What is a data controller or a data processor? (2025)

Home
About us
Learn more about the role of the European Commission, its leadership and corporate policies
Discover more
- The President
  College of Commissioners
  Departments and executive agencies
  Staff
  See all
- In strategy and policy
  In law
  In budget and funding
  In international relations
  See all
- Transparency
  Ethics and Good Administration
  People first – Modernising the European Commission
  The Commission’s use of languages
  See all
- Contact
- Our priorities
  Learn how the EU is building a sustainable, digital, and inclusive future through its seven key priorities.
  Discover more
  Competitiveness
  Security and defence
  European social fairness
  Quality of life
  Democracy and our values
  A global Europe
  EU budget and reform
- News and media
  See Also
  Is Ray Tracing Worth the FPS Hit? 36 Game Performance Investigation
  Stay up to date with the European Commission's news. Discover the latest updates, stories, multimedia and other valuable material
  Discover more
  News
  Press corner
  Visual stories
  Audiovisual portal
  Publications
  Statistics
  Learning corner
  Eurobarometer
  EU law
  See all
  Topics from A to Z
  Discover EU policies designed to bring benefits to citizens, businesses and other stakeholders in the EU
  Discover more
  Your rights in the EU
  Human rights in non-EU countries
  Recipients and results of EU aid
  How we provide aid
  Ensuring aid effectiveness
  See all
  Doing business in the EU
  Financial services
  Economic recovery
  Economic forecasts and surveillance
  The European Semester
  Economic and Monetary Union
  The euro area
  The benefits of the euro
  See all
  Skills and qualifications
  Study or teach abroad
  Teaching methods and materials
  Policy on educational issues
  Set up projects for education and training
  See all
  A European Green Deal
  Overall targets and reporting
  Implementation in EU countries
  International cooperation
  Standards, tools and labels
  See all
  Financial support for projects
  Projects and results
  Countries, regions, cities
  Cooperation between border regions
  See all
  Food safety and quality
  Farming
  Oceans and fisheries
  Forestry
  Sustainable agriculture
  Agricultural trade
  Plants and plant products
  Animals and animal products
  See all
  Law-making process
  Track law-making
  Search law
  Law by topic
  Application of EU law
  Cross-border cases
  Judicial training and professional networks
  Find a legal professional
  See all
  Living in another EU country
  Consumer rights and complaints
  Culture, Heritage, Sport in the EU
  Working in another EU country
  Employment opportunities
  Travelling in the EU
  Travelling for non-EU nationals
  Emigrating to the EU
  See all
  Strategy on research and innovation
  Law and regulations
  Knowledge: publications, tools and data
  Funding
  Projects
  Partners, networking
  Research by area
  See all
  Get involved
  Share your views on EU laws and policies, debate Europe's future and find funding for your EU projects.
  Discover more
  Have your say
  European Citizens’ Panels
  European Citizens' Initiative
  Petition the EU
  See all
  Job opportunities at the Commission
  Working for the EU civil service
  Traineeships
  Volunteering
  See all
  Funding and tenders
  Events
  Visitors' Centre
  Experience Europe exhibition centre
  See all
  European Commission on social media
  
  Home
  Law
  Law by topic
  Data protection
  Rules for business and organisations
  Obligations
  Controller/processor
  What is a data controller or a data processor?
  
  Page contents
  
  Answer
  The data controller determines the purposes for which and the means by which personal data is processed. So, if your company/organisation decides ‘why’ and ‘how’ the personal data should be processed it is the data controller. Employees processing personal data within your organisation do so to fulfil your tasks as data controller.
  Your company/organisation is a joint controller when together with one or more organisations it jointly determines ‘why’ and ‘how’ personal data should be processed. Joint controllers must enter into an arrangement setting out their respective responsibilities for complying with the GDPR rules. The main aspects of the arrangement must be communicated to the individuals whose data is being processed.
  The data processor processes personal data only on behalf of the controller. The data processor is usually a third party external to the company. However, in the case of groups of undertakings, one undertaking may act as processor for another undertaking.
  The duties of the processor towards the controller must be specified in a contract or another legal act. For example, the contract must indicate what happens to the personal data once the contract is terminated. A typical activity of processors is offering IT solutions, including cloud storage. The data processor may only sub-contract a part of its task to another processor or appoint a joint processor when it has received prior written authorisation from the data controller.
  There are situations where an entity can be a data controller, or a data processor, or both.
  
  Examples
  Controller and processor
  A brewery has many employees. It signs a contract with a payroll company to pay the wages. The brewery tells the payroll company when the wages should be paid, when an employee leaves or has a pay rise, and provides all other details for the salary slip and payment. The payroll company provides the IT system and stores the employees’ data. The brewery is the data controller and the payroll company is the data processor.
  Joint controllers
  Your company/organisation offers babysitting services via an online platform. At the same time your company/organisation has a contract with another company allowing you to offer value-added services. Those services include the possibility for parents not only to choose the babysitter but also to rent games and DVDs that the babysitter can bring. Both companies are involved in the technical set-up of the website. In that case, the two companies have decided to use the platform for both purposes (babysitting services and DVD/games rental) and will very often share clients’ names. Therefore, the two companies are joint controllers because not only do they agree to offer the possibility of ‘combined services’ but they also design and use a common platform.
  
  References
  References: Article 4(7) and (8), Articles 24, 26, 28 and 29 and Recitals (74), (79) and (81) of the GDPR
  Article 29 Working Party Opinion 1/2010 on the concepts of 'controller' and 'processor' (WP 169)

What is a data controller or a data processor? (2025)

Answer

Examples

References