What is a data controller?
Definition
A data controller is the person or organisation that decides why and how personal data is processed. Under the UK GDPR it carries the main legal responsibility for protecting that data.
- Category
- Privacy
- Also called
- controller, personal data controller
- Last updated
The UK GDPR defines a controller as the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. In plain terms: the controller decides why your data is being used and how.
If a shop collects your name and address to deliver an order, the shop is the controller. The courier that receives the address to carry out the delivery may be a processor, depending on who decides what it does with the data.
Controller vs. processor
The ICO explains the difference like this. A controller makes the overarching decisions, such as what types of personal data to collect and what it will be used for. A processor acts on the controller's behalf and can make day-to-day technical choices, but can't make those big decisions. The ICO also says the label in a contract doesn't settle it: an organisation that determines the purposes and means is a controller however the contract describes it.
Who can be a controller
A company or other legal entity, a public authority, or an individual such as a sole trader. If two or more controllers jointly decide the purposes and means for the same personal data, they are joint controllers. They aren't joint controllers if they process the same data for different purposes.
Why it matters to you
Controllers hold the highest level of compliance responsibility, and they're also responsible for the compliance of their processors. When you want to see your data, correct it, or have it deleted, the controller is who you ask. Its name and contact details should be in its privacy notice.
How to protect yourself
- 1
Find the controller in the privacy notice
Look for the organisation's name and contact details, usually in the privacy notice or at the bottom of the website. That's where requests go.
- 2
Make a subject access request
You can ask a controller what personal data it holds on you and how it uses it. Put the request in writing and keep a copy.
- 3
Ask for correction or deletion
If the data is wrong or no longer needed, ask the controller to fix or erase it. If it doesn't respond properly, you can complain to the ICO.
- 4
Check who it shares data with
The privacy notice should name the types of organisation that receive your data. Data broker and people-search sites are controllers too, and each has its own opt-out. Serus finds where your address and phone number are listed and removes them for you.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is the difference between a data controller and a data processor?
The controller decides why and how personal data is processed. The processor handles it on the controller's behalf and can make technical day-to-day choices, but not the overarching decisions.
Can an individual be a data controller?
Yes. The ICO says a controller can be a company or other legal entity, or an individual such as a sole trader.
What are joint controllers?
Two or more controllers who jointly determine the purposes and means of processing the same personal data. They aren't joint controllers if they use the same data for different purposes.
Sources
Something wrong or out of date? Tell us and we'll re-check it.