Controller and processor
A controller is the organisation that decides why and how personal data is processed; a processor handles personal data on a controller’s behalf and on its instructions. Most organisations are both: controller of their own staff and customer data, processor of the data their customers put into the service they run.
- Clauses
- EU GDPR Article 4(7) · EU GDPR Article 4(8) · UK GDPR Article 4(1) · UK GDPR Article 26 · UK GDPR Article 28(10)
Where the term appears
EU GDPR Article 4(7) defines the controller and EU GDPR Article 4(8) the processor; the UK text holds the same definitions as points (7) and (8) of UK GDPR Article 4(1). Two organisations that decide purposes and means together are joint controllers and must set out who does what (UK GDPR Article 26). A processor needs a written contract with set terms, which the processors and contracts page lists.
The facts decide, not the label
Auditors and regulators read what each party actually does. A contract that calls your supplier a processor does not make it one if it uses the data for its own product analytics. A processor that starts deciding its own purposes and means becomes a controller for that processing (UK GDPR Article 28(10)), with every controller duty that follows. The same tests and article numbers apply under EU GDPR.
How Sted uses it
- Sted treats UK GDPR, and separately EU GDPR, as applying when you process any personal data and are established in that territory or offer goods or services to, or monitor, people there; it reads your controller and processor roles from your processing activities, notes when an Article 27 representative is needed, and holds its confidence at medium until a processing activity is recorded.
- Sted’s knowledge base includes a Supplier Approval Record (REC-SAR) under the Supplier Approval and Management Procedure (PRC-SAMP), which records the supplier’s criticality, the information security and data protection review, and whether its data processing agreement is signed and holds the required processor terms.
- Records are part of the Full Management System plan.
Related terms
- Personal data: what both roles handle.
- Lawful basis: the controller chooses it; the processor follows.
- Records of processing activities (ROPA): controllers and processors each keep one.
- International transfer: a processor abroad is a common source of one.
- Personal data breach: a processor must tell its controller without undue delay.