Glossary · Privacy and data protection
The GDPR puts primary responsibility on whoever decides why and how personal data is used.
Under the GDPR, the person or body that, alone or with others, decides the purposes and means of processing personal data, and answers for that processing.
Back to the glossary01 · In plain words
In plain words
Under the GDPR, the person or body that, alone or with others, decides the purposes and means of processing personal data, and answers for that processing.
Ask who decided that the data would be collected, for what, and roughly how. The answer is the controller. A company that only follows those instructions is a processor. The label comes from what you actually decide, not from what a contract calls you.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
Most GDPR duties land on the controller: choosing a lawful basis, writing the privacy notice, answering access requests, notifying a supervisory authority of a breach, and being able to show compliance under the accountability principle. An Indian SaaS company serving EU customers is often a processor for its clients' data and a controller for its own marketing and billing data, at the same time. Getting the role wrong means signing the wrong contract and owning the wrong duties. India's DPDP Act uses a close equivalent, the data fiduciary, under its own rules.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Article 4(7) of the GDPR
- The definition of controller, including the possibility of deciding jointly with others.
- Articles 24 and 26
- The controller's responsibility to implement and show appropriate measures, and the arrangement joint controllers must agree.
- The data processing agreement
- Under Article 28 the controller sets instructions for each processor in a binding contract.
- The record of processing activities
- Article 30 asks controllers to keep a record of what they process and why.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a Bengaluru analytics startup with German retail clients
The startup hosts shopper data that retailers upload and runs reports the retailers configure. For that data it is a processor: the retailers decide what is collected and why. Then the startup starts using pooled shopper data to train its own forecasting model sold to other clients. Now it is deciding a new purpose itself, which makes it a controller for that use. It needs its own lawful basis, its own notice route and likely its clients' agreement, and its processor contracts must be reviewed.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Data processor
- A processor handles personal data only on the controller's instructions. Step outside those instructions and decide a purpose yourself, and you are treated as a controller for that processing.
- Data fiduciary (DPDP Act)
- India's term for the party deciding purpose and means. Similar idea, different law: separate duties, grounds for processing and penalties.
- Data protection officer
- A DPO advises and monitors inside an organisation. The controller is the organisation itself, not the officer.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- List each processing activity and write down who decides its purpose.
- Expect to be controller for some activities and processor for others, and record both.
- Check that each processor contract reflects the role you actually play.
- Ask counsel to confirm the role where control is shared or unclear.
- GuideControllers, processors & DPOsWho decides, who processes, and when a DPO is required.
- GuideGDPR and India's DPDP ActData fiduciaries, consent, rights and penalties, side by side with GDPR.
- GuideGDPR principles & lawful basisThe seven principles of Article 5 and the six lawful bases.
Sources: Regulation (EU) 2016/679 (GDPR), Articles 3, 4(7), 24, 26, 27, 28 and 30; Digital Personal Data Protection Act, 2023, section 2(i), for comparison only.
Questions about Data controller
Can two companies both be controllers for the same data?
Yes. They may be joint controllers.
When two parties decide the purposes and means together, the GDPR treats them as joint controllers. Article 26 asks them to set out their respective responsibilities in an arrangement, and individuals can still exercise rights against either one.
Does the GDPR apply to an Indian controller at all?
It can, through Article 3(2).
A controller outside the EU falls under the GDPR when it offers goods or services to people in the EU or monitors their behaviour there. Such a controller may also need an EU representative under Article 27. Counsel should confirm how the law applies to your contracts.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.