Are you a controller or a processor?

What it is

A controller determines the purposes and means of processing, alone or jointly with others. A processor processes personal data on behalf of a controller. If a processor starts deciding purposes for itself, it becomes a controller for that processing. Two or more organisations that decide purposes and means together are joint controllers and must set out their respective responsibilities in an arrangement.

How to tell

• You are a controller if you decide to collect the data, for what purpose, which data and about whom, or how long to keep it. UK GDPR Art 4(7)
• You are a processor if you act only on another organisation's instructions and do not use the data for your own purposes. UK GDPR Art 4(8); Art 29
• You are joint controllers if you decide purposes and means together, and must agree who does what, especially on transparency and rights. UK GDPR Art 26

Who is responsible

Each organisation must work out its own role for each processing activity. A cloud provider can be a processor for customer data and a controller for its own billing data.

What it involves

1. List each processing activity.
2. Ask who decides purpose and essential means.
3. Put an Art 28 contract in place with every processor.
4. Put an Art 26 arrangement in place with joint controllers.
5. Record roles in the record of processing.

If it goes wrong

Regulatory

Getting the role wrong usually means missing contracts, notices or security duties. Processor and controller obligations under Arts 25 to 39 sit in the standard penalty tier (up to £8.7 million or 2%); a processor that uses data for its own purposes is treated as a controller for it.

Criminal

No offence for mislabelling a relationship. Individuals who use data beyond what the controller allows can commit the s.170 offence.

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168. A processor is liable only where it has breached its own duties or acted outside the controller's lawful instructions (Art 82(2)).