Organisation that determines the purposes and means of processing personal data.
A data controller determines why and how personal data is processed—they decide the purposes and means of processing. Controllers have primary responsibility for GDPR compliance, including determining lawful basis, ensuring data subject rights, and reporting breaches. Most organisations are controllers for at least some data (employee data, customer data). Controllers can use processors but remain responsible for compliance.
Why It Matters
The DSC Perspective:
If you decide what data to collect and why, you're a controller with full GDPR responsibilities. Understand your controller obligations—you can't outsource compliance responsibility to processors.