Data Controller and Data Processor

The controller makes the key choices: what data to collect, for what purpose and for how long. It carries the main duties, including legal basis, transparency, rights requests and breach reporting. The processor, such as a payroll bureau or cloud host, acts on documented instructions and owes security duties and help to the controller, under a written contract. Roles follow the facts, not the labels in a contract. A supplier that starts deciding its own purposes becomes a controller. Two organisations that jointly set purposes and means are joint controllers and must agree who does what. India's DPDP Act uses the term data fiduciary for roughly the controller's role. Privacy teams map these roles before any vendor engagement. Whichever label applies decides who answers to the regulator and who gets sued.

A university hires a mailing house to print and send graduation invitations. The university decides who is invited and what the letter says, so it is the controller. The mailing house follows the university's file and instructions and may not use the addresses for its own marketing. If it did, it would be treated as a controller for that use.