Under Brazil's General Data Protection Law (LGPD), the controller is the person or organisation that makes the decisions about processing personal data, and the processor is the one that processes it on the controller's behalf. Both are "processing agents", both keep records, and both can be ordered to pay compensation. A processor shares liability with the controller when it breaks data protection law or ignores the controller's lawful instructions.
The definitions sit in Article 5 of the LGPD's official text, and the duties and liability rules in Articles 37 to 45. Roles are assigned per operation, not per company: the ANPD (Agência Nacional de Proteção de Dados, Brazil's data protection authority) says in its guide on processing agents that the same organisation can be a controller for one operation and a processor for another.
The controller decides and the processor follows instructions
Article 5(VI) defines the controller as the natural or legal person, public or private, responsible for decisions about the processing of personal data. Article 5(VII) defines the processor as the natural or legal person that processes personal data on the controller's behalf.
The ANPD's guide adds two practical points. Employees are neither controllers nor processors, because they act under their employer's direction, so in a company the organisation itself is the processing agent. A processor may decide non-essential details of how it works, but not the purpose or the essential elements of the processing.
| Question | Controller | Processor |
|---|---|---|
| Who decides purpose and essential means? | Yes (Article 5(VI)) | No, it acts on the controller's behalf (Article 5(VII)) |
| Follows instructions? | Gives them and checks they are followed | Must follow them (Article 39) |
| Keeps records of processing? | Yes (Article 37) | Yes (Article 37) |
| Appoints a DPO (encarregado)? | Yes (Article 41), unless exempt as a small processing agent | Not required by Article 41 |
| Notifies security incidents to the ANPD? | Yes (Article 48) | No, the duty is the controller's |
| Liable for damages? | Yes (Article 42) | Yes, jointly with the controller when it breaks the law or its instructions |
What this looks like on a website
Take an online shop. The shop decides to collect customer details to sell and deliver goods, so it is the controller. The hosting company, the email delivery service and a support desk tool that store or send that data only to run the shop's service act as processors.
That changes when a vendor uses the data for its own purposes. A third party whose tag collects visitor data and then uses it to build its own advertising profiles is deciding a purpose of its own, and for that processing it acts as a controller rather than a processor. Contracts, consent and the cookie banner have to reflect which role each vendor plays, and the GDPR version of the same distinction is set out in data controller vs processor under the GDPR.
Both roles keep records, only one answers for the purpose
Article 37 requires the controller and the processor to maintain records of the personal data processing operations they carry out, especially when processing is based on legitimate interest.
The controller carries the heavier load. Under Article 38, the ANPD can order a controller to prepare a data protection impact assessment report, including on sensitive data, describing the types of data collected, the collection and security methods, and the safeguards and risk mitigation measures adopted. Under Article 39, the processor processes according to the controller's instructions, and the controller checks that its own instructions and the law are followed.
Who must appoint a DPO
Article 41 requires the controller to appoint a data protection officer, called the encarregado. The officer's identity and contact details must be published clearly and objectively, preferably on the controller's website. The encarregado receives complaints and communications from data subjects, takes communications from the ANPD, guides staff and contractors on data protection practice and carries out other tasks the controller or the rules assign.
There is an exemption. Article 11 of Resolution CD/ANPD No. 2/2022 frees small processing agents (micro and small businesses, startups and similar entities) from appointing one, as long as they offer a communication channel for data subjects instead. The exemption does not apply to small agents that carry out high-risk processing or exceed the revenue limits. The officer's role is now set out in more detail in Resolution CD/ANPD No. 18 of 16 July 2024, the regulation on the encarregado's work.
A processor shares liability when it breaks the rules
Article 42 makes the controller or processor that causes material, moral, individual or collective damage to others, in breach of data protection law, liable to compensate for it. To make sure the data subject is compensated, Article 42(1) adds two forms of joint liability:
- A processor is jointly liable for damage caused by the processing when it fails to meet its obligations under data protection law or does not follow the controller's lawful instructions. In those cases it is treated as a controller.
- Controllers directly involved in the processing that caused the damage are jointly liable with each other.
Whoever pays compensation can recover it from the others in proportion to their part in the damage (Article 42(4)). In a civil case, a judge may reverse the burden of proof in favour of the data subject when the claim seems credible, when the data subject lacks the means to produce evidence, or when producing it would be excessively burdensome (Article 42(2)). Collective claims are possible too (Article 42(3)).
Consumer cases add another layer. Article 45 keeps the liability rules of consumer law in place for breaches of data subjects' rights in consumer relationships, which in Brazil means the Consumer Defence Code.
Three defences and the security rule
Article 43 lets a processing agent avoid liability only by proving one of three things:
- It did not carry out the processing attributed to it.
- It carried out the processing, but did not break data protection law.
- The damage was caused only by the data subject or a third party.
Security is where liability most often lands. Under Article 44, processing is irregular when it breaks the law or does not provide the security the data subject can expect, judged by how it is done, the results and risks reasonably expected, and the techniques available at the time. A controller or processor that causes damage by failing to adopt the security measures in Article 46 is liable for it. After an incident, the controller also has its own deadline to meet, covered in LGPD data breach notification. Brazil's rules sit alongside others on the privacy laws by region overview.
Questions about LGPD controllers and processors
Can a processor be held jointly liable under the LGPD?
Yes. Under Article 42(1)(I), a processor is jointly liable for the damage when it fails to meet its data protection obligations or does not follow the controller's lawful instructions, and in those cases it is treated as a controller.
Who is required to appoint a data protection officer?
The controller, under Article 41, and its contact details must be published, preferably on its website. Small processing agents without high-risk processing are exempt under Resolution CD/ANPD No. 2/2022 but must offer a communication channel for data subjects.
Are controllers and processors required to keep records?
Yes. Article 37 requires both to keep records of the processing operations they carry out, especially when the processing is based on legitimate interest.
When can the burden of proof be reversed?
A judge in a civil case may reverse it in favour of the data subject when the claim seems credible, when the data subject lacks the means to produce evidence, or when producing evidence would be excessively burdensome for them (Article 42(2)).
Can one company be both a controller and a processor?
Yes. The ANPD's guide on processing agents says roles are defined per processing operation, so the same organisation can be a controller for its own customer data and a processor for data it handles for a client.
List the third parties your website sends data to
Every vendor on your pages is either your processor or a controller in its own right, and you cannot sort them until you know who they are. Kukie.io's free Script audit lists the third-party domains one page loads, the service and category behind each and whether it sets cookies before a choice.
