# Who is a data controller, and who is a processor? Follow the decisions about the data, rather than the label on the contract. The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026. **The short answer.** A data controller decides why and how personal data is used. A processor uses it on the controller’s behalf. Work out the role for each activity, rather than giving the whole company a label that covers everything it does ([ICO, What are ‘controllers’ and ‘processors’?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/) and [ICO, How do you determine whether you are a controller or processor?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/how-do-you-determine-whether-you-are-a-controller-or-processor/), checked 7 October 2026). ## In this series - [Article 28: what must a processor contract say?](https://theassurancedesk.com/guides/article-28-processor-contract.md) ## What is the difference between controller and processor? The controller makes the key decisions about the use of data. The processor acts for the controller and under its authority. Start with the purpose: who decided what the data would be used for? ([ICO, What are ‘controllers’ and ‘processors’?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/), checked 7 October 2026). **The roles follow the work** | Role | What it means | | --- | --- | | Controller | Decides why and how personal data is used. | | Processor | Uses personal data on behalf of the controller. | | Joint controllers | Decide the purposes and means together for shared purposes. | | Employee doing their job | Acts as part of the controller, not as a separate processor. | Source: ICO, What are ‘controllers’ and ‘processors’?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/ (checked 7 October 2026) ## Can you show a simple example? The ICO uses a gym sending invitations through a printing company. The gym is the controller for that use of personal data. The printer is the processor because it uses the data only on the gym’s instructions ([ICO, What are ‘controllers’ and ‘processors’?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/), checked 7 October 2026). **The ICO’s gym and printer example** - Gym: Controller for the invitation data. (Gives instructions → Printing company) - Printing company: Processor following those instructions. This is the regulator’s example, not a finding about a named business. Source: ICO, What are ‘controllers’ and ‘processors’?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/ (checked 7 October 2026) ## Does choosing the technology make an IT firm a controller? Not necessarily. The ICO gives an example of an IT firm storing a bank’s archived data. The firm has freedom over technical storage decisions, but remains a processor for the bank’s data ([ICO, How do you determine whether you are a controller or processor?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/how-do-you-determine-whether-you-are-a-controller-or-processor/), checked 7 October 2026). The key limit is the wider purpose. A processor cannot decide what the personal data is for or which types should be collected. Some technical choices can remain with the processor where the arrangement allows ([ICO, How do you determine whether you are a controller or processor?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/how-do-you-determine-whether-you-are-a-controller-or-processor/), checked 7 October 2026). ## Is every supplier a processor? No. A specialist service provider that uses data under its own professional obligations acts as a controller for that work. Being paid to provide a service does not, by itself, settle the role ([ICO, What are ‘controllers’ and ‘processors’?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/) and [ICO, How do you determine whether you are a controller or processor?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/how-do-you-determine-whether-you-are-a-controller-or-processor/), checked 7 October 2026). Look at the actual use of the data. Who makes the key decisions for that activity? A supplier label is less useful than a clear description of the work and the authority behind it ([ICO, What are ‘controllers’ and ‘processors’?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/) and [ICO, How do you determine whether you are a controller or processor?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/how-do-you-determine-whether-you-are-a-controller-or-processor/), checked 7 October 2026). ## Can a company have more than one role? Yes, for different activities. It can be a controller for one use of data and a processor for another. It cannot hold both roles for the same processing activity ([ICO, How do you determine whether you are a controller or processor?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/how-do-you-determine-whether-you-are-a-controller-or-processor/), checked 7 October 2026). Joint controllers decide the purposes and means together. Having the same data is not enough: organisations using it for different purposes are not joint controllers just because the data overlaps ([ICO, What are ‘controllers’ and ‘processors’?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/), checked 7 October 2026). ## What to do 1. Choose a specific use of personal data to examine ([ICO, How do you determine whether you are a controller or processor?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/how-do-you-determine-whether-you-are-a-controller-or-processor/), checked 7 October 2026). 2. Ask who decides its purpose and the key means of using it ([ICO, What are ‘controllers’ and ‘processors’?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/) and [ICO, How do you determine whether you are a controller or processor?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/how-do-you-determine-whether-you-are-a-controller-or-processor/), checked 7 October 2026). 3. Ask whether the other party acts on that organisation’s behalf or for its own purposes ([ICO, What are ‘controllers’ and ‘processors’?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/), checked 7 October 2026). 4. Record the role for that activity and repeat the check for other uses ([ICO, How do you determine whether you are a controller or processor?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/how-do-you-determine-whether-you-are-a-controller-or-processor/), checked 7 October 2026). ## Common questions ### Are our employees data processors? No. When employees act within their duties, they act as part of the controller itself ([ICO, What are ‘controllers’ and ‘processors’?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/), checked 7 October 2026). ### Are we joint controllers because we share data? Not just because the data is shared. Joint controllers decide the purposes and means together for the same or shared purposes ([ICO, What are ‘controllers’ and ‘processors’?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/), checked 7 October 2026). ### Can a processor choose technical details? Yes, within the arrangement. The ICO’s bank storage example keeps the IT firm as a processor despite its technical choices. The controller keeps the key decisions about purpose and data types ([ICO, How do you determine whether you are a controller or processor?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/how-do-you-determine-whether-you-are-a-controller-or-processor/), checked 7 October 2026). ## Where next - [First DPO or AI policy](https://theassurancedesk.com/best/first-appointment.md) - [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md) - [Customer security questionnaires: what they ask and how to answer](https://theassurancedesk.com/guides/customer-security-questionnaires-what-they-ask-and-how-to-answer.md) - [Do you have to pay the ICO fee?](https://theassurancedesk.com/guides/ico-data-protection-fee.md) - [A data breach has happened: who do you call?](https://theassurancedesk.com/guides/data-breach-who-to-call.md) - [Article 28: what must a processor contract say?](https://theassurancedesk.com/guides/article-28-processor-contract.md) - [Does GDPR apply to small businesses and sole traders?](https://theassurancedesk.com/guides/gdpr-small-business-sole-trader.md) - [A DPIA for an AI tool: when and how](https://theassurancedesk.com/guides/dpia-for-an-ai-tool.md) - [What must your UK privacy notice say?](https://theassurancedesk.com/guides/what-your-privacy-notice-must-say.md) ## Sources - ICO, What are ‘controllers’ and ‘processors’?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/ (checked 7 October 2026) - ICO, How do you determine whether you are a controller or processor?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/how-do-you-determine-whether-you-are-a-controller-or-processor/ (checked 7 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.