Data Controller vs Processor in an AI Vendor Contract (LGPD)

Data Controller vs Processor in an AI Vendor Contract (LGPD)

Under LGPD, Brazil's data protection law, the controller decides why and how personal data is processed, and the processor handles that data on the controller's behalf, following its instructions. In a data controller vs processor AI vendor contract, your company is usually the controller and the vendor is the processor. That framing only holds if the contract says so clearly and the vendor does not use the data for its own purposes.

Key takeaways

• The controller decides the purpose and means of processing. The processor acts on the controller's behalf and must follow its lawful instructions.
• The role does not depend on the label in the contract. It depends on who actually decides what happens to the data.
• If an AI vendor uses your data to train or improve its own products, it may be acting as a controller for that part of the processing.
• Liability toward data subjects and the ANPD (Brazil's data protection authority) can reach both sides, so the clauses need to distribute duties and evidence.
• Each role calls for different clauses: the controller needs limits, audit rights and deadlines, and the processor needs documented instructions and a defined scope.

How LGPD defines controller and processor

The law defines the controller as the person or company responsible for decisions about the processing of personal data. It defines the processor as the one who carries out processing on the controller's behalf. The definitions are in Article 5 of LGPD, and Article 39 requires the processor to process data according to the instructions given by the controller.

In practice, one question separates the two roles: who decides the purpose? If your company decides that an AI agent will answer customer questions on WhatsApp, and the vendor only supplies the model, the platform and the infrastructure, the decision is yours. The vendor executes.

The law also provides for the data protection officer (encarregado in Portuguese), the person who acts as the bridge between the controller, data subjects and the ANPD. The controller appoints this person. The role does not replace the contract, but this is who should be able to answer questions about the processing when a data subject or the authority asks.

This article organizes concepts for people who decide and buy. It does not replace review by your legal team or a data protection lawyer for your specific case.

When an AI vendor is a processor and when it stops being one

The most common setup is this: a company hires an AI platform or agent, sends it customer or employee data, and the vendor processes that data to deliver the contracted service. In that setup the vendor is a processor.

The classification changes when the vendor starts deciding about the data on its own. Some signs that it may be acting as a controller for part of the processing:

• It uses the conversations or documents you send to train or improve models that serve other customers.
• It keeps data for its own retention period, and you cannot set or bring forward deletion.
• It shares the data with third parties for purposes you did not define.
• It combines your data with other customers' data to build profiles or products.

In these cases the vendor has a purpose of its own. That does not make the use automatically unlawful, but it changes who needs a legal basis, who informs the data subject and who answers for that part. If you do not want this scenario, the contract must expressly prohibit it.

There is also the supply chain. The vendor you hire often uses another provider for the language model, another for hosting and another for the messaging layer. In market practice these parties are called subprocessors (suboperadores in Portuguese). The law does not need to use that term for your contract to regulate the chain. What matters is knowing who they are, where they process data and under which rules.

Who answers for what

Article 42 of LGPD covers compensation for damages. In general terms, the controller and the processor who cause harm to another person because of data processing are liable for repairing it. The processor is jointly liable when it fails to meet its legal obligations or does not follow the controller's lawful instructions. Controllers directly involved in the processing that caused the damage are also jointly liable.

What this means for the buyer:

• Outsourcing processing to an AI vendor does not transfer your company's responsibility toward the data subject.
• A contract can split costs and set rights of recourse between the parties, but it does not remove the controller's duty to choose well, instruct and supervise.
• If the vendor errs outside your instructions, its position gets worse. If it errs within them, your company is more exposed. That is why instructions must be in writing.

Another point is the record of processing operations under Article 37. Both controller and processor must keep one. An AI vendor that cannot say which data it processed, why and where is not ready to operate under LGPD.

For the broader view of what a company must do when using AI with personal data, see LGPD and Artificial Intelligence for Companies: What to Do.

Clauses the controller should require from the vendor

If your company is the controller, the contract should protect your ability to decide, prove and react. A practical set of clauses:

• Purpose and scope: a description of what the vendor may do with the data, limited to the contracted service.
• Roles: an express statement of who is controller and who is processor, plus any exceptions.
• Ban on own use: a prohibition on training, fine-tuning or improving models with your data, or a restricted and revocable authorization if you decide to allow it.
• Data categories and data subjects: a list of what will be processed, with attention to sensitive data, children's data or health data.
• Subprocessors: a current list, advance notice of changes, a right to object, and the same obligations passed down to them.
• Location and international transfer: where data is processed and stored, and the mechanism required by Article 33 of LGPD when data leaves Brazil.
• Security: technical and administrative measures consistent with Article 46, with access control, encryption and separation between customers.
• Incidents: a deadline and format for the vendor to notify you, with enough information for you to meet Article 48, which covers notice to the ANPD and data subjects.
• Data subject rights: an obligation to support requests for access, correction, deletion and other rights, within a timeframe compatible with yours.
• Retention and deletion: how long conversations, logs and backups are kept, and return or deletion at the end of the contract, confirmed in writing.
• Audit and evidence: the right to request reports, records and answers to security questionnaires.
• Decision records: logs that let you reconstruct what the AI agent answered or did, and on what basis.

