GDPR roles
Controllers, processors, and when you need a DPO.
The controller decides why and how personal data is processed; a processor acts on its instructions. Your role decides your duties, and you can hold different roles for different processing. Some organizations must also appoint a Data Protection Officer.
Back to GDPR services01 · The roles
Controller, processor, joint controller
Decided by who decides, not by what the contract calls you.
- Controller
- Sets the purposes and means. Carries the primary duties.
- Processor
- Processes on the controller's behalf, under a contract (Article 28).
- Joint controllers
- Two or more deciding together, with an arrangement splitting duties.
- Sub-processor
- A processor's own vendor, engaged only with the controller's authorization.
A SaaS company is usually a processor for customer data in its product, and a controller for its own staff, marketing and billing data.
02 · Processor contracts
What an Article 28 agreement must cover
The DPA every controller–processor relationship needs.
- Documented instructions
- Confidentiality
- Security measures
- Sub-processor approval
- Help with rights requests
- Help with DPIAs and breaches
- Deletion or return at the end
- Audit rights
Both roles keep records of processing activities (Article 30): purposes, data categories, recipients, transfers, retention and security measures.
03 · When a DPO is required
When you must appoint a DPO
Three triggers in Article 37.
- Public authorityAny public body, except courts acting judicially.
- Large-scale monitoringCore activities involve regular, systematic monitoring at scale, such as behavioural advertising.
- Large-scale special dataCore activities process special category or criminal data at scale.
A DPO needs expert knowledge, must be independent, reports to the highest management level, and can be an employee or an external appointee.
04 · Deciding the role
Testing which role you hold
Ask who chose the purpose, and who chose the tools.
| Illustrative case | Likely role | Why |
|---|---|---|
| A payroll bureau runs salaries on a client's instructions | Processor | The client sets purpose and means |
| A hospital and a research lab design one study together | Joint controllers | Both decide why and how |
| A bank uses a cloud vendor only to store files | Processor | The vendor follows the bank's instructions |
| A vendor reuses client data to train its own product | Controller for that use | It chose a new purpose |
That last row matters. A processor that starts deciding its own purposes becomes a controller for them and takes on the full duties, so check what your vendors do with data beyond the service.
05 · Duties and mistakes
What each side owes, and where it slips
Processors are directly liable too, not only bound by contract.
Controller
- Picks a lawful basis
- Writes the privacy notice
- Runs DPIAs
- Answers rights requests
- Reports breaches to the authority
Processor
- Follows documented instructions
- Secures the data
- Keeps its own records
- Tells the controller of a breach without undue delay
- Helps with rights and DPIAs
Both can be fined by a supervisory authority.
- A DPA nobody reads. Signed templates that never match the real data flow.
- Unlisted sub-processors. A vendor adds a sub-contractor with no approval step.
- A DPO with a conflict. Someone who sets the purposes cannot also check them.
- No published DPO contact. The contact details must be public and given to the authority.
06 · Beside the DPDP Act
The Indian equivalents
Different words, a close shape.
India's Digital Personal Data Protection Act, 2023 uses data fiduciary for the decider and data processor for the one acting on its behalf. The duty to answer people and to protect the data sits with the fiduciary, so a processor contract matters on both sides. The Act's extra tier, the significant data fiduciary, brings its own officer and audit duties, which sit near the GDPR DPO idea but are not the same. Under ISO 27001, supplier and role clarity show up in the controls on supplier relationships and on roles and responsibilities.
- Data fiduciary, processor or consent manager?The three roles the Act names, and which one you are.
- Significant data fiduciariesThe extra duties: DPO, audits and impact assessments.
Sources: Regulation (EU) 2016/679, Articles 4, 24 to 30 and 37 to 39; EDPB Guidelines 07/2020 on controller and processor; Digital Personal Data Protection Act, 2023. This page is general information, not legal advice; counsel should confirm how it applies to your contracts.
More about GDPR roles
Can we be controller and processor at once?
Yes, for different processing.
Classify each processing activity. The role follows who decides purposes and means for that activity.
Can one DPO serve a whole group of companies?
Yes, if easily reachable from each one.
A group may appoint one DPO, provided that person can be reached from every establishment, including in the right language.
What does a DPO actually do?
Advise, monitor and be the contact point.
The DPO informs staff, monitors compliance, advises on DPIAs and cooperates with the authority. The organization, not the DPO, stays accountable.
Is a DPO ever worth appointing when not required?
Sometimes, as a voluntary choice.
You may appoint one anyway. Be aware that a voluntary DPO is then held to the same independence and role rules.
Get your roles and contracts straight.
A GDPR gap assessment classifies each activity and checks every DPA.