What is Data Controller?

The controller/processor distinction, defined in GDPR Article 4, allocates responsibility across the data supply chain. The controller decides why personal data is processed and, in its essential elements, how; everyone processing on the controller's documented instructions is a processor. An eCommerce brand deciding to collect customer emails for marketing is the controller; the email platform sending campaigns on its behalf is a processor.

Controllership follows decisions, not contracts or labels. A vendor agreement calling a party a 'processor' does not survive facts showing it used the data for its own purposes — at that point it became a controller (and possibly an unlawful one). Two organizations that jointly determine purposes and means are joint controllers under Article 26, a status courts have applied expansively: the CJEU has found website operators jointly responsible with Facebook for data collected by an embedded Like button.

The controller's duty list is the long one: establishing a legal basis for each purpose, delivering privacy notices, honoring data subject rights, implementing privacy by design, executing Article 28 contracts with every processor, maintaining records of processing, notifying breaches, and conducting DPIAs for high-risk processing. Controllers answer for their processors' handling of the data, which is why processor due diligence is a controller obligation rather than a courtesy.

US state laws adopted the same architecture — Virginia, Colorado, and most other state statutes use 'controller' and 'processor' explicitly, while California's 'business' and 'service provider' play the equivalent roles. Whatever the vocabulary, the entity deciding why data is used carries the primary duties.