Data controller

What it means

Under the GDPR, a controller is a company, authority or person that, alone or jointly with others, determines the purposes and means of processing personal data. In other words, it decides why and how data are processed and bears the main responsibility for the processing.

Every company is a controller in at least some areas. An employer processes staff data for payroll and HR, an online shop processes customer data to fulfil orders, an office processes data of suppliers and contact persons. For each of these activities the controller has obligations.

A controller must be distinguished from a processor, which processes data on the controller’s behalf and according to its instructions. When a company outsources payroll to an accounting firm, the company remains the controller and the firm is the processor. Their relationship is governed by a data processing agreement.

How it works in practice

When setting up data protection for a client, we start by listing the activities where it is a controller. For each we define the purpose, legal basis, retention period and recipients. The result is the record of processing activities, the foundation of the whole framework.

The controller must inform data subjects about processing, handle their requests, such as the right of access, secure the data with appropriate measures and notify the authority of breaches that pose a risk.

For external providers such as cloud services, payroll software or marketing tools, we check whether they are processors and whether a contract is in place. The controller is also responsible for choosing a trustworthy processor.

What to watch out for

Companies often assume that outsourcing a task also transfers the responsibility. It does not: the controller remains responsible for lawful processing, and if data leak from a cloud service, it is the controller that must handle and report the incident.

Sometimes two companies are joint controllers, for example in a joint marketing campaign. They must then allocate their obligations by agreement, and the data subject can exercise their rights against either of them. This is worth settling in advance.