the vendor has become a controller for the unauthorized purpose and what separate transparency, legal-basis, rights, retention and liability consequences follow.

A Five-Question Role Classification Test

Common Controller / Operator Mistakes

“Every vendor is an operator.”

Incorrect. Some vendors independently determine their own purposes and can be separate controllers for those activities.

“If the vendor chooses technology, it is a controller.”

Incorrect. ANPD allows operators to make non-essential technical decisions such as software/equipment selection and detailed security implementation.

“Our employee is our operator.”

Usually incorrect where the employee acts as part of and under the authority of the legal entity.

“The DPA decides the role.”

No. The DPA documents and governs the relationship, but factual decision-making power determines classification.

“Joint controller means two companies touched the same data.”

Too broad. ANPD looks for joint/common/convergent determination of purpose and essential elements plus mutual interests and decision-making power.

“Operator means no liability.”

Incorrect. Operators have direct duties and can face joint liability in the situations described by Article 42.

“Subprocessors are the vendor's problem.”

Too simplistic. ANPD recommends formal controller authorization for suboperator engagement, and downstream processing should be contractually and operationally governed.

20-Point Controller vs Operator Review