Data Controller and Processor

A data controller is the person or organisation that decides why and how personal data is processed. Article 4(7) of the GDPR defines it as the body which, "alone or jointly with others, determines the purposes and means of the processing of personal data". A law firm that copies a client's passport to open a file is a controller. It chose to collect the document and what to use it for.

The controller carries the responsibility. It must be able to demonstrate that processing follows the data protection principles (Article 5(2)), and it must put appropriate technical and organisational measures in place to that end (Article 24(1)). Where EU or national law itself fixes the purposes and means, that law may also name the controller.

A data processor is a person or organisation that "processes personal data on behalf of the controller" (Article 4(8)). It works to the controller's order. Typical cases are a cloud storage provider, an outsourced payroll bureau, and a client portal supplier that hosts a firm's files.

The processor may not use the data for ends of its own. Under Article 29 it shall not process the data "except on instructions from the controller", unless EU or member state law requires it to. The same rule binds any person who has access to the data and acts under the authority of the controller or the processor. A firm's own staff fall under it. The controller, for its part, may use only processors that give sufficient guarantees of compliant processing (Article 28(1)).

Ask who decides the purposes and the means. The party that determines why the data is processed, and how, is the controller. A party that only carries out those decisions for someone else is a processor. The test follows from the two definitions, and it turns on what each party does in fact.

A contract cannot settle the matter by calling a party a processor. Article 28(10) says that a processor which infringes the regulation "by determining the purposes and means of processing" is considered a controller for that processing. A supplier that starts to use client data for purposes of its own therefore takes on a controller's duties for that use. The European Data Protection Board has published guidelines on the two concepts for cases that are harder to call.

Two questions help in practice. Who decided that the data would be collected? Who decides what it is used for and how long it is kept? A party that answers "we do" is unlikely to be only a processor.

The controller answers for the processing as a whole. The processor answers for following instructions and for a shorter list of duties that the GDPR addresses to it directly. The table sets the two side by side, with the article for each point.

Some duties fall on both. Each must secure the data to a level appropriate to the risk (Article 32) and cooperate with the supervisory authority on request (Article 31).

It decides who answers to the person whose data it is, and who answers to the supervisory authority. Data subjects exercise their rights against the controller. The controller must give them the information about the processing and must act on their requests (Article 12).

It also decides who pays. Article 82(2) makes a controller liable for damage caused by processing that infringes the regulation. A processor is liable only where it has not complied with obligations directed specifically at processors, or has acted outside or contrary to the controller's lawful instructions. Where both are responsible for the same damage, each can be held liable for all of it, so that the person is compensated. The one that paid can claim back the other's share (Article 82(4) and (5)).

Administrative fines can reach either role. Article 83(4) covers "the obligations of the controller and the processor" under Articles 25 to 39. A firm that misreads its role may lack the contract, the records or the breach procedure that the role requires.

Joint controllers are two or more controllers that "jointly determine the purposes and means of processing" (Article 26(1)). Neither works for the other.

Joint controllers must settle, in a transparent arrangement between them, who meets which obligation. The arrangement covers in particular the rights of data subjects and the duty to inform them. Its essence must be made available to the data subjects. The split works between the controllers only. Whatever the arrangement says, a person may exercise their rights "in respect of and against each of the controllers" (Article 26(3)).