{"head":{"title":"What Is a Data Controller Under the GDPR? | OceanLab","description":"Under the GDPR, a data controller decides why and how personal data is processed. How it differs from a processor, its duties and mistakes.","canonical":"https://oceanlab.in/glossary/data-controller"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"data controller","path":"/glossary/data-controller"}],"slug":"data-controller","term":"Data controller (GDPR)","aka":["controller"],"category":"Compliance","short":"Under the GDPR, the organisation that decides why and how personal data is processed, alone or jointly with others.","body":[["GDPR Article 4(7) defines the controller as the person or body that, alone or jointly with others, determines the purposes and means of processing personal data. Article 4(8) defines the ",{"href":"/glossary/data-processor","text":"processor"}," as one that processes personal data on behalf of the controller."],["The controller carries most of the duties: having a ",{"href":"/glossary/lawful-basis","text":"lawful basis"}," for each use, telling people how their data is used, answering ",{"href":"/glossary/data-subject-request","text":"data subject requests"},", keeping data secure, and choosing processors that give sufficient guarantees."]],"why":["Knowing whether you are the controller or the processor for each kind of data decides which GDPR duties fall on you. A SaaS company is often both: controller for its own customer accounts and billing, processor for the data its customers put into the product."],"example":["A recruiting platform is the controller for the account details of the companies that sign up. For the candidate CVs those companies upload, the companies are controllers and the platform is their processor."],"inBuild":["A product build for EU users should mark, for each data type in the data model, who is the controller. That drives the privacy notice, the consent screens and the deletion and export features."],"mistakes":[["Calling yourself a processor while deciding how the data is used, for example to train your own models."],["Forgetting that joint controllers need an arrangement setting out who does what."],["Treating controller duties as a privacy policy only, not as features the product must have."]],"related":[{"href":"/glossary/data-processor","label":"Data processor (GDPR)","detail":"Under the GDPR, an organisation that processes personal data on behalf of a controller and only on its documented instructions."},{"href":"/glossary/dpa","label":"DPA (data processing agreement)","detail":"The contract the GDPR requires between a data controller and a processor that handles personal data for it."},{"href":"/glossary/lawful-basis","label":"Lawful basis (GDPR)","detail":"One of the six reasons listed in GDPR Article 6 that make processing personal data lawful, such as consent or a contract."},{"href":"/glossary/data-subject-request","label":"Data subject request (DSR)","detail":"A request from a person to use one of their GDPR rights over their personal data, such as access, correction, deletion or a copy to take elsewhere."}],"tools":[],"links":[{"href":"/compliance/gdpr","label":"GDPR guide","detail":"Who the GDPR applies to and what it asks of software."},{"href":"/compliance","label":"Compliance guides","detail":"What each rule means for the software you build."},{"href":"/software","label":"Software by industry","detail":"Systems we build per industry, with guides and tools."}],"sources":[{"title":"Regulation (EU) 2016/679, the GDPR (Official Journal)","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}