Data Controller and Processor: How to Distinguish Them Under the GDPR

01

The difference in short

The data controller is the natural or legal person, public authority or body that determines the purposes and means of the processing of personal data. The processor, on the other hand, processes data on behalf of the controller, without independently deciding why and how the data is used.

02

Why this distinction matters

The GDPR also distinguishes the recipient, meaning whoever receives a communication of personal data, regardless of whether they are a third party or not. Understanding who is the controller, who is the processor and who is merely a recipient allows obligations and responsibilities to be correctly assigned before a problem occurs.

03

How to formalize the relationship

Steps

1. Identify who decides the purposes and means of the processing: that is the controller.
2. Enter into a contract or legal act binding the processor to the controller.
3. Specify in the contract the subject matter, duration, nature, purpose, type of data and categories of data subjects.
4. Obtain written authorization, specific or general, before the processor engages a sub-processor.
5. If the authorization is general, provide that the processor inform the controller of any future changes.

04

A hypothetical case

Hypothetical example: a controller company entrusts payroll management to an external supplier. The contract states that the supplier processes data only on documented instructions from the company, unless legally required, in which case it informs the controller before proceeding. If the supplier wants to sub-delegate part of the work to another party, it must first obtain the company's written authorization.

05

Typical processor obligations in the contract

• Process data only on documented instructions from the controller.
• Ensure confidentiality of persons authorized to process data.
• Adopt the technical and organizational measures required by Article 32.
• Assist the controller in responding to data subjects' requests.
• Remove or return the data at the end of the service, unless otherwise required by law.

06

How to organize roles with management software

A company can choose to configure, together with its software partner, a clear list of who is controller and who is processor for each processing activity, with traceability of documented instructions and authorizations for sub-processors. It is a useful operational choice to have every change of processing suppliers recorded and reviewable, so as to be able to demonstrate compliance with contractual obligations at any time.

07

Frequently asked questions about controller and processor

Can the processor sub-delegate processing? Yes, but only with the controller's written authorization and by imposing on the sub-processor the same data protection obligations set out in the original contract.

Who remains responsible if the sub-processor fails to perform? The initial processor retains full liability to the controller for the performance of the other processor's obligations.

08

Next step

Review your existing contracts with data processing suppliers: make sure they clearly state documented instructions, duration, purpose and conditions for any sub-processors.