Data Controller vs. Data Processor

A data controller determines why and how personal data is processed, retaining primary GDPR responsibility. A data processor acts on the controller’s instructions to process data. Misclassification can lead to compliance issues and fines. In banking, a merchant's bank may often function as both controller and processor.