Data controller (GDPR)
Also called controller.
Under the GDPR, the organisation that decides why and how personal data is processed, alone or jointly with others.
Last updated
What it is.
GDPR Article 4(7) defines the controller as the person or body that, alone or jointly with others, determines the purposes and means of processing personal data. Article 4(8) defines the processor as one that processes personal data on behalf of the controller.
The controller carries most of the duties: having a lawful basis for each use, telling people how their data is used, answering data subject requests, keeping data secure, and choosing processors that give sufficient guarantees.
Why it matters
Knowing whether you are the controller or the processor for each kind of data decides which GDPR duties fall on you. A SaaS company is often both: controller for its own customer accounts and billing, processor for the data its customers put into the product.
In a product build
A product build for EU users should mark, for each data type in the data model, who is the controller. That drives the privacy notice, the consent screens and the deletion and export features.
Common mistakes.
- 01
Calling yourself a processor while deciding how the data is used, for example to train your own models.
- 02
Forgetting that joint controllers need an arrangement setting out who does what.
- 03
Treating controller duties as a privacy policy only, not as features the product must have.
Read the official text.
Primary sources this definition is based on.
- Regulation (EU) 2016/679, the GDPR (Official Journal)checked 2026-10-25
Related terms.
- Data processor (GDPR)Under the GDPR, an organisation that processes personal data on behalf of a controller and only on its documented instructions.
- DPA (data processing agreement)The contract the GDPR requires between a data controller and a processor that handles personal data for it.
- Lawful basis (GDPR)One of the six reasons listed in GDPR Article 6 that make processing personal data lawful, such as consent or a contract.
- Data subject request (DSR)A request from a person to use one of their GDPR rights over their personal data, such as access, correction, deletion or a copy to take elsewhere.
Guides and pages
Browse the full glossary or read answers to common questions.
