Data controller vs Data processor

Why they differ

The controller decides why and how data is used; the processor only handles it on the controller's written instructions.

Data controller

Compliance & regulation

The organisation that decides why and how personal data is used, and so carries the main legal duty under GDPR.

Formal

Under GDPR Article 4(7), the person or body that, alone or jointly with others, decides the purposes and means of processing personal data; under Article 24 it must be able to show that the processing complies with the regulation.

In plain English

Like someone who hires a moving firm - the movers carry the boxes, but you chose what to move and where, so it is on you if the wrong things end up in the wrong place.

In practice

A Danish municipality picks a learning platform for its schools; the municipality, not the platform supplier, is the controller, so it must tell parents what is collected and answer their requests for access.

Why it matters

Data often passes through many hands; fixing one party as answerable means people know whom to ask, and the authority knows whom to hold liable when data is misused or lost.

Data processor

Compliance & regulation

An outside party that handles personal data on behalf of another organisation and only as that organisation instructs.

Formal

Under GDPR Article 4(8), a person or body that processes personal data on behalf of a controller; it may act only on the controller's documented instructions and has its own duties to keep the data secure.

In plain English

Like a laundry that washes a hotel's sheets - it takes good care of them and sends them back, but it has no say in what the hotel uses them for.

In practice

A Danish payroll bureau runs salaries for 200 small firms; for each of them it is a processor, allowed to use staff data only for payroll and not, say, to sell insurance offers to the employees.

Why it matters

If a processor starts using the data for its own ends, it becomes a controller in its own right and answers for that use; the role stops handing work to outsiders from becoming a loophole.

Shared connections

Data processing agreement (DPA)GDPR