Data Controller

A data controller is the entity that, alone or jointly with others, determines the purposes and means of processing personal data. This definition identifies them as the principal decision-maker responsible for why and how data is processed.

Data controller responsibilities include establishing an appropriate basis for processing, providing transparent privacy notices, ensuring data accuracy, implementing security safeguards, and responding to the individual or data subject rights requests. They also hold accountability for the actions of any third-party processors they engage.

The main distinction in the data controller vs processor relationship lies in decision-making. The controller determines the why and how of processing, while the processor acts on behalf of the controller, following their instructions. The controller bears primary accountability, while the processor typically has more limited obligations defined by contract and applicable requirements.

Controller compliance obligations commonly involve adhering to principles such as data minimization and purpose limitation, maintaining records of processing activities, conducting impact assessments for higher-risk processing, and managing data breach response and notifications when required.

To determine the data controller role, ask who decides the purpose of the data collection and how it will be processed. If an organization decides to collect data to achieve a specific business outcome or benefit and directs others on how to handle it, that organization is the controller.

Accountability measures include adopting internal data protection policies, assigning responsibility for privacy oversight where required, conducting regular reviews or audits, and implementing privacy by design and privacy by default into systems. To operationalize policy governance, some organizations use tools like WatchDog Security's Policy Management module to maintain approved privacy/security policies, track versions and review cycles, and record acknowledgements. These measures demonstrate that the organization takes its data controller duties seriously.

When two or more entities jointly determine the purposes and means of processing, they are joint data controllers. They should enter into an arrangement defining their respective responsibilities for compliance, particularly regarding the exercising of rights by the individual or data subject and the provision of information.

Data controllers can face serious consequences for non-compliance, which may include monetary penalties, orders to change or stop certain processing, contractual and civil claims, and significant reputational damage. The specific outcomes depend on the applicable laws, sector rules, and the severity of the incident.