What decides whether an organisation is a controller or processor?
A controller determines the purposes and essential means of processing. A processor handles personal data on the controller’s behalf and documented instructions. The facts of each processing activity control the role.
Operating sequence
- 01
Describe the processing purpose, data, people, retention, recipients, and essential system choices.
- 02
Record who makes each essential decision and who can change it.
- 03
Align notices, contracts, instructions, sub-processing, rights handling, and incident duties to the resulting role.
Failure modes to avoid
- Assigning one role to a company for every activity.
- Assuming a “processor” contract overrides actual independent decisions.
- Ignoring joint control where parties jointly shape purpose and essential means.
The source remains the authority.
EDPB Guidelines 07/2020 on controller and processor concepts