Data protection
Controller or processor? How to tell which you are, relationship by relationship
Whoever decides why personal data is used, and how, is the controller and carries the GDPR's duties. Whoever only handles it on their behalf is the processor. One business can be both, in different relationships, at once.
By Oscar CobbeCurrent as at 2 minute read3 sources
The two definitions
The GDPR defines a controller as the person or body that, alone or jointly with others, determines the purposes and means of the processing of personal data (Article 4(7)), and a processor as one that processes personal data on behalf of the controller (Article 4(8)).
The European Data Protection Board's guidelines call these functional concepts: the role follows what a business does with the data, not what a contract calls it. A contract helps identify the controller, the Board says, but it is not decisive in every case.
Why and how: the test
The controller decides the purposes and the means: the why and the how. The Board's guidelines allow some practical decisions about the how (which it calls non-essential means, such as the software or the security set-up) to be left to a processor without changing who the controller is.
A processor must not use the data for anything except the controller's instructions. The Board is clear on what happens if it does: a processor that starts deciding its own purposes becomes a controller for that processing, and can be sanctioned for going beyond its instructions.
| Relationship | Usually |
|---|---|
| You and your own customers' and staff's data | You are the controller |
| Your payroll bureau, email provider, website host or CRM supplier, handling your data for you | They are your processors |
| An accountant or a solicitor using client data under their own professional duties | Can be a controller in their own right; check what their terms say |
| Two businesses that decide together why and how data is used, such as a joint marketing campaign | Joint controllers, who must agree their responsibilities |
What each must do
A controller carries the duties: a lawful basis, the privacy notice, answering people's requests, the record of processing, reporting breaches, and choosing processors that give sufficient guarantees.
Between a controller and a processor there must be a written contract with the terms Article 28 lists; what it must contain goes through them one by one. Joint controllers must set out who does what, in particular who answers people's requests and who tells them how their data is used, and the Board recommends that be a binding document.
When you are the processor
A business that builds or runs systems for clients is often a processor for the data in them. FourWinds is, for the client data in the systems it builds and supports. The duties then run the other way: act only on the client's instructions, keep it secure, use sub-processors only with the client's authorisation, help with requests and breaches, and delete or return the data at the end.
Sources
- 1.Regulation (EU) 2016/679 (GDPR), Articles 4(7), 4(8), 26 and 28 · EUR-Lex, Publications Office of the European Union
- 2.Guidelines 07/2020 on the concepts of controller and processor in the GDPR · European Data Protection Board
- 3.Guidelines 07/2020: landing page and version history · European Data Protection Board
Free, and no account needed
Do you need a DPIA?
As controller, some uses of data need an impact assessment before they start. Nine questions against the Data Protection Commission's own list.
Run the free checkThe GDPR pack, €650 once
A privacy notice that matches your website, the written record of what you hold and why, with your processors named, and the steps for when someone asks for their data or something goes wrong.
See the pricesWho wrote this
Oscar Cobbe · Founder, FourWinds Digital
Writes and maintains the legal explainers on this site, and does the compliance work behind them. Every date and article number here is checked against the legislation itself before it is published, and each article shows the date it was last checked.
More about how we work →Read next
- Data protectionWhat a data processing agreement must contain: the Article 28 checklist
- GDPRA record of processing for a small Irish business: what goes in it, and whether you need one
- GDPRGDPR for a small Irish business, and what the Data Protection Commission deals with
Written on 29 October 2026; it describes the law as FourWinds read it on that date. This is general information about how the rules work, not legal advice on your situation. Where you need a solicitor, we say so. How we check the law.