Data Controller vs Data Processor: What’s the Difference?

Under the European General Data Protection Regulation (GDPR), your responsibilities and duties can vary from being a data controller or a data processor.

In this guide, we explain the difference between a data controller vs data processor and what are your duties in each case.

In short

What is a Data Controller?
Duties of a Data Controller
What is a Data Processor?
Duties of a Data Processor
Data Controller vs Data Processor: What’s the Difference?
What is an Example of a Data Controller and a Data Processor?
Is Google a Data Controller or Processor?

What is a Data Controller?

Under the GDPR, a data controller is defined as “any person or legal entity involved in determining the purpose and ways of processing the personal data.” In simpler terms, it’s the person or entity that decides what data should be collected and processed and why.

Duties of a Data Controller

In the eyes of the law, the controller is the main person responsible for GDPR compliance in his organization and the one who is liable in case of non-compliance. His duties are, among others:

Ensuring that personal data is processed lawfully, fairly, and transparently, as the main principles of the GDPR require.
Implementing the appropriate technical and organizational measures to comply with the GDPR and safeguard the data of its users.
Providing the necessary documents to users – such as a privacy policy and a cookie policy.
Maintaining documentation of processing activities, conducting Data Protection Impact Assessments for high-risk processing activities, and appointing a Data Protection Officer (DPO) if needed.

What is a Data Processor?

The GDPR defines the data processor as “any person or legal entity involved in processing personal data on behalf of the controller.” So, processors are basically entities chosen by the controller to handle part of the processing on their behalf.

The data controller and the data processor sign a contract – called Data Processing Agreement. This contract defines what the processor is responsible for and the conditions of the processing.

Duties of a Data Processor

While the main responsibility for compliance starts with the data controller, data processors still have duties and responsibilities, as outlined in Article 28 of the GDPR:

They must abide by the Data Processing Agreement (DPA) and they can’t use the data collected for their own purposes.
They must ensure that the highest security measures are met.
They commit to confidentiality and assist the controller in meeting the legal obligations required by the GDPR.

This doesn’t mean that data processors aren’t liable for anything. For example, if a data subject believes that his data has been processed unlawfully, he can seek compensation from either the data controller or the data processor.

Data Controller vs Data Processor: What’s the Difference?

The main difference between GDPR data controller vs data processor lies in their role: the data controller decides what data should be collected and how it should be processed, while the data processor handles the processing on the controller’s behalf.

What is an Example of a Data Controller and a Data Processor?

Let’s look at a few examples of data controllers and processors to better understand the difference.

Dropshipping: You own an e-commerce store that relies on dropshipping, meaning that you rely on a contractor to ship the orders to your customers. In this case, the contractor needs to process your customers’ personal data to send them what they purchased from you. You as the contractor are the data controller and dropshipping is the processor.
Cloud storage: An internet company collects user information via its website and stores it using an external cloud service. In this scenario, the internet company is the data controller and the organization running the cloud service is the data processor.
Payroll services: A company needs to process payroll for its employees (e.g., salary payments, tax deductions, and payslip generation). Instead of managing payroll internally, the company outsources the task to a third-party payroll provider. The company is the data controller and the payroll provider is the data processor.

In all these cases, both the data controller and processor need to sign a Data Processing Agreement, which defines the extent of their agreement.

Is Google a Data Controller or Processor?

Like many website owners, you may use Google products on your website or in your organization. So, you may be wondering: is Google my data processor?

The answer is, it depends.

Google acts as a data controller when it comes to the data it collects and processes for its own purposes. Some of this data may also come from your website if you use tools like Google Ad Manager or YouTube.

Google states: “We operate as a controller because we regularly make decisions on the data to deliver and improve the product”.

In other cases, Google can act as your data processor. For example, if your organization uses Google Workspace or Google Cloud, Google is your data processor – meaning that they can’t process your data for their own purposes, and you’ll need to enter a Data Processing Agreement with them.