Brazil LGPD Controller Operator and DPO Roles

Classify each purpose and relationship from actual conduct. A controller decides why personal data is processed and the essential elements of that processing. An operator acts on the controller's behalf and must follow the controller's lawful instructions. A supplier can be an operator for one activity and a controller for another if it determines a separate purpose.

The encarregado is not a third processing agent. The LGPD's Article 5 definition, amended by Law 15,352 on 25 February 2026, describes the encarregado as a person designated by the controller and operator to serve as the communication channel among the controller, data subjects, and the ANPD. Article 41 continues to state the controller's appointment duty, while Resolution 18/2024 makes operator appointment optional and treats it as a governance practice.

The controller owns the legal basis and purpose, transparency, data-subject responses, RIPD decision, transfer mechanism verification, operator instructions, and reportable-incident notifications. Operators must process within lawful instructions, maintain their own Article 37 records, assist with information in their control, apply security, and escalate incidents without unjustified delay.

Resolution 18 requires a formal written, dated, signed encarregado designation and a formally designated substitute for absences, impediments, or vacancies. The agent must publish and keep current the encarregado's identity and contact information, provide resources and technical autonomy, enable direct access to senior decision-makers, and maintain effective routes for data subjects and ANPD communications.

A service provider that uses customer data for its own independent purpose may be a controller for that use even if the main service contract calls it an operator. An operator that processes contrary to lawful controller instructions can be treated like a controller for liability arising from that processing under Article 42(1). This is a fact-specific liability rule, not an automatic reclassification of every operator activity.

An encarregado may be a natural person or legal entity and may be internal or external. The function needs technical autonomy and must avoid conflicts that impair objective judgment. The encarregado advises and assists, but Resolution 18 states that these activities do not transfer responsibility for the processing agent's legal compliance to the encarregado.

Employees and internal departments that act for the same legal entity are not separate operators merely because they handle data. By contrast, an external call centre following the customer's purposes and instructions is a typical operator. A cloud provider hired by that operator can be a sub-operator; the ANPD guide recommends formal controller authorisation for that subcontracting.

Produce a role matrix for each purpose showing the decision-maker, instructed processor, sub-operator, system owner, rights owner, security owner, transfer owner, incident escalation route, encarregado channel, evidence owner, and reassessment trigger.

Translate the matrix into contracts and procedures. State permitted processing, documented instructions, confidentiality, security, sub-operator conditions, assistance, incident escalation, rights support, transfer restrictions, audit evidence, retention, return or deletion, and change control.