If you are preparing a formal procurement, the AI Agent RFP Template helps turn part of this list into objective requirements.

What the processor needs from the controller

A good contract does not only protect the buyer. The vendor, as processor, also needs the conditions to comply with the law, and the buyer has to provide them. This avoids the scenario where the vendor follows vague instructions and everyone later argues about who made the mistake.

Clauses and duties that usually fall to the controller:

• Documented instructions: what the agent may and may not process, when it escalates to a human, and which actions it may take. Article 39 expects instructions, and implicit instructions are hard to prove.
• Legal basis and transparency: the controller is responsible for having a legal basis for the processing and for informing data subjects, for example in the privacy notice and at the start of a WhatsApp conversation.
• Quality and minimization of what is sent: the controller decides which CRM, ERP or conversation fields reach the vendor. Sending more than necessary is the controller's decision.
• Contact channel: naming the data protection officer and the technical contact for incidents and data subject requests.
• Change procedure: how to change the purpose, scope or integrations without the vendor having to guess.

On the processor's side, what is expected is to process only as instructed, keep a record of operations, apply security, report incidents, support data subject rights, and delete or return the data at the end.

For the internal policy layer, Company Policy for Employee ChatGPT Use: What to Allow and Ban shows how to define what employees may send to AI tools, which reduces the problem at its source.

Illustrative scenario: a WhatsApp agent with a vendor chain

Illustrative scenario: an aesthetics clinic hires a technology company to run an AI agent on WhatsApp that confirms appointments and answers questions about procedures. The technology company uses a language model provider and a cloud service to store conversation history.

The clinic is the controller: it decides that the data will be processed for scheduling and customer service. The technology company is the processor. The model provider and the cloud service are subprocessors. Three questions show whether the contract is good:

• Does the clinic know who the subprocessors are and where they process the data?
• Is there a clause saying the conversations do not train third-party models?
• When a patient asks for deletion, who does it, how quickly, and with what confirmation?

If the clinic cannot answer, it is still responsible toward the patient, but without the material to show it chose and instructed the vendor well. Because the service may touch health information, also read Health Data and AI Compliance for Clinics: What to Limit Under LGPD.

Step by step to close the contract

A practical sequence, following a map, limit, pilot and hand over method:

• Map: list the flow the AI will handle, the data that goes in, the connected systems and who decides what. Without this map you cannot say who is controller and who is processor at each step.
• Classify the roles: for each vendor in the chain, record whether it acts only on instruction or has a purpose of its own. Where it has its own purpose, treat it as a decision point, not a contract detail.
• Limit: define in writing which data may be sent, which actions the agent may take and when it hands over to a human. This document becomes the instructions annex of the contract.
• Assess the risk: if the processing is higher risk, such as sensitive data or decisions that affect people, evaluate whether you need an impact assessment. Data Protection Impact Assessment for AI Projects (LGPD RIPD) explains when to do one and what to include.
• Negotiate the clauses: use the list in the earlier sections as a checklist and record accepted exceptions, with an owner and a deadline.
• Pilot: start with one real flow, with logs, an agreed success metric and reduced data. Test a deletion request and an incident simulation before scaling up.
• Hand over and decide: at the end of the pilot, deliver the operation with documentation, access and a review routine, and decide whether to expand, adjust or stop.

For AI risk management references, the NIST AI Risk Management Framework offers a general structure, and the ANPD is the official source for Brazilian guidance and regulations on data protection. For technical risks specific to applications built on language models, there is the OWASP Top 10 for LLM Applications.

Frequently asked questions

Is an AI vendor always a processor? No. It is a processor when it handles the data only to deliver the service, under your instructions. If it uses the data for its own purposes, such as training models for other customers, it may be a controller for that part, and the contract should address this explicitly.

If the vendor causes a data leak, does my company stop being responsible? Generally, no. The controller still has duties toward data subjects and the ANPD, and the law provides for joint liability in specific situations. The contract can set rights of recourse and a duty to cooperate, but your choice of vendor and the instructions you gave will still be examined.

Do I need a separate contract for LGPD? Not necessarily. What matters is that the obligations are written down, either in the main contract or in a data processing annex. Many companies prefer the annex, because it can be updated when subprocessors or scope change without renegotiating the whole contract.

Does using an AI model through an API change the roles? Using an API does not define the role by itself. What defines it is who decides the purpose and what the provider does with the data you send, including retention and training. Read the provider's data processing terms, confirm how these points work on the plan you bought, and take your questions to your legal team.

Sources

• ANPD: Autoridade Nacional de Proteção de Dados
• NIST AI Risk Management Framework
• OWASP Top 10 for LLM Applications