GDPR Q9

What is the difference between a data controller and processor?

Q9. What is the difference between a data controller and processor?

Category: Roles

Controllers and processors work together to handle personal data. Knowing the difference helps you assign the right responsibilities and draft proper contracts.

In simple terms

Controllers decide the why and how of processing.
Processors act only on a controller’s documented instructions.
Clear contracts protect both sides and set out compliance duties.

Role of the controller

Controllers determine the purposes and means of processing. They must be able to demonstrate compliance with GDPR principles, choose lawful bases, and respond to individual rights requests.

Controllers must carry out DPIAs when required and keep records of processing activities.
They are primarily responsible for notifying breaches to the ICO.
Joint controllers must transparently allocate responsibilities between them.

Role of the processor

Processors act on behalf of controllers. They cannot use the data for their own purposes and must follow the controller’s instructions and the contract.

Processors must implement appropriate security measures (Article 32).
They cannot appoint subprocessors without written authorisation.
They must assist controllers with audits, DPIAs, and breach responses.

Contracts and accountability

Article 28 requires contracts to set out key terms including subject matter, duration, nature, and purpose of processing. Contracts help prove accountability to the ICO.

Include confidentiality obligations for staff and sub-contractors.
Specify how data will be returned or deleted at the end of the contract.
Make sure international transfers are covered with appropriate safeguards.

Practical steps to take

Identify whether you are a controller, processor, or joint controller for each activity.
Review and update contracts to include the mandatory Article 28 clauses.
Carry out due diligence on processors before engagement and monitor performance.
Set up communication channels so processors can report incidents immediately.
Maintain documentation showing how responsibilities are allocated.

Real-life examples

Payroll provider

An employer (controller) hires a payroll bureau (processor) to manage salaries. The contract includes security requirements and instructions for handling leavers.

Joint controllers

Two charities run a joint fundraising campaign and decide together how supporter data will be used. They sign an agreement and publish a summary explaining their respective roles.

Helpful reminders

If you make decisions about data for your own purposes, you are acting as a controller.
Keep processor contracts easily accessible for audits and ICO requests.
Revisit agreements whenever services or technologies change.
Ensure processors in other countries provide equivalent protection.

Key takeaway

Be clear about roles, put everything in writing, and monitor your partners—shared understanding keeps everyone compliant.