Controller and operator under the LGPD: understand the responsibilities

The artificial intelligence and cloud computing market is expanding rapidly. Every week a new tool, a new model, a new "vibe-coded" product emerges in just a few hours. But behind this technical agility lies an equally complex legal framework that, in practice, decides whether a company survives a security incident or becomes the next case sanctioned by the National Data Protection Authority (ANPD).

Skycast 04 Sep 2026 12 min read By: Skyone

That was precisely the central theme of the conversation on the Builders, which brought together Dr. Renata Barros, legal director, compliance and governance at Skyone, and Henrique Fabretti, partner at the law firm Opice Blum Advogados. The discussion began with a recently published guide by the CNIL (the French data protection authority) on the allocation of roles among the parties involved in the management of cloud services. From there, the conversation explored territory that every company dealing with personal data, AI, or cloud computing needs to master: who is responsible for what, and why.

The starting point: controller and operator are not the same thing

Both the Brazilian LGPD and the European GDPR, which served as inspiration for the Brazilian law, divide responsibilities for the processing of personal data into two central figures. As Henrique Fabretti explained, this division is not bureaucratic, it is a matter of regulatory fairness:

The legislation resolved to divide roles because there are parties with more influence and decision-making power over the data, and parties with less power, and it would not be fair to apply the same standard to both.

The controller is the one who makes the relevant decisions: defining the purpose of the processing, deciding what to do with the data, how long to retain it, and when to delete it. The operator (the processor under the GDPR) only executes instructions. They process data on behalf of another party, without decision-making autonomy over the purpose of that processing.

The trap, according to Fabretti, is that this distinction "seems simple at first glance," but it is rarely binary. He cites Skyone's own example: "often, in the vast majority of cases, a company is not just an operator or just a controller in the same relationship." A company can be a controller in one part of the operation and an operator in another, within the same contract, of the same product. Therefore, the first exercise for any business that handles personal data is: to map, piece by piece of the operation, what role you play there.

You may also be interested in: Does generative AI use company data? Risks, LGPD (Brazilian General Data Protection Law), and how to protect corporate information.

The most common mistake: confusing the person who holds the data with the person who controls the data

One of the most instructive moments of the conversation was when the presenters proposed a practical example: a developer creates a CRM using AI — the so-called "vibe coding" — and this CRM stores a customer database. Who is in control in this relationship: the person who developed the CRM or the person who uses it?

Dr. Renata's answer clears up an extremely common misconception in the technology market:

The CRM user, not the provider, decides what information goes into the CRM (name, email, marital status, children). The provider has the fields available, but the user decides what data goes there and what to do with it afterward.
Renata Barros, Legal, Compliance and Governance Director at Skyone

In other words, the greatest regulatory burden falls on those who use the tool and decide the purpose of the data, not on those who built the technological infrastructure. As André Senna observed during the program, this is counterintuitive: "at first glance, you might think the opposite." The natural tendency is to assume that whoever possesses the technical complexity (the cloud provider, the platform developer) is automatically responsible. That's not the case. According to Renata, the provider "defines the 'how' technically; it's the track on which the operation runs. But whoever defines the business is the controller, and that's what brings the greatest responsibility."

It is precisely this grey area that the CNIL guidance seeks to eliminate: the fact that a provider has more sophisticated technological infrastructure does not automatically transform it into a controller or make it the "owner of the data".

When theory becomes reality: the case of the "vibe codado" app

The discussion ceased to be abstract when Fabretti brought up a concrete and recent case: a sanctioning process by the ANPD (National Data Protection Authority), made public the week before the recording, involving a dating platform aimed at the LGBTQ+ community developed through vibe coding. The platform experienced explosive growth, gaining over 30,000 users in a short time, and, due to a security configuration flaw, exposed the data of all newly arrived users.

The point Fabretti raised about the seriousness of the case goes far beyond the amount of the fine:

You were storing data on people who clearly indicated a certain sexual orientation, and it leaked. The person creating this has to consider: I might be outing someone who isn't ready for it. A conservative family finds out through a leak because someone saw their son's name and sent it to the WhatsApp group.
Henrique Fabretti, Partner at Opice Blum Advogados

This example illustrates a central principle of the LGPD (Brazilian General Data Protection Law) that Dr. Renata reinforced throughout the episode: it is a risk-based legislation, not a binary rule-based one. There is no simple "can or cannot" answer; there is a spectrum of exposure, and the level of care required is proportional to the severity of the potential harm. Health data, sexual orientation, or other sensitive information require a much higher level of due diligence than, for example, a database of names and CPF (Brazilian taxpayer identification number).

Cloud security vs. security in the cloud: the distinction that prevents (or creates) incidents

One of the most operational concepts discussed in the episode is the difference between cloud security (the provider's responsibility: physical infrastructure, operating system patches, physical access control to the data center) and security in the cloud (the user's responsibility: access management, correct configuration of tools, credential revocation).

According to Fabretti, who works directly in incident response at the Opice Blum office, the vast majority of problems do not stem from provider failures:

It's very rare to have a security incident that affects cloud security; data center environments are usually very well controlled. Typically, it's the cloud service user who hasn't managed access properly: a token left in a public GitHub repository, or a third party leaving the company whose credentials are never revoked.
Henrique Fabretti, Partner at Opice Blum Advogados

Dr. Renata summarized this distinction with an analogy worth remembering:

We think of cloud security as a highly fortified, virtually indestructible safe. It's no use if you leave the key in the reception area.
Renata Barros, Legal, Compliance and Governance Director at Skyone

This metaphor directly illustrates why many companies miss the mark by investing heavily in infrastructure without investing equally in access governance, credential rotation, and team training.

How does the ANPD (Brazilian National Data Protection Authority) assess liability in cases of difficult causality?

One of the richest segments of the episode explored a deliberately extreme scenario: an attack via a physical peripheral (a compromised keyboard that installs malware when connected), with virtually no traceability. Who is responsible for this?

Fabretti's response brought an important shift in perspective on how the Brazilian regulator actually analyzes these cases:

According to the ANPD (Brazilian National Data Protection Authority), when it decides whether you fulfilled or failed to fulfill your duty of diligence regarding security, it is not concerned with whether it was the IT guy or the CISO. What matters is that it happened, and it will look at the level of care you took to prevent it from happening.
Henrique Fabretti, Partner at Opice Blum Advogados

In practice, this means that the existence of an incident is not, in itself, proof of negligence. What the authority assesses is the difference between two possible scenarios: a company that trained people, monitored the network, kept logs, and conducted forensic analysis after the event; versus a company that had absolutely none of these layers and only discovered the problem because a third party notified them. In the case of the Vibe Codado app, according to Fabretti, the ANPD's view was straightforward: "they did not take any of the appropriate security, and that is why the incident happened, and that is why they are being sanctioned."

The practical conclusion, summarized by Renata, is that governance is not bureaucracy; it is the raw material for future legal defense: “Sometimes the legal department is a bit annoying, wanting you to document this, do that. But to tell that story later on, it has to be convincing. It's no use just telling the story; you have to show the proof.”

Privacy by Design and the new frontier: Compliance by Design

A concept that runs throughout the conversation is Privacy by Design. The idea is that technological solutions should be designed from the outset to incorporate data protection safeguards, rather than receiving them as an afterthought. According to Dr. Renata:

Privacy by Design means ensuring that the solution is built with all these precautions, all the relevant legislation, and everything else that's important for you to later demonstrate that you acted correctly.
Renata Barros, Legal, Compliance and Governance Director at Skyone

In the episode, the presenters also raised a realistic scenario: what if the developer strictly follows Privacy by Design and Security by Design best practices and still suffers an incident? Fabretti's answer balances legal honesty with pragmatism:

Having all that perfectly arranged isn't enough to guarantee you're 100% safe. But if it's a less serious problem, having all that apparatus can show the regulator or judge that it was impossible for it not to have happened even with all the layers of security in place.
Henrique Fabretti, Partner at Opice Blum Advogados

There is also a second element, besides risk: good faith. Fabretti emphasizes that demonstrating good faith is not only a principle of the LGPD (Brazilian General Data Protection Law), it is a concrete item in the calculation of fines applied by the ANPD (National Data Protection Authority), capable of reducing the penalty. Documentation and evidence, therefore, are not just a defense: they are mitigating factors.

Learn the best secure development practices for your company

The golden rule: "If it can't be done, said, or proven, don't do it."

At the end of the episode, Dr. Renata summarized her guidance for individuals and companies in a sentence that encapsulates the entire risk management philosophy discussed in the program:

Always ask yourself: are there any risks involved? And as a rule, most activities do. If a problem arises, how will I be impacted? If it can't be done, or can't be said, or can't be proven: don't do it.
Renata Barros, Legal, Compliance and Governance Director at Skyone

Henrique Fabretti added a stress test recommendation applicable to any digital product that handles personal data:

Lawyers work with risk; it's our world, looking at what could go wrong. Stress-check what you're doing: what's the catastrophic scenario? If the catastrophe is someone dying or being evicted from their home, you need a much higher level of care. If the catastrophe is someone receiving an unwanted advertising call, it's annoying, but not catastrophic.
Henrique Fabretti, Partner at Opice Blum Advogados

A message for those building with AI today

The conversation provides a clear roadmap for any founder, developer, or company that is "vibe-coding" a new AI or cloud product:

Map out your roles — controller or operator — in each data processing relationship, before an incident forces this analysis under pressure.
Document the division of responsibilities in the contract, clearly distinguishing between cloud security and security in the cloud.
Implement access governance with the same rigor you invest in infrastructure — tokens, credentials, and third-party permissions are the most common point of failure.
Adopt Privacy by Design and Compliance by Design from the product's conception, not as an afterthought.
Document and provide evidence of everything. When faced with a regulator, good faith and proven diligence make a real difference in determining liability.

As Robson Del Fiol summarized during the program, exposure to this type of risk doesn't begin when the product is launched, "it begins at the ideation stage." And that's exactly the blind spot of many digital businesses today: technology advances in weeks, but the legal consequences of a poorly informed decision can haunt the company for years.

Want to hear the full conversation, with all the examples, analogies, and productivity "hacks" from the guests? Listen to the complete episode of the Builders, with Dr. Renata (Skyone) and Henrique Fabretti (Opice Blum Advogados), available now on Spotify.