Controller and processor obligations
Two roles, one chain
Controlador decides the purposes and means of processing; operador processes on the controller's behalf. The label drives liability, so the exam tests borderline cases: a processor that sets its own purposes, or ignores lawful instructions, is equated to a controller for that processing.
Duties you can be examined on
- Records of processing (Art. 37) - controllers and processors must keep them, especially for processing based on legitimate interest.
- Impact assessment / RIPD (Art. 38) - the ANPD may require it, notably for high-risk processing and for legitimate interest (Art. 10).
- Instructions (Art. 39) - the processor must follow the controller's lawful instructions and the law.
- Security (Arts. 46–49) - technical and administrative measures, access control, traceability; the duty can be waived only by law.
- Retention and elimination (Art. 16), principles (Art. 6), international transfers only through Article 33 mechanisms, and governance (Art. 50): privacy by design, policies, training, incident response.
Liability
A controller or processor causing material, moral, individual or collective damage in breach of the law must repair it, with the court able to invert the burden of proof (Art. 42). They answer individually or jointly and escape liability only by proving they did not process the data, that no violation occurred, or that the damage came exclusively from the data subject or a third party. A processor is jointly liable when it breaches the law or disobeys lawful instructions, and is then equated to a controller unless the controller was exclusively at fault.
Worked example
An employer uses a payroll SaaS vendor. The employer is the controller; the vendor is the processor. If the vendor repurposes the payroll database to train its own analytics product, it exceeds instructions, becomes a controller for that use, and is jointly liable for resulting damage. A signed contract does not neutralise that outcome.
Traps
- Believing a DPA transfers the controller's liability to the processor.
- Believing the processor can never be liable.
- Skipping records of processing because 'we are too small' - the small-agent regime relaxes format, not the underlying duty.
- Treating the RIPD as a document needed only after an incident.
- Forgetting that joint liability lets the data subject sue either party.