Controller

The controller is the party that decides why personal data is processed and how, at least in its essential elements. Under the GDPR (Art. 4(7) and Art. 24) and the LGPD (Art. 5, VI), the controller carries primary accountability: choosing a lawful basis, informing data subjects, answering their requests, keeping records, running DPIAs where required, securing the data and notifying breaches.

The role follows the facts, not the contract label. An organisation that decides to use a vendor's AI model to screen job applicants is the controller for that screening, even if the vendor designs the technical details. When two organisations decide purposes together, they are joint controllers and must allocate responsibilities transparently.

The counterpart is the processor, which acts only on the controller's documented instructions. A bank using a cloud provider to host customer data is the controller; the cloud provider is a processor. If the provider starts using that data to train its own models for its own purposes, it becomes a controller for that new processing.