A data controller is the natural or legal person, public authority or other body that, alone or jointly with others, determines the purposes and means of processing personal data. The definition comes from Article 4(7) of the GDPR, and the concept is the cornerstone of privacy law in the European Union and of many laws modeled on it: whoever decides why and how personal data is used carries primary accountability for that use.
In privacy fundamentals, the data controller is defined in contrast to the data processor, which handles personal data only on the controller’s behalf and instructions. The role is assigned by actual influence over the processing, not by contract labels, job titles or who owns the servers.
How the controller role is determined
The decisive test is who decides the purpose, the reason the processing happens, and the essential means, such as which data is collected, about whom, for how long and who receives it. Decisions about non-essential means, like the choice of database software or hosting provider, can be left to a processor without changing the roles.
Control can arise from explicit legal duty, for example an employer processing payroll data for tax purposes, from implicit competence that follows from a traditional role, or from factual influence over the processing. Regulators and courts look at the reality of the arrangement, so a contract that calls a party a processor does not protect it if it actually decides why the data is used.
| Question | If the answer is yes | Example |
|---|---|---|
| Does the party decide why data is processed? | Strong indication of controller | A retailer running a loyalty program |
| Does it choose which data and whose data? | Controller of essential means | Deciding to collect purchase history |
| Does it set retention and recipients? | Controller of essential means | Keeping records for five years |
| Does it only follow documented instructions? | Likely a processor | A mailing service sending campaigns |
| Does it use the data for its own goals? | Becomes a controller for that use | A vendor training its own products |
Obligations of a data controller
The GDPR places the main compliance burden on the data controller through the accountability principle: the controller must not only comply but also be able to demonstrate compliance. That covers the legal basis, the data protection principles and the rights of data subjects.
| Obligation | What it requires | GDPR reference |
|---|---|---|
| Lawful basis | One of six bases, such as consent or contract | Article 6 |
| Transparency | Clear privacy notices to individuals | Articles 12 to 14 |
| Data subject rights | Access, erasure, objection, portability | Articles 15 to 22 |
| Privacy by design and default | Built-in protection and data minimization | Article 25 |
| Processor contracts | Binding terms with every processor | Article 28 |
| Records of processing | Documented inventory of processing activities | Article 30 |
| Breach notification | Report to the authority within 72 hours where required | Articles 33 and 34 |
| Impact assessment | DPIA for high-risk processing | Article 35 |
Responding to individuals is a practical test of controllership. Requests for access or erasure must normally be answered within one month, extendable by two further months for complex cases, and the controller remains responsible for the answer even when processors hold the data.
Data controller compared with related roles
One organization can hold different roles for different processing activities. A cloud provider is a processor for customer data it hosts, yet a controller for its own billing and security logs. Roles are therefore assessed per activity, not per company.
| Role | Decides purposes | Main responsibility | Typical example |
|---|---|---|---|
| Data controller | Yes | Overall compliance and accountability | Online shop processing orders |
| Joint controllers | Yes, together | Shared duties under an arrangement | Two firms running a co-branded program |
| Data processor | No | Process only on instructions, secure data | Payroll or hosting provider |
| Sub-processor | No | Support a processor with authorization | Data center used by a SaaS vendor |
| Data subject | Not applicable | Exercises rights over own data | Customer or employee |
Joint controllership arises when parties decide purposes and means together, even with unequal influence. European case law has found joint control in situations such as a website embedding a social media plugin that transmits visitor data, which means operators cannot assume that third-party tools make them mere bystanders.
Liability and the controller outside the EU framework
A data controller is directly liable for damage caused by processing that infringes the GDPR, and administrative fines can reach 20 million euros or 4 percent of worldwide annual turnover, whichever is higher, for the most serious infringements. Controllers outside the European Union fall under the GDPR when they offer goods or services to people in the EU or monitor their behavior, and they may need an EU representative.
Other laws use similar concepts under different names. The UK GDPR keeps the term data controller. California privacy law speaks of a business that determines the purposes and means, alongside service providers and contractors. Brazil’s LGPD uses controlador and operador. Mapping these roles carefully matters for global companies, because duties and terminology do not align perfectly.
Common mistakes in assigning controller responsibility
Errors in role allocation lead to missing contracts, unanswered rights requests and unclear breach responsibility.
- Relying on contract labels while the vendor in fact reuses data for its own purposes.
- Ignoring joint control for shared marketing, analytics or embedded third-party tools.
- Assuming the processor answers rights requests, when the controller remains responsible.
- Keeping no records of processing, which makes accountability impossible to demonstrate.
- Treating the IT department as the controller, when the organization as a whole holds the role.
Understanding it simply
A data controller is the organization in charge of your personal information. It decides why your details are collected and what happens to them, so it is the one that must follow the rules and answer to you.
Think of building a house. The owner decides what is built and why, while contractors do the work as instructed. The owner is like the controller and the contractors are like processors. If something goes wrong, the owner cannot simply blame the builders.
Applied in practice
A chain of fitness studios launches a mobile app that records members’ workouts and class bookings. It hires a software agency to build the app and a cloud provider to host it. The studio chain decides what data is collected, why and for how long, so it is the data controller, while the agency and the cloud provider act as processors under written contracts.
Later, the analytics vendor embedded in the app proposes to use members’ activity data to improve its own advertising products. The chain’s privacy lead recognizes that this would make the vendor a separate controller for that purpose, requiring its own legal basis and transparency. The chain refuses the change, updates its records of processing and avoids an unlawful disclosure of health-related data.