The Assurance Desk
What is the difference between controller and processor?
The controller makes the key decisions about the use of data. The processor acts for the controller and under its authority. Start with the purpose: who decided what the data would be used for?.
| Role | What it means |
|---|---|
| Controller | Decides why and how personal data is used. |
| Processor | Uses personal data on behalf of the controller. |
| Joint controllers | Decide the purposes and means together for shared purposes. |
| Employee doing their job | Acts as part of the controller, not as a separate processor. |
Can you show a simple example?
The ICO uses a gym sending invitations through a printing company. The gym is the controller for that use of personal data. The printer is the processor because it uses the data only on the gym’s instructions.
The ICO’s gym and printer example
- Gym Controller for the invitation data.Gives instructions
- Printing company Processor following those instructions.
Does choosing the technology make an IT firm a controller?
Not necessarily. The ICO gives an example of an IT firm storing a bank’s archived data. The firm has freedom over technical storage decisions, but remains a processor for the bank’s data.
The key limit is the wider purpose. A processor cannot decide what the personal data is for or which types should be collected. Some technical choices can remain with the processor where the arrangement allows.
Is every supplier a processor?
No. A specialist service provider that uses data under its own professional obligations acts as a controller for that work. Being paid to provide a service does not, by itself, settle the role.
Look at the actual use of the data. Who makes the key decisions for that activity? A supplier label is less useful than a clear description of the work and the authority behind it.
Can a company have more than one role?
Yes, for different activities. It can be a controller for one use of data and a processor for another. It cannot hold both roles for the same processing activity.
Joint controllers decide the purposes and means together. Having the same data is not enough: organisations using it for different purposes are not joint controllers just because the data overlaps.
What to do
- Choose a specific use of personal data to examine.
- Ask who decides its purpose and the key means of using it.
- Ask whether the other party acts on that organisation’s behalf or for its own purposes.
- Record the role for that activity and repeat the check for other uses.
Common questions
Are our employees data processors?
No. When employees act within their duties, they act as part of the controller itself.
Are we joint controllers because we share data?
Not just because the data is shared. Joint controllers decide the purposes and means together for the same or shared purposes.
Can a processor choose technical details?
Yes, within the arrangement. The ICO’s bank storage example keeps the IT firm as a processor despite its technical choices. The controller keeps the key decisions about purpose and data types.
Where next
Sources
- ICO, What are ‘controllers’ and ‘processors’?, checked 7 October 2026
- ICO, How do you determine whether you are a controller or processor?, checked 7 October 2026
This is an independent editorial guide, not legal advice.