What should teams do about Controller Operator and DPO Roles under the Brazil LGPD?
The binding definitions are in LGPD Article 5, with operational duties in Articles 37 to 42. ANPD guidance explains how the Agency applies those definitions but does not replace the statute. Start with one processing purpose, identify who decides that purpose and the essential elements of the operation, then identify who acts on whose documented instructions.
A can be a natural person or a legal entity. More than one party may be a controller when each makes relevant decisions; the ANPD guide treats joint control as a fact-specific situation in which multiple controllers have common, convergent, or complementary decisions and influence the purposes and essential elements. Shared infrastructure or commercial cooperation alone does not settle the result.
An must act on behalf of a . A payroll provider may be an operator for calculating salaries under the employer's instructions, for example, but may be a controller for a separate purpose it determines itself. Employees, directors, and teams acting under the organization's direct authority are part of that organization rather than separate operators for routine internal work.
The is a channel and adviser, not the owner of the business purpose or legal-basis decision. LGPD Article 41 assigns the the appointment and publication duties, while the current Article 5 definition and ANPD rules frame the role as the channel for the processing agent. Record which entity made the formal appointment and which processing activities and entities the appointment covers.
- : approve the purpose, legal basis, essential processing design, transparency, retention, recipients, rights response, instructions, and any reportable-incident decision.
- : document the , instructions, permitted purpose, data and people covered, security measures, suboperator conditions, assistance duties, audit evidence, and return, deletion, or lawful retention at the end.
- : maintain a clear public contact channel, accept complaints and ANPD communications, route action to the accountable owner, guide employees and contractors, and retain the appointment and activity records.
- Reassess the map when a party starts reusing data for its own purpose, chooses new essential processing elements, appoints a suboperator, changes the affected , or materially changes the service.
Citations (3)
- LEI Nº 13.709, DE 14 DE AGOSTO DE 2018
LGPD Article 5 defines controller, operator, DPO, and processing-agent roles and anchors the role evidence record.
controlador: pessoa natural ou jurídica, de direito público ou privado, a quem competem as decisões referentes ao tratamento de dados pessoais
- ANPD Guia orientativo sobre atuação do encarregado
ANPD guidance supports the operational duties and escalation route for the encarregado role.
- Resolução CD/ANPD nº 18, de 16 de julho de 2024
The binding ANPD regulation establishes appointment, disclosure, activity, autonomy, resource, and conflict-of-interest rules for the encarregado.