What is a data operator?

Definition

An operator is a natural or legal person, governed by public or private law, who processes personal data on behalf of the controller, without deciding on the essential purposes and means of such processing.

Cloud providers, payroll companies, third-party call centers, email marketing platforms, and laboratories that process tests for a hospital are typical operators.

What does the LGPD say?

Article 5, VII, of LGPD The operator is defined. Article 39 stipulates that the operator must carry out the processing according to the controller's instructions, who verifies compliance with them. Article 42, § 1, I, holds the operator jointly liable when it fails to comply with the law or the controller's lawful instructions. The operator must also maintain a record of operations (Article 37) and report incidents to the controller.

In practice

• Hire operators with data protection clauses covering purpose, security, subcontracting, incidents, and data return.
• Evaluate the operator before and during the contract, using questionnaires and evidence.
• Record in ROPA which operators participate in each activity.
• If the provider starts making decisions about the data, it ceases to be an operator and becomes a controller.

How Privacy Tools it deals with the topic

A Third Party Risk Management It registers operators, applies assessments, and monitors the risk of each contract; Data Mapping It links operators to treatment activities.

Related terms

Controller · International data transfer · ROPA · Security incident · Back to glossary

Updated October 3th, 2026.