The agent who decides on the processing of personal data and is responsible for it before the data subjects and the ANPD (National Data Protection Authority).
The controller is the natural or legal person, governed by public or private law, who is responsible for decisions regarding the processing of personal data: what to collect, for what purpose, for how long, and with whom to share it.
The company that maintains the customer database, the hospital that keeps medical records, and the public agency that manages a benefit are all controllers. When two organizations jointly decide on the same treatment, there is joint controllership.
Article 5, VI, of LGPD The law defines the controller, and Article 37 obligates both the controller and the operator to maintain records of data processing operations. The controller appoints the data protection officer (Article 41), prepares the impact assessment report when required (Article 38), reports incidents to the ANPD (Article 48), and is liable for damages caused (Article 42). The ANPD detailed the roles of the agents in its guidance document on data processing agents and data protection officers, available at [link to guidance document]. ANPD website.
No Data Mapping Each activity records the role of the organization (controller, operator, or joint controller) and the third parties involved; Third Party Risk Management evaluates the contracted operators.
Operator · Person in Charge (DPO) · ROPA · Data subject · Back to glossary
Updated .
Request a demo and see how... Privacy Tools It organizes mapping, legal bases, rights holder applications, and evidence all in one place.
