Data controller

Follow the decisions, not the supplier label

A data controller makes the essential decisions about a processing activity: why the personal data is needed and how it will be used. Choosing what to collect, whose information to use, the purpose, lawful basis, disclosures and retention are all signs of control.

The role follows the facts. As the ICO's controller and processor test explains, a contract label does not settle the question. One organisation can be controller for its employment records, processor for work carried out on a client's instructions and controller again for information it must use for its own legal duties.

A controller can act alone or jointly

Two organisations are joint controllers when they jointly determine the purposes and essential means of the same processing. Simply receiving the same data or working together does not make them joint controllers. They may instead use it independently for separate purposes.

A processor can choose practical details within a controller's documented instructions without taking over the controller role. If the supplier starts deciding its own purpose or essential means, however, its role for that activity may change.

Record what your organisation controls

Map the role separately for each processing activity. Record the purpose, people and information involved, lawful basis, recipients, processors, retention, accountable owner and evidence behind the decision.

Controllers remain responsible for the principles, privacy information, individual rights, suitable processor contracts, security and breach assessment. Outsourcing payroll, storage or HR software can change who performs the work, but it does not transfer the employer's accountability for the decisions it still controls.