Under Art. 4(7) GDPR, the controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data. The controller bears primary responsibility for compliance with the GDPR.
What is a controller?
The controller bears central obligations — among them accountability (Art. 5(2)), the record of processing activities (Art. 30), data subject rights (Art. 12-22), data breach notification (Art. 33-34), the data protection impact assessment (Art. 35) and the appointment of a data protection officer (Art. 37).
A controller is NOT the individual employee who handles the data — that employee acts on behalf of the controller.
Practical example
Examples:
Mustermann GmbH is the controller for employee data (personnel files)
Mustermann GmbH is the controller for customer data (CRM)
A tax adviser is a controller in their own right (BayLDA 2024) — not a processor
In a group structure: each subsidiary is a controller in its own right (unless purposes and means are determined jointly — then joint controllership under Art. 26)
Frequently asked questions
What is the difference from a data processor?
The controller determines the purposes and means. The data processor carries out the processing on the controller's behalf, without determining purposes of its own. A data processing agreement (Art. 28) governs the relationship.
Can several controllers be jointly responsible?
Yes, under Art. 26 GDPR. Joint controllership requires a joint controller arrangement. Example: the operator of a Facebook fan page and Facebook (CJEU C-210/16).
Who is liable in the event of a breach?
Primarily the controller. Fines and damages. The data processor is additionally liable for breaches of its own obligations.
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are compliance specialists, not a law firm. For legally binding advice, consult a qualified lawyer.