Data Controller
An entity that determines the purposes and means of processing personal data.
Full Definition
Under GDPR and similar frameworks, a Data Controller is a natural or legal person who determines why (the purpose) and how (the means) personal data is processed. Controllers bear primary accountability for compliance — they must establish a lawful basis, respond to data subject rights, conduct DPIAs, maintain processing records, and ensure any processors they appoint offer sufficient guarantees. In India's DPDP Act, the equivalent concept is the 'Data Fiduciary'. Controllers can be distinguished from processors, who only process data on behalf of and under instructions from a controller.
How each law treats it
The natural or legal person who determines the purposes and means of processing. The controller carries primary accountability for Article 5–10 compliance.
DPDP uses 'Data Fiduciary' for the same role. All significant obligations (notice, consent, DSR, breach, DPIA, DPO under SDF designation) sit on the Fiduciary.
'Business' is the controller-equivalent. The CCPA definition is revenue-threshold-based (currently $25M + specific data-volume tests) rather than role-based.
In practice
- A single legal entity can be a controller for one activity and a processor for another; map activity-by-activity.
- Joint controllers must have an Article 26 arrangement in place that allocates responsibilities between them. The GDPR requires the arrangement to be made available to data subjects.
- The commercial 'customer / vendor' line often does not match the controller/processor line; your SaaS vendor processing HR data is a processor regardless of who's paying whom.
Common pitfalls
- Agreeing to be the controller in the contract while in substance the counterparty is making the processing-purpose decisions.
- Treating 'controller of controllers' arrangements as processor relationships — the DPA will fail an Article 28 review and the GDPR will treat it as a Chapter V transfer.
- Hard-coding 'controller' into a template DPA — some activities (payroll, security monitoring, telemetry) are processor relationships even inside a group company.
Frequently asked questions
Is a SaaS vendor always a processor?+
Usually yes — the vendor processes customer data on the customer's instructions. The vendor flips to controller for its own ancillary processing (service telemetry, security monitoring, aggregated analytics), which should be disclosed separately in the DPA.
What's the difference between a joint controller and a controller-of-controllers?+
Joint controllers jointly determine purposes and means and share accountability (GDPR Article 26). Controllers-of-controllers independently determine purposes and share data under a lawful basis — each is accountable for their own processing.
Can an individual be a controller?+
Yes. The GDPR's household exemption excludes purely personal activities, but an individual running a business or acting outside the household context is a controller like any legal person.
Related terms
Data Processor
An entity that processes personal data on behalf of and under the instructions of a Data Controller.
Data Fiduciary
The Indian equivalent of a Data Controller under the DPDP Act — an entity that determines the purposes and means of processing personal data.
Lawful Basis
A legal justification under GDPR for processing personal data — one of six bases must apply before processing can begin.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes