Data controller and processor

Also called Controller, Processor, DPA, Data processing agreement

Who decides what happens to personal data, and who merely acts on instructions. The distinction sets the liability.

What it means

A controller decides the purposes and means of processing personal data. A processor processes it on the controller's behalf, on instructions.

Your accountant is usually a controller in their own right. Your email platform is usually your processor. Your CRM supplier is usually your processor.

Why it matters

The role determines the obligations. Controllers carry the primary duties to data subjects; processors have direct obligations too but a narrower set.

A written contract with defined terms is legally required between controller and processor. Larger customers will ask to see yours.

What it looks like in practice

Map your suppliers and decide, for each, which role they play. Get a data processing agreement in place with every processor.

Check where the data goes. International transfers need a lawful mechanism such as the UK's addendum to the standard contractual clauses.

Joint controllers exist where two organisations genuinely decide together, and need their own arrangement.

What to watch out for

Assuming a supplier's standard terms include a compliant DPA. Many do; some do not, and it is worth reading.

Sub-processors. Your processor's suppliers also handle your data, and you should know who they are.

Where to get proper advice

The ICO's controllers and processors guidance, including its checklists. A solicitor for contracts where the data is sensitive or the volumes large